A new era of smart banking in Hong Kong is anticipated to begin at the end of this year. In September 2017, one of the policy initiatives announced by the Hong Kong Monetary Authority (“HKMA”) relates to the facilitation of the establishment of virtual banks in Hong Kong. After completion of the public consultation in February 20181, the HKMA unveiled the long-awaited revised “Guideline on Authorisation of Virtual Banks” (“Guideline”) on 30 May 20182. The development of virtual banks in Hong Kong is intended to upgrade the banking system, to promote financial technology (“FinTech”), innovation and financial inclusion, and to offer a new kind of customer experience.

A “virtual bank” is defined as a company which delivers banking services primarily, if not entirely, through the Internet or other electronic delivery channels. It does not refer to a licensed bank which makes use of the Internet or other electronic means as an alternative channel to deliver its products or services to customers.

Under the Banking Ordinance (Cap. 155) (“Ordinance”), only authorised institutions are legally permitted to carry on banking business or the business of taking deposits in Hong Kong. An authorised institution is either in the form of a licensed bank, a restricted licence bank or a deposit-taking company. A licensed virtual bank will become the fourth type of authorised deposit-taking institution in Hong Kong.

The HKMA clarified in the Guideline that both financial firms (including existing licensed banks) and non-financial firms (including technology companies) are welcome to apply for a virtual bank licence. Applicants should meet the same minimum criteria for authorisation under the Seventh Schedule to the Ordinance to which all traditional licensed banks are subject to.

Key criteria for authorisation of virtual banks

1. Capital RequirementVirtual banks must maintain minimum levels of share capital of HK$300 million.

2. Physical Presence Applicants must have a physical presence in Hong Kong to provide customer services such as handling complaints and enquiries, and to verify the identity of customers.

3. Business Plan Applicants must provide a credible business plan for profitability in the medium term without imposing any minimum account balance requirements or low-balance fees on customers. The business model should promote financial inclusion and bring value to Hong Kong-based customers.

4. Exit PlanShould it become necessary, virtual banks should be able to unwind the business operations without causing any disruption to the customers and the financial system.

5. Information Technology (“IT”) SecurityThe security controls should be ‘fit for purpose’. Regular assessment on IT systems, hardware, software and procedures and controls should be performed.

6. Risk ManagementApplicants should analyse the eight types of risk identified in the risk-based supervisory framework of the HKMA (that being credit, interest rate, market, liquidity, operational, reputation, legal and strategic risk).

7. Customer ProtectionCustomer terms and conditions must describe the respective rights and obligations between the virtual bank and its customers. They should be fair and balanced to both the virtual bank and its customers. Customers should be made aware of how losses from security breaches, system failure or human error will be apportioned between the virtual bank and its customers.

8. Ongoing SupervisionVirtual banks are subject to the same set of supervisory requirements applicable to conventional banks. Some adaptations are used to fit virtual banks’ technology-driven business model. For example, the board of directors and senior management of virtual banks should have the requisite knowledge and experience to enable them to discharge their duties effectively.

9. Ownership & Capital Requirement Virtual banks are required to operate in the form of a locally incorporated bank for engaging in significant retail businesses.

Both financial companies (including existing banks) and non-financial companies (including technology companies) can apply for a virtual bank licence.

The applicant can either:

  • be majority-owned by a bank or financial institution in good standing and supervised by a recognised authority; or
  • be held by a holding company incorporated in Hong Kong subject to the risk-based supervisory conditions mentioned in 6.

10. Outsourcing Material outsourcing should be approved by the HKMA and it must be in compliance with the principles in the HKMA’s Supervisory Policy Manual module on Outsourcing.

Applicants should ensure:

  • the operations outsourced remain subject to adequate security controls;
  • that the confidentiality and integrity of customers will not be compromised;
  • that the requirements under the Personal Data (Privacy) Ordinance and common law customer confidentiality are complied with; and
  • that powers and duties of the HKMA under the Ordinance will not be hindered by the outsourcing arrangements.

Over the past couple of years, Hong Kong and Singapore have been competing for supremacy as Asia’s FinTech hub. The Monetary Authority of Singapore (“MAS”) has launched a number of initiatives to foster a thriving FinTech ecosystem, such as creating a regulatory sandbox in 2016 to facilitate experimentation of new innovative financial products or services in a relaxed regulatory environment3. Nevertheless, for non-financial firms such as technology companies to operate as a bank in Singapore, they must have a Singapore-incorporated bank to allow them to operate as a joint-venture partner subsidiary4.

In Hong Kong, for a non-bank company (such as a technology company) to operate as a virtual bank, it can be held through a holding company incorporated in Hong Kong subject to supervisory conditions such as capital adequacy, liquidity, risk management, etc. The less restrictive criterion allows technology companies to operate as a virtual bank using their own technical infrastructures without integration with more fragmented systems of conventional banks. The costs saved on integration can be invested in the core business such as financial products and services diversifications; in the enhancement of customer experiences such as simplifying mobile applications or advancing cybersecurity measures.

Although the structure of a virtual bank in Singapore is different from that in Hong Kong, the regulators in both cities emphasise that it is particularly important to the potentially high risk business to have the backing of a strong parent to provide financial, managerial and technological support. Non-bank companies who are planning to operate as a virtual bank should take this into consideration during the early stages of formalising their business plan.

Irrespective of the competition between Hong Kong and Singapore, the HKMA proactively seeks cross-border collaborations with Singapore in the development of FinTech, which will be discussed in the last section of this paper.

The convergence of banking and innovative technology brings a new risk profile to virtual banks. Firstly, with the adaptation of open application programming interfaces (APIs) and partnerships with third parties, for example, hosting systems on a virtual private cloud, virtual banks will encounter privacy data issues when handling customers’ personal data imposed by the Personal Data (Privacy) Ordinance. In addition, the use of cloud technology outside Hong Kong may trigger cross border data transfers. Virtual banks are recommended not to transfer any customers’ personal data outside of Hong Kong without customers’ consent.

Secondly, an increased vulnerability to cyber-attacks and cyber-crimes may arise from the engagement of third parties. It will be a fatal attack to the reputation of a virtual bank if a cyber-attack successfully disrupts its services, causes loss of customer data and system outages. Virtual banks are recommended to ensure a high level of IT system and network availability, to perform regular IT system assessment and to ensure business continuity.

With respect to the new risks identified, a new approach to risk management should be adopted. Closer cross-border collaboration with FinTech centres in Asia is the first step to foster the healthy development of FinTech in Hong Kong. On 25 October 2017, the HKMA and the MAS signed a co-operation agreement relating to referrals of innovative business, collaboration on innovative projects, information and expertise exchange5. On 15 November 2017, the two authorities signed a Memorandum of Understanding to jointly develop a cross-border infrastructure based on distributed ledger technology to digitalise and share trade documents between two cities to reduce fraud and increase efficiency6.

Given the rapid development of technology and innovation, FinTech has been changing the business landscape significantly. It is foreseeable that the network of cross-border collaborations with FinTech centres will be expanded in the region and globally. Cross-border collaborations may extend to multiple jurisdictions which could potentially not follow the English common law system in some countries such as China. As a result, the legal basis for liability will vary across different jurisdictions. To avoid uncertainty, one possible solution is to agree on a choice of jurisdiction with an arbitration clause. Using the respective jurisdictional regulatory sandbox to facilitate experimentation of various scenarios in a controlled and safe environment can provide references to which cases have no precedent. Besides, regular conversation with startups, lawyers, banks and relevant stakeholders can also help regulators to understand challenges.

After the announcement of the Guideline, about sixty companies have expressed interest in applying for a virtual bank licence including the traditional bank Standard Chartered Bank, online lender WeLab, payment platform Yedpay! and the stored value payment (“SVP”) licensee TNG. The establishment of virtual banks in Hong Kong is the beginning of building a healthy financial ecosystem and the competent players attracted to the field will embrace the enormous opportunities brought about by marrying the banking and technology to challenge the traditional banking model in Hong Kong.