When is too late? Hong Kong SFC expectations on timely self-reporting

SFC expectations

“Intermediaries must report problems to us immediately - not after internal investigation, not after legal advice has been obtained but straightaway, without leaving out any important information” said the SFC’s then Executive Director of Enforcement Mark Steward in a 2015 press release.

The message was not new. It reflects paragraph 12.5(a) of the Code of Conduct which states that the SFC requires immediate reporting of “any material breach, infringement of or non-compliance…. or where it suspects any such breach, infringement or non-compliance”.

Over the years, the SFC has reinforced the importance of timely self-reports and, for registered institutions, the requirement for prompt reporting to both the Hong Kong Monetary Authority (HKMA) and the SFC¹.   The SFC has also strongly encouraged intermediaries to use the WINGS platform (an online submission process introduced in early 2019) that allows for submissions of paragraph 12.5 notifications via standardised reporting templates thereby making it easier for intermediaries to submit notifications.

Examples of reporting considered by the SFC to be delayed

Recent cases have seen the following behaviours regarded by the SFC as delay (and a regulatory breach):

• filing a self-report to the SFC for regulatory breaches only after completing an internal investigation, which was several months after the breach was initially discovered.
• deciding to conduct an internal investigation first and only deciding to self-report after the SFC made enquiries (a couple of weeks later).
• delaying self reporting for a month until after an internal compliance review and obtaining external legal advice.

These examples show that intermediaries should not wait until internal (or external) investigations are completed before self-reporting, nor until after obtaining legal advice.  These firms were all separately fined for the delay in self-reporting, in addition to the misconduct that was being reported.

Prompt self-reporting can be rewarded

From our experience, and as the public reprimands and fines demonstrate, the SFC uses a ‘carrot and stick’ in its approach:

• The ‘stick’: highlighting and taking into consideration failures to self-report in a timely fashion in its disciplinary action.
• The ‘carrot’: highlighting early reporting in its disciplinary actions and rewarding timely self-reports when deciding sanctions.

Although less common, the SFC has in the past given credit to intermediaries, and reduced sanctions, where the intermediary has promptly reported to the SFC, especially if prompt reporting has assisted the SFC in taking necessary action to contain any damage caused by the breach.

Practical impact

Recent enforcement actions as well as older cases emphasise that, by promptly self-reporting, intermediaries will be in a better position by not adding a potential further breach into the equation and avoiding potentially increased sanctions as a result.

By promptly self-reporting intermediaries may also avert more challenging discussions with the regulator than there might otherwise be and may also benefit from reduced sanctions if disciplinary action is taken.

Intermediaries should understand their obligations under paragraph 12.5, including determining whether there has been a “material” breach or suspected “material” breach and, if there has been a material or suspected material breach, self-report to the SFC.

It is advisable, and many intermediaries will want,  to consult legal counsel early on and seek advice on prompt self-reporting alongside other steps that should be taken, such as conducting an investigation (whether internally or externally led) while keeping the SFC informed.

Intermediaries are advised to have internal guidance, acting as a playbook, on what to do and who to involve (internally and externally) when an issue is identified so that precious time is saved in case a self-report is ultimately required.

^{1 Note that the HKMA also requires authorised institutions to submit an incident report on the same day of discovering the incident.}