PAYMENTS REGULATIONS IN FLUX RECENT CHANGES IN IN HONG KONG, CHINA AND SINGAPORE WHAT'S GOING ON IN HONG KONG STORED VALUE FACILITIES AND RETAIL PAYMENT SYSTEMS The new regulatory regime for Stored Value Facilities ("SVF") and Retail Payment Systems ("RPS") in Hong Kong under the Payment Systems and Stored Value Facilities Ordinance (the "Ordinance") is now in full force. It is of particular importance that under the Ordinance, it will be illegal for any issuers to issue or operate any SVF without a licence after 13 November 2016. The following are the key points of the Ordinance, along with an explanation of how these new changes will affect existing and prospective SVF and RPS issuers. Who needs to apply for a SVF licence Under the Ordinance, SVFs are broadly defined as any facility which may be used for storing value of a pre-paid amount of money for making payments for goods or services, regardless of whether they are device based or non-device based. Non-device based SVFs that store value on network-based accounts, mobile network accounts or computer servers which were not previously regulated are now covered under the Ordinance. Both the issuer and the facilitator(s) (i.e. someone who provides valuable consideration for the issue) of the SVF require a licence from the Hong Kong Monetary Authority ("HKMA"). Under the new regime, persons who provide ancillary services which assist the issuer of the SVF, such as distribution, payment collection, telecommunication network facilities and operational support, will not be considered a facilitator. Who is exempt from a SVF licence The following classes are specifically exempted by the HKMA from obtaining a licence: • single purpose SVFs such as prepaid cards or loyalty cards issued by retailers; • department store SVFs that may only be used for purchasing goods or services from the issuer; • SVF used for bonus and loyalty point schemes where the points collected are not redeemable for cash. Examples include airline mileage programmers or customer loyalty schemes that provide non-cash points to customers to reward their patronage and such points are not redeemable for cash; • SVFs used to purchase digital products where goods or services are paid for through, delivered to and intended to be used through an electronic device. This exemption is intended to cover online platforms offering third party content such as music, games and apps; • banks licensed under the Banking Ordinance will be deemed to be licensed as issuers and facilitators of SVFs; • SVF used within a limited group of goods or service providers. Examples include store cards where the cards can only be used at the store’s premises; and • SVFs used within certain premises. Examples include membership cards where the cards can only be used in the shops or restaurants in a specific club or organisation. In addition to the above exempted classes, the HKMA may exempt an SVF from the Ordinance if the risks posed by the SVF to the users or potential users, or to the financial system of Hong Kong are immaterial. This means that small start-up companies may not have to be burdened with the new mandatory licensing regime. However, the ultimate decision lies with the HKMA. Even if a SVF is exempted, the Ordinance provides that the HKMA can impose conditions to such exemption, thus allowing the HKMA to consistently monitor any SVF even when it is exempted. For example, the HKMA can impose requirements for the administration, maintenance, management, use and regulation of the float of any SVF issued, impose requirements as to the accounts of the licensee and requiring disclosure to the HKMA or the public all or part of those accounts or any information relating to the business of the licensee. Contravention of a condition attached to the licence is an offence and can result in a fine of up to HKD400,000 and in the case of a continuing offence, a further fine of HKD10,000 for every day during which the offence continues. What criteria will the HKMA consider when issuing SVF licence The following is a list of minimum requirements that the applicant of an SVF license will need to meet: • being a Hong Kong incorporated entity; • having the issue of or facilitating the issue of SVFs as its principal business; • having a minimum on-going capital of no less than HKD25 million; • its chief executive, director and controller satisfying certain "fit and proper" requirements; • its senior management team and key personnel being based in Hong Kong; • having in place appropriate risk management policies and procedures for managing risks including data privacy risks, cyber threats, operational disruptions and major disasters. Where third party service providers support these functions, it is expected that the HKMA will look for adequate control and risk transfer provisions within the contracts that regulate such outsourcing arrangements; • having appropriate systems of control for preventing and combating possible money laundering and terrorist financing; • having in place adequate risk management policies and procedures for managing the float or SVF deposit as a segregated amount from the applicant's operating funds to ensure there will always be sufficient funds for the redemption of the stored value that remains on the facility; • having operating rules that are prudent, sound and properly maintained; and • complying with other obligations required by the HKMA, such as payment of licence fees and other reporting duties to the HKMA. Consequences for operating a SVF without a licence Anyone who operates a SVF without an appropriate licence will be liable to a fine of up to HKD 1 million and up to 5 years’ imprisonment. NEW REGULATIONS FOR RPS ISSUERS Previously, HKMA required that RPSs such as credit and debit card schemes self-regulate. As a result, major credit card companies adopted a voluntary code of practice endorsed by the HKMA. Under the Ordinance, a designated scheme will be established which will enable HKMA to designate a system as an RPS if disruptions to the RPS would have an impact on: • the monetary or financial stability of Hong Kong; • public confidence in payment systems or the financial systems of Hong Kong; or • public confidence in day-to-day commercial activities in Hong Kong. Once designated, an RPS would be subject to requirements which are similar to those already existing in the Ordinance, including safe and efficient operation of the system, establishment of appropriate operating rules, existence of adequate compliance arrangements and the availability of sufficient financial resources. How the designation scheme will develop remains to be seen once the HKMA publishes supervisory guidelines in relation to the designation process. SIGNIFICANCE OF THE NEW REGULATIONS The Ordinance could not have come at a more opportune time given the rapid advancement of payments for goods and services using the internet or smartphone technologies. The introduction of Apple Pay, Google Wallet last year and the increasing popularity of SMS payments, near field communication payments and wireless application protocol facility are just a small wave in the giant trend towards making payments easier, faster and more efficient than ever before. However, with innovation comes risks, such as risks posed to the stability of the payment systems and the security of users' float. In light of this, the new mandatory licensing mechanism brings all areas of payment processing under the HKMA's regulatory control and will hopefully instill greater public confidence in mobile payments. How the HKMA processes the licence applications and monitors SVFs under the new SVF regime will be an area of interest. The scope of the payment systems that will be regulated under the RPS regime will also become clearer upon further guidance from the HKMA. Companies who wish to issue SVFs and facilitators of SVFs should begin preparing their applications and apply to the HKMA as soon as possible. Companies who are issuers of SVFs or facilitating the issue of SVFs should ensure they obtain a licence within the one year transition period which will expire on 12 November 2016. WHAT'S GOING ON IN CHINA Following on our previous article regarding China's legal changes on the domestic bank card clearing market and the online payment industry (see link here), the payments industry in China has seen significant development in the past few months. We summarise the developments below and the impact these developments will have on businesses. INTRODUCING CROSS BORDER INTER BANK PAYMENT SYSTEM ("CIPS") China opened its inter-bank clearing system clearing market to foreign firms in October 2015 through CIPS. This new system allows for real time settlements across a global clearing platform as opposed to the previous system where foreign banks had to use designated offshore clearing banks. Previously, China used the China National Advanced Payment System ("CNAPS"), which is the domestic interbank clearing and settlement system. However CNAPS does not support cross-border payments. This means all RMB cross border transactions had to be cleared through the Society for Worldwide Interbank Financial Telecommunication ("SWIFT"), a globally accepted and US influenced platform based in Belgium. SWIFT would send payment orders to one of 18 authorized clearing banks, which would consolidate transactions around the world and send trades to be settled centrally with the People's Bank of China. However the previous system was the source of much confusion because the system only used Chinese characters and had a different coding from SWIFT which is used by 10,500 financial institutions in 215 countries. Manual changes to convert coding and language to suit the CNAPS system is costly and inefficient. Misunderstanding due to the difference in language and code also resulted in 15% of RMB denominated payments being rejected compared to a 5% rejection rate for other currencies, making RMB a less attractive currency to other major currencies. In addition, CNAPS did not support time zones different to China and was fettered by layered control and middle agents resulting in transaction costs higher than the actual settlement. With RMB being the fourth largest payment currency in the world since August 2015, behind the US dollar, Euro and the Pound, but overtaking the Japanese Yen, the Canadian dollar and the Australian dollar, CIPS was introduced as a remedy towards all the problems foreign businesses experienced with CNAPS. It was also hoped at the time of its launch that CIPS would also help China's bid to be included as a reserve currency in the International Monetary Fund ("IMF"). This was successful as IMF Managing Director Christine Lagarde recommended inclusion of the RMB into the IMF's Special Drawing Rights basket in November 2015, joining the U.S. dollar, Euro, Pound Sterling and Japanese Yen. The addition will officially take effect on 1 October 2016. The intended benefits CIPS will bring to businesses the following: • improving efficiency by enabling instantaneous RMB settlements to be made through any CIPS-listed financial institutions; • imposing standardisation through using a uniform coding, language and documentation format that complements the international standard used by SWIFT and subscribed to by most counties; • enabling international coverage by connecting China with most offshore RMB centres and countries in the Asia Pacific, Europe and Africa. Although much of the benefits of CIPS remain to be observed, the response has so far been positive. 19 banks have joined as direct participants of CIPS, including HSBC, Citibank, Standard Chartered Bank, Development Bank of Singapore, Deutche Bank, BNP Paribas and the Australia and New Zealand Banking Group. 38 Chinese banks and 138 foreign banks from Asia, Europe, the Oceania and African regions have been approved as indirect participants who are entitled to CIPS services indirectly via one or more direct participants. Standard Chartered Bank (China) completed its first direct international RMB clearing from China to Luxembourg for IKEA China using CIPS and the China Industrial and Commercial Bank Singapore has completed a trade settlement payment worth RMB 35 million (approximately HKD42.7 million) from Singapore's Raffemet Pte to Baosteel Resources in Shanghai through CIPS. DEVELOPMENTS IN THE OPENING UP OF DOMESTIC BANK CARD CLEARING MARKET The State Council of China's Decision on the Implementation of Market Access Administration in relation to Bank Card Clearing Institution came into effect on 1 June 2015. This decision allows foreign players such as Visa Inc. and MasterCard Inc. to gain direct access to China's market such that they are able to set up their own clearing companies in China and apply to the People Bank's of China for a Bank Card Clearing Licence. The foreign companies enjoy national treatment, as all clearing agencies will henceforth be regulated under a common set of standards regardless of the country of origin of their investors. This is a stark contrast to the previous system, in which the processing and clearance of all RMB denominated payments made via bank cards and credit cards in China is performed by China UnionPay, a bank card association in China established in 2002, with the consent of the State Council and the approval of the Chinese central bank, the People's Bank of China. This means foreign credit card companies such as Visa and MasterCard had to piggyback their services on China UnionPay's network when accepting RMB payments and were required to pay network access fees. Those that provide bank card clearing service to parties within China must establish a Foreign Invested Enterprise within China and obtain a Bank Card Clearing Permit. Those that only provide bank card clearing services for cross border transactions in foreign currency, on the other hand, are not required to establish a bank card institution in China in principle, but they must report their business developments and circumstances to the People's Bank of China and the China Banking Regulatory Commission. Requirements to qualify as a bank card clearing institution The following is a list of minimum requirements a company will need to meet if they wish to obtain a Bank Card Clearing Licence: • being a Chinese enterprise legal person established in accordance with The People's Republic of China Company Law; • having a registered capital of not less than RMB 1 billion; • having one or more "main capital contributors" (if only one, it must hold more than 20% of the shares; if more than one, together they must hold more than 25% of shares in aggregate), each of which must: ‒ have total assets of no less than RMB 2 billion or net asset of no less than RMB 500 million in the year preceding the application; ‒ have engaged in banking, payment or settlement and so forth for more than five consecutive years with three consecutive years of profitability; ‒ have no record of any serious violation of laws or regulations in the last three years; and ‒ with respect to any other capital contributors who will hold more than 10% of the shares, such contributors must (i) have net assets of not less than RMB 200 million; (ii) have the ability to make profits on a sustained basis; (iii) enjoy a good reputation; and (iv) have no record of any serious violation of laws or regulations in the last three years; • having a standard bank card clearing system which is in line with Chinese national and industry standards; • having infrastructure and a remote disaster recovery system within China, which meets specified requirements and is capable of independently completing bank card clearing business actions; • having directors and the senior management personnel with qualifications approved by the PBOC after having obtained the consent of China Banking Regulatory Commission; and satisfying other specified requirements, such as internal controls, risk prevention, information security and anti-money laundering. Significance of the new system Prior to this new system, state-controlled China UnionPay was the only company allowed to provide clearing service for cross-border RMB transactions. However, this change will end the near monopoly held by China's UnionPay Co Ltd, as domestic and international financial institutions are now able to join the market. The change is said to be designed to 'protect the rights and interests of card holders and promote healthy competition', It is hoped that the new system will promote greater use of the RMB currency and international trade, and bring the RMB on par with other global currencies. Application procedure The application procedure is split into two stages. The first phase involves approval to begin the preparatory phase, and the second phase involves approval to commence business. The People's Bank of China is the approval body, however its decisions are subject to the approval of the China Banking Regulatory Commission. The People's Bank of China will have 90 days from the receipt of an application to decide whether or not to approve the application. If approved, the applicant can start the preparatory phase which must be completed within one year from approval. Once the preparatory phase is complete, the application to commence business can be applied for, which will also be decided within 90 days of the receipt of the application. Once approval is given, the People's Bank of China will issue a Bank Card Clearing Business Permit to the applicant and the applicant will need to commence business within six months thereafter. STRICTER REGULATION FOR ONLINE PEER TO PEER LENDING On 28 December 2015, The China Banking Regulatory Commission released the draft Interim Measures for Administration of Businesses Activities for Infomediaries of Peer to Peer Lending (the "Draft"), targeted at the estimated 2,000 peer to peer lending websites (which is lending without a traditional financial intermediary such as a bank) in an effort to prevent credit and liquidity risks, fraud, personal information leakage and embezzlement of customers on online lending platforms. Currently, the Draft proposes a set of restrictions on peer to peer lending businesses, rather than establishing a licensing regime requiring all online lending businesses to seek approval before conducting their businesses. This approach was adopted in an effort to strike a balance between protecting the healthy development of peer to peer lending businesses on the one hand and providing protection and security for the public on the other. The restrictions proposed by the Draft include, amongst others, limiting peer to peer lending to the role of information intermediaries instead of credit intermediaries, prohibiting peer to peer lenders from absorbing public deposits, collecting capital, establishing capital pool and providing guarantees for lenders by itself and restricting the issue of financial products on peer to peer lending platforms. Online lending platforms will also be required to publicly disclose aggregate loan information and performance, as well as register with local financial authorities to improve transparency. The Draft is now published for public comment. Once the Interim Measures for Administration of Businesses Activities for Infomediaries of Peer to Peer Lending takes effect, it is expected that peer to peer lending platforms will have a limited grace period to rectify their businesses. Therefore businesses engaged in such lending operations are advised to start as early as possible to ensure that their business operations are in conformity. ADMINISTRATIVE MEASURES FOR ONLINE PAYMENT BUSINESSES The People's Bank of China published the Administrative Measures for Internet Payment Services of China (the "Measures") on 28 December 2015, set to come into full effect on 1 July 2016. The rapidly growing third party payment services industry has more than 300 third party service providers in China, the largest being Alipay, Tenpay and China UnionPay. However, since customers using these payment systems to conduct transactions do not require a bank account, these payment systems are outside the protection of bank deposit insurance and could be misused as a money laundering tool. As compared with the draft Measures we reported on in our previous article, the Measures have imposed stricter regulations concerning the usage of customers’ personal information. Specifically, non-banking payment institutions are now required to implement protective security measures for their online payment processing systems and adopt risk control systems. Sensitive information such as credit card chip information, verification codes and passwords can no longer be stored unless for limited purposes or as authorised by the customer. The remaining requirements remain largely the same as in the draft Measures. The following are the key regulations the non-banking payment institutions will be required to conform with once the Measures come into effect this year: • Know Your Client: When opening a payment account for customers, the payment institution is required to register and verify the customers' identity through no less than three external channels (for example, by way of the public security bureau, tax office and credit reporting agencies). • Type of Payment Account: The degree of verification conducted on a customer will decide the type of payment account that can be set up for the customer. A "comprehensive account" may be set up if either (i) the identity verification is conducted face-to-face; or (ii) the identity verification is completed through no fewer than five external channels. If the customer's identity is verified through three or four external channels, the payment institution is only allowed to open a "consumption account" for the customer. Payment accounts cannot be opened for financial institutions or those institutions engaged in financial businesses such as lending, financing, wealth management, guarantee, trust or money exchange. • Function of Payment Accounts: The "comprehensive account" can be used for transactions, remittances and purchases of investment or financial products, while the "consumption account" can only be used for transactions and remittances. The annual online payment limit for all "comprehensive accounts" owned by a particular customer cannot exceed RMB 200,000, while the limit for all "consumption accounts" owned by a particular customer is RMB 100,000. Any sums in excess of the payment limit should be processed through the customer's bank account. • Daily Limit on Online Payments: If payment instructions are verified through two or more means, one of which is a digital certificate or electronic signature, the daily cap can be agreed by the customer and payment institution. If payment instructions are verified through two or more means not including a digital certificate or electronic signature, the daily cap for all Payment Accounts owned by the customer is RMB 5,000. If payment instructions are verified through fewer than two means, the daily cap for all Payment Accounts of the customer will be RMB 1,000, and the payment institution is fully liable for the risks and losses associated with the relevant transaction. Note, however, that the transfer of funds from a customer's Payment Account to his/her own bank account is not restricted by the above rules. • Privacy Protection: Payment institutions will be required to have privacy protection obligations as banks have in respect of personal financial information. In addition to the requirements mentioned above, payment institutions will need to obtain the client's confirmation and authorisation if it is necessary to provide their information to any third party. The collection, use, storage and transfer of customers’ personal information is also restricted to the minimum extent necessary and customers must be notified of the purposes for collecting their personal information as well as how the collected personal information will be used by non-banking payment institutions. Additionally, non-banking payment institutions will need to enter into agreements with third parties to whom they will divulge or transfer customers’ personal information and impose on those third parties the same regulations as they themselves are bound under the Measures. • Ban on Provision of Financial Services: Payment institutions are not financial institutions and are therefore banned from providing financial services, including cash deposits and withdrawals, money lending, funding, wealth management, guarantee services and currency exchange. Significance of the Measures Although the Measure are a necessary step to regulate and provide security for customers using any online payment services, the Measures could also restrict the market from potential new entrants due to the higher costs involved for due diligence, verification measures and data privacy protection as well as the reduced amount of profit for online payment providers due to the low transaction caps. PLANS TO LAUNCH CHINA’S OWN DIGITAL CURRENCY On 21 January 2016, the People’s Bank of China issued a statement announcing its plan to launch its own digital currency. Although very little detail about its proposed digital currency has been disclosed and the statement is silent on how this will work in relation to the RMB, WHAT'S GOING ON IN SINGAPORE STRICTER CONTROL ON STORED VALUE FACILITIES Effective from 24 July 2015, key changes were made to the Notice on Prevention of Money Laundering and Countering the Financing of Terrorism (the "AMF and CFT Notice") which affect holders of stored value facilities (“SVFs”). Additional amendments were made to the AMF and CFT Notice, effective 30 November 2015. The following are the key changes affecting SVF holders: • The coverage of the AMF and CFT Notice was broadened to include all SVF holders. Previously, the AMF and CFT Notice covered only those persons operating SVFs which are able to contain, and make available to customers, stored values of more than S$1,000. • All SVF holders, except for pre-defined classes of SVFs which pose low moneylaundering or terrorist financing risks, will be required to comply with the anti-money laundering and countering financing of terrorism requirements in the revised AMF and CFT Notice. The Monetary Authority of Singapore ("MAS") will not subject the holders of low risk SVFs to the AMF and CFT Notice requirements although the notification requirements, as detailed below, will still apply to all SVF holders. • All holders of SVFs must notify MAS at least 10 business days prior to the commencement of operations of the SVFs, by providing the information specified in the the People’s Bank of China has announced intentions to launch its digital currency as soon as possible. For more details, please refer to our main article regarding China's plans to launch its own digital currency (see link here). newly prescribed “Form A” under the AMF and CFT Notice. Information required to be furnished in Form A includes details regarding the features or business model of the SVFs provided by the holder of SVFs. Thereafter, holders of SVFs must, at least 10 business days prior to a change in the information previously provided to MAS in Form A, notify MAS of any such change. • All SVF holders will be required to submit annual statistical updates to MAS, in the newly prescribed "Form B". The statistics will cover the preceding calendar year and should be submitted by 31 March of the current calendar year. • SVF holders (except for pre-defined classes of SVFs which pose low money-laundering or terrorist financing risks) will be required to conduct customer due diligence measures when they undertake any transaction of a value exceeding S$5,000 for any customer even where that customer has not otherwise established business relations with the relevant SVF holder. SIGNIFICANCE OF THE NEW REQUIREMENTS All existing and future holders of SVFs should carefully consider the requirements in the revised AMF and CFT Notice and ensure their businesses are fully compliant with the requirements including notification requirements. In particular, all SVF holders must ensure their annual statistical updates for the preceding calendar year are submitted to MAS by 31 March of the current calendar year. A failure to comply with the requirements in the AMF and CFT Notice will constitute an offence. FUTURE DEVELOPMENTS We will continue to monitor developments in this regard and provide our clients with updates. In the meantime, if you would like further information on payment systems regulation in Asia or elsewhere, our Technology team would be pleased to hear from you. FOR MORE INFORMATION If you have any queries or concerns please do not hesitate to contact us. Scott Thiel Partner, Hong Kong T +852 2103 0519 [email protected] Amy Kong Associate, Hong Kong T +852 2103 0482 [email protected] Andy Tam Associate, Hong Kong T +852 2103 0445 [email protected] This email is from DLA Piper Hong Kong. DLA Piper Hong Kong is a partnership whose principal place of business is at The Landmark, 17th Floor, Edinburgh Tower, 15 Queen's Road, Central, Hong Kong which provides services from offices in Hong Kong. A list of the firm's principals will be provided on request. DLA Piper Hong Kong is regulated by the Law Society of Hong Kong and is part of DLA Piper, global law firm, operating through various separate and distinct legal entities. For further information, please refer to www.dlapiper.com. Please note that neither DLA Piper Hong Kong nor the sender accepts any responsibility for viruses and it is your responsibility to scan or otherwise check this email and any attachments. This information is intended as a general overview and discussion of the subjects dealt with and is accurate as of 8 March 2016 however the law may have changed since this date. This information is not legal advice, and should not be used as a substitute for taking legal advice in any specific situation. DLA Piper will accept no responsibility for any actions taken or not taken on the basis of this information. We may supply your personal data to other parts of the DLA Piper global law firm so that we or they may contact you with information about legal services and events offered by us or them subject to your consent. It is our policy not to pass any of your personal data outside of the DLA Piper global law firm or use your personal data for any purpose other than for those indicated above. Switchboard: + 852 2103 0808. Copyright © 2016 DLA Piper. All rights reserved. Heng Loong Cheong Partner, Hong Kong T +852 2103 0610 [email protected]