The latest enforcement actions underscore the Hong Kong Securities and Futures Commission’s (SFC) self-disclosure approach under Section 12.5 (a) of the Code of Conduct for individuals licensed or registered with the SFC
“Intermediaries must report problems to us immediately – not after an internal investigation, not after obtaining legal advice, but immediately without leaving out any important information,” said Mark Steward, the then Executive Director of Enforcement of the SFC, in a 2015 press release.
The news wasn’t new. It reflects Section 12.5 (a) of the Code of Conduct, which states that the SFC requires immediate reporting of “any material breach, breach or non-compliance …”. or if it suspects such violation, violation or non-compliance ”.
Over the years, the SFC has the importance of timely self-reports and for registered institutions the requirement of an immediate report to the Hong Kong Monetary Authority (HKMA) and the SFC1. The SFC has also strongly recommended that intermediaries use the WINGS platform (an online submission procedure introduced at the beginning of 2019), which enables the submission of reports in accordance with Paragraph 12.5 using standardized reporting templates and thus makes it easier for the intermediaries to submit reports.
Examples of messages that are considered to be late by the SFC
In the most recent cases, the following behaviors have been viewed as delaying (and rule violations) by the SFC:
- Only after completing an internal investigation, which took place several months after the first breach was discovered, submit a voluntary report to the SFC for violating the law.
- Decision to first conduct an internal investigation and only decide to self-report after a request from the SFC (a few weeks later).
- Delay in self-disclosure by one month until after an internal compliance check and external legal advice has been obtained.
These examples show that intermediaries shouldn’t wait for internal (or external) investigations to complete before filing a voluntary disclosure or seeking legal advice. These companies were all fined separately for delaying self-disclosure in addition to the reported misconduct.
Rapid self-disclosure can be rewarded
From our experience and as the public reprimands and fines show, the SFC uses “carrot and stick” in its approach:
- The “stick”: the timely highlighting and consideration of failures in the voluntary disclosure in its disciplinary measures.
- The “carrot”: Emphasis on early reporting in their disciplinary measures and rewarding timely self-disclosures when deciding on sanctions.
Although less common, in the past the SFC has granted credit to intermediaries and reduced penalties if the intermediary reported promptly to the SFC, especially if prompt reporting helped the SFC take the necessary action to address the issue of the Mitigate the damage caused by the violation.
Recent enforcement actions, as well as older cases, underscore that by promptly self-reporting, intermediaries are in a better position by not including a possible further violation in the equation, thereby avoiding potentially increased sanctions.
Immediate self-disclosure also allows mediators to avert more difficult discussions with the regulator than would otherwise be the case and can also benefit from reduced sanctions if disciplinary action is taken.
Intermediaries should understand their obligations under Section 12.5, including determining whether there has been a “material” breach or a suspected “material” breach and, if there is a material or suspected material breach, voluntarily report to the SFC.
It is advisable, and many intermediaries will want to seek legal advice early on and, among other measures that should be taken, such as:
Intermediaries are advised to have internal guidance when identifying a problem, which acts as a guide on what to do and who to involve (internal and external) in order to save valuable time in the event that a voluntary disclosure is ultimately required.
1 Note that the HKMA also requires authorized institutions to file an incident report the same day after the incident was discovered.