The Securities and Futures Commission ("SFC") has publicly reprimanded a bank (the "Bank") and fined it HK$6 million. The SFC also has also suspended the licence of its responsible officer for eight months.
One of the key concerns identified was the Bank's failure to make a timely report to the SFC of suspected misconduct by one of its employees in contravention of Part 12.5 of the Code of Conduct for Persons Licensed by or Registered with the SFC (the "Code"). Part 12.5 of the Code requires a licensed or registered person to report to the SFC immediately upon the occurrence of (amongst other eventualities) any material breach, infringement or non-compliance with any laws, rules, regulations or codes operated by the SFC, and to give particulars of the incident.
The relevant misconduct involved a former licensed representative of the Bank, Mr X (“Mr X”), who operated a fraudulent investment scheme within the Bank's wealth management division from 2004 to 2009. In 2009, the Bank suspended Mr X in order to investigate the suspected misconduct. Shortly thereafter, the Bank dismissed Mr X for gross misconduct.
After dismissing Mr X, the Bank reported the fact of his dismissal for gross misconduct to the SFC and noted that an internal investigation was in progress. The Bank did not make available its internal preliminary investigation report that existed at the time, but waited until a full investigation by its external auditors was completed. By the time the SFC was provided with these reports, Mr X had already left Hong Kong and, as a consequence, the SFC and other law enforcement agencies were not able to interview or detain Mr X. The SFC has criticised the Bank's delay in self-reporting (in addition to its delay in detecting the misconduct itself).
The Bank has also agreed to review and upgrade its detection, escalation and notification practices and policies and has agreed to a surprise audit of its upgraded practices and policies by the SFC within 2 years.
This is the first time the SFC has taken strong public enforcement action against a bank and its responsible officer in relation to delays in self-reporting under the Code. This puts an end to any debate within financial institutions as to what is the cost to business for not taking the self-reporting obligations seriously. The SFC has made it clear that a failure to comply with the self-reporting obligations could affect the licensing status of the institution's senior management.
The SFC's tough stance in this case serves as a timely reminder to financial institutions to review its policies and procedures for self-reporting suspected material breaches and misconduct.
Financial institutions may also consider reviewing and stresstesting their employee whistleblowing practices and policies, to ensure early detection, escalation and notification of any incidents. This is a clear sign that missed red flags will not be looked upon lightly by the SFC.