There was speculation, following the introduction of the Senior Managers Regime (SMR) in the U.K., that other regulators would follow suit and introduce similar regimes in their countries. It looks as if Hong Kong will now be the first to do so.
On 16 December 2016, the Hong Kong Securities and Futures Commission (SFC) announced it was taking steps to enhance the senior management regime of licensed corporations. It issued a circular in which it sets out how it envisages promoting senior individuals’ awareness of their regulatory obligations and how it plans to render them accountable for misconduct falling within their areas of responsibility.
Managers-in-Charge of Core Functions
The new rules will not apply to banks but will apply to other entities regulated by the SFC and will also cover senior executives involved in the day-to-day running of SFC-regulated activities who are based abroad. A cornerstone of the new regime, which is likely to come into force later in 2017, is the creation of a new category of Managers-in-Charge of Core Functions (MICs). The relevant 8 functions are:
- Overall management oversight
- Key business line
- Operational control and review
- Risk management
- Finance and accounting
- Information technology
- Anti-money laundering and counter-terrorist financing
Although these functions do not correspond precisely with the equivalent SMR functions in the U.K. (and there are not as many of them), there are substantial overlaps.
Who to point the finger at?
The key concern that appears to be driving this new initiative is that the SFC doesn’t always know which individuals are responsible for key decisions, many of which may be taken by executives based outside Hong Kong. The circular quotes Principle 9 of the SFC’s existing Code of Conduct, which states that the
senior management of a licensed or registered person should bear primary responsibility for ensuring the maintenance of appropriate standards of conduct and adherence to proper procedures by the firm. In determining where responsibility lies, and the degree of responsibility of a particular individual, regard shall be had to that individual’s apparent or actual authority in relation to the particular business operations….
In other words, “unless we know who to the point the finger at we can’t do our job as regulator as effectively as we need to.” So in order to put that right, Paragraph 31 of the circular sets out the information the SFC will require in respect of each new MIC as follows:
- full name
- identification information
- job title 
- place of residence
- the core function(s) which he or she is in charge of
- the job title(s) of the person(s) to whom he or she reports within the corporation and, if applicable, within its corporate group
A “responsibilities map”
The context for this new information requirement about individuals is created by the information requirements for each regulated entity as a whole, which are set out in paragraph 32 of the circular:
In addition, the corporation should submit an organisational chart depicting its management and governance structure, business and operational units and key human resources and their respective reporting lines. The chart should capture all MICs engaged by the corporation, their respective reporting lines (as described in paragraph 31, item (f)) and the job titles of the persons reporting directly to these MICs in relation to the operations of the corporation.
To underline the point, the circular states that:
… a licensed corporation should adopt a formal document, approved by the Board, clearly setting out the management structure of the corporation, including the roles, responsibilities, accountability and reporting lines of its senior management personnel. (Paragraph 28)
Readers will recognize all this as a close cousin of the Responsibilities Map requirements under the SMR.
The SFC intends to commence the information collection initiative from all regulated entities on 18 April 2017. It says it then plans to “…organise industry workshops to introduce the new features of the SFC Online Portal for submitting the MIC information and organisational charts” and that it expects “…licensed corporations to submit the MIC information and organisational charts within three months from the commencement date (ie, on or before 17 July 2017).”
By October 2017 it expects those new MICs who occupy positions as responsible officers to have applied for approval.
What does all this mean for the personal accountability of individuals?
It may be partly because the SFC considers its existing enforcement powers adequate, that it does not (for the present) seem to have in mind implementation of the enhanced duties and responsibilities imposed under the SMR by the FCA in the UK. Alternatively, it may be that there was less political pressure in Hong Kong than there was in the UK following the financial crisis of 2008 to introduce tougher powers. For example, there is to be no new “Duty of responsibility” imposed on senior managers nor any express requirement to tell the regulator that about which they would expect to be kept informed nor indeed any other enhanced conduct rules for senior managers.
That is not to say that the SFC is a toothless tiger. On the contrary, it already has plenty of weapons in its arsenal. For example, it has the power to discipline licensed individuals with civil sanctions including public censure, license restrictions or outright bans, and fines of up to HK$10 million ($1.3 million) for each breach of the rules. Nor should it be forgotten that the SFC has flexed its muscles in the past. See for example my earlier blog on the interesting Hontex decision. In addition there are of course the very real reputational and financial consequences of becoming caught up in a full scale regulatory investigation the first place.
In the run up to implementation of the new regime, regulated entities in Hong Kong will have their work cut out identifying and agreeing the relevant roles and responsibilities. During this time the individuals who are to be tagged for the first time with these specific responsibilities would do well to consider afresh their personal liability protections in the form of appropriate and carefully crafted indemnities and insurances.