SFC encourages the industry to keep in mind the ‘spirit’ of the new Internal Investigation Disclosure Requirement introduced to halt the ‘roll’ of ‘bad apples’

On 17 June 2019, Ms Julia Leung (Deputy Chief Executive Officer, Intermediaries) and Mr Wilson Lo (Senior Director, Licensing) discussed the recent initiative by the Securities and Futures Commission (SFC) to halt the ‘roll’ of ‘bad apples’ within the financial services industry at the 2019 SFC Compliance Forum (Forum). The SFC encourages industry participants to have regard to the spirit of the Internal Investigation Disclosure Obligation when assessing whether internal investigations in relation to outgoing licensed individuals should be disclosed to the SFC.

The SFC’s comments are helpful in providing some clarity as to what types of behaviour would be disclosable under the Internal Investigation Disclosure Obligation. However, in implementing this requirement, it will be important for the industry to consider carefully how to interpret comments against the detail set out in the SFC’s frequently-asked questions (FAQs).

Background
 

On 1 February 2019, the SFC announced significant changes to its licensing forms and processes (Licensing Reforms). Included in these changes was the introduction of the Internal Investigation Disclosure Obligation, requiring licensed corporations (LCs) and registered institutions (RIs) to identify whether departing licensed representatives, responsible officers (ROs) and executive officers (EOs) were the subject of an internal investigation in the six months prior to their departure.

We have been closely involved with industry discussions on this new requirement, led by the Asia Securities Industry & Financial Markets Association (ASIFMA). Ms Leung commented on the industry’s reaction to the Licensing Reforms during the Forum, observing that following the introduction of the Licensing Reforms (which included 400+ pages of gazetted forms), industry feedback was overwhelmingly focused on the need for further guidance to clarify the meaning of ‘internal investigation’ in the context of the Internal Investigation Disclosure Obligation.

Comments from the SFC at the 2019 SFC Compliance Forum
 

During a plenary panel discussion on the importance of governance frameworks ‘as a driving force for a culture of accountability and behavioural change’, Ms Leung and Mr Lo provided further clarification on the Internal Investigation Disclosure Obligation and discussed how firms can best comply with the enhanced notification requirements.

Meaning of ‘internal investigation’

The SFC made clear that it will not provide an exhaustive list of disclosable internal investigations, and that firms should have regard to the spirit of the requirements when assessing whether an internal investigation is disclosable under the relevant section of the SFC Online Portal and Form 5U.

In describing the spirit of the regulation, the SFC referred to its recent FAQs and reminded firms that the requirement forms part of a broader focus by the SFC on the fitness and properness of licensed individuals, and driving misconduct out of the industry more generally.

Why the new disclosure requirement was introduced  

The SFC provided some context on the introduction of the new disclosure obligation, explaining that the SFC had come across several instances where firms had misrepresented the reason for cessation of employment, when notifying the regulator that an individual was no longer acting as a licensed individual.

Mr Lo referred to one example (as described in the SFC’s May 2019 Compliance Bulletin) where an LC terminated the employment of a staff member who was found to be misappropriating client money. However, the LC reported the reason for cessation as ‘job rotation’ when submitting the notification form to the SFC, and provided no information in relation to the misappropriation of client funds. Ultimately, the LC and the responsible officer declaring the information in the notification form to be complete, true and correct were convicted and fined under section 384 of the Securities and Futures Ordinance, (which provides that a person commits an offence if the information he or she provides in a notification to the SFC is false or misleading, and the individual knows, or is reckless as to whether, the information is false and misleading).

Following misrepresentations such as these, and consistent with its ‘front load’ approach to regulation, the SFC introduced the Internal Investigation Disclosure Obligation in order to proactively ask firms if an individual was subject to an internal investigation within the six months prior to their cessation, instead of ‘passively waiting for disclosures’.

How the SFC will use the information provided to it by firms

The SFC confirmed that it will not disclose information obtained under the new obligation to any other persons, including the outgoing employee and his/her prospective employer, unless otherwise permitted by law (for example, pursuant to a court order).

However, the SFC did acknowledge that, under certain circumstances, the Licensing Division may need to ask firms several follow-up questions in relation to the internal investigation, and could potentially refer matters to the Enforcement Division for further investigation.

Remaining uncertainties
 

Having regard to the spirit of the requirement – ‘false positives’ remain in scope

The SFC’s comments have gone some way in addressing industry concerns that the Internal Investigation Disclosure Obligation, when read widely, could result in the SFC receiving an unwieldy volume of irrelevant disclosures that would not assist the SFC in achieving its objectives of reducing misconduct across the financial services industry.

It is now clear that the SFC is most concerned with information on internal investigations covering matters that are sufficiently serious to be of interest to the SFC, such as misconduct or alleged misconduct that:

• raises fitness and properness concerns under the SFC’s Fit and Proper Guidelines;

• has an adverse market or client impact; or

• involves fraud or corruption.

However, ‘false positive’ findings still remain in scope of the Internal Investigation Disclosure Obligation. Under Question 5 of the FAQs, firms are required to notify the SFC of an investigation even if no negative findings were made against the employee in question. In this situation, firms must provide a brief description of the nature of the matter, and an explanation about the basis of its conclusion. 

The meaning of ‘investigative action’

Ms Leung and Mr Lo reiterated during the panel discussion that the SFC will not formally define ‘investigation’. However, it is clear from the FAQs that an investigation (as that term is commonly understood) is simply one example of what should be disclosed under the Internal Investigation Disclosure Obligation, with routine checks, inquiries, reviews, examinations and inspections also in scope. 

The key element to consider is whether an ‘investigative action’ has taken place, as Question 3 of the FAQs emphasises that ‘[t]he SFC expects licensed corporations to proactively disclose information of all investigative actions (no matter how they are described) to the SFC’.

In our view, the meaning of ‘investigative action’ is critical in determining whether the Internal Investigation Disclosure Obligation has been triggered. Interestingly, the term ‘investigative action’ was not mentioned by panellists during the Forum.

As such, to ensure that internal investigation policies are sufficiently localised to Hong Kong regulatory standards, it is important for firms to settle on a clear understanding of the meaning of ‘investigative action’ in the context of their business and operations.

Next steps
 

As made clear by Ms Leung and Mr Lo during the Forum, complying with the spirit of the Internal Investigation Disclosure Obligation involves having regard to the fact that the SFC introduced these ‘front load’ measures to enhance its gatekeeping function and the SFC’s ultimate objective to ensure that those working in the industry are fit and proper.

In light of these remarks, practical steps that firms can now take to best comply with the Internal Investigation Disclosure Obligation include: 

• updating internal policies to make clear what an ‘investigative action’ constitutes within the firm (and therefore what is disclosable) and how it expects employees to conduct ‘investigative actions’ (for example, by setting out clear guidelines relating to record keeping and documentation);
• formulating a clear framework or criteria to be used by those responsible for making a materiality assessment (as per guidance from Question 4 of the FAQs), in order to minimise litigation risk and ensure that all individuals subject to internal investigations are assessed fairly and consistently; and
• considering how different departments within the organisation (including Legal, Compliance, Human Resources or Operational Risk) can share information internally regarding ‘investigative actions’, whilst also protecting the privacy of licensed individuals within the organisation.