## 1hkgea2021004 ## Source details **Canonical URL:** [1hkgea2021004](https://www.imf.org/-/media/files/publications/cr/2021/english/1hkgea2021004.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2021/english/1hkgea2021004.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2021/english/1hkgea2021004.pdf.json) --- ### Executive summary and scope - Technical note (TN) covering implications of fintech for regulation and supervision of the HKSAR financial services sector; part of the 2019 Financial Sector Assessment Program (FSAP). - Inputs: virtual discussions with HKSAR officials (April 28 to May 8, 2020), authorities’ materials, and publicly available information; based on information as of November 30, 2020. - Anchored in international guidance and frameworks (e.g., Financial Stability Board publications, BCBS, IOSCO, CPMI, PFMI, Bali Fintech Agenda). - Structure: - Industry landscape and key initiatives. - Distribution of responsibilities across sectoral regulators and engagement with RegTech and SupTech, including sandboxes. - Detailed analysis: virtual banking, third-party risk/Open API, payment system initiatives, and virtual assets (VAs). ### Fintech industry overview and key statistics - HKSAR strengths: - Presence as an international financial center; free-flowing talent and capital; highly developed ICT infrastructure; proximity to Mainland China. - Adoption and rankings: - HKSAR ranked fifth in digitalization of the traditional financial sector in 2018; percentage of fintech users reached 35 percent. - In 2019, the consumer fintech adoption rate increased to 67 percent. - Firms, funding and listings: - Fintech companies: 600 in 2019 (compared to 230 in 2017). - Identified fintech unicorns as of 2019: 4 companies. - In the first half of 2019, Hong Kong fintech companies raised US$152 million (up 561 percent from the same period last year). - 84 new listings raising HK$69.8 billion in the capital markets in the first half of 2019 (up 35.2 percent year-on-year). - Activity notifications to HKMA (since January 2017; as of November 2020): - Over 530 notifications of major digital banking and other fintech initiatives. - More than 100 projects related to mobile payments. - Over 130 projects related to cloud computing. - Around 80 customer authentication initiatives. - More than 30 remote customer onboarding projects. - Distribution by fintech focus: - 18 percent big data and artificial intelligence. - 12 percent blockchain (non-digital assets). - 12 percent InsurTech. - 9 percent compliance and RegTech. - 9 percent payment solutions. - Fintech transaction indicators: - FPS processed 39 million transactions involving an aggregate amount of HKD 675 billion and RMB 16 billion (as of end November 2019). ### Regulatory approach, institutional setting, and coordination - Sectoral regulators and coordination: - HKMA (banks), SFC (securities and futures), IA (insurers); FSTB oversees and coordinates cross-sector fintech issues. - InvestHK has a dedicated fintech team for investment promotion. - 2017: single point of entry linking HKMA, SFC and IA sandboxes for cross-sector pilot trials. - CFR and FSC facilitate exchanges among Government and financial regulators on fintech matters. - HKMA stance and initiatives: - Proactive, risk-based and technology-neutral approach; established Fintech Facilitation Office (FFO) and a Digitalisation Office. - Launched “7 Smart Banking Initiatives” including FPS, virtual banking, Banking Made Easy, and Open API. - Surveyed banks on AI use; published high-level principles on AI and big data analytics (November 2019). - SFC stance and initiatives: - Facilitative but cautious approach to VA activities; dedicated fintech unit (Fintech Contact Point) and Fintech Advisory Group; established sandbox and voluntary framework for VA trading platforms. - IA stance and initiatives: - Encourages InsurTech adoption; InsurTech Facilitation Team; Insurtech Sandbox and Fast Track scheme. - Cross-sector recommendations: - Deepen cooperation on cyber-/IT-related incident reporting, information sharing, and AI implications. - Develop a more robust process for information exchange among regulators (¶16). Recipient(s): HKSAR authorities. Timing: C. - Continue to review regulatory perimeter of non-bank fintech companies (¶17). Recipient(s): HKSAR authorities. Timing: C. ### Areas of supervisory focus and market implications - Virtual Banks (VBs) - Eight VB licenses granted in the first half of 2019 among 33 applications; minimum paid-up capital requirement HK$300 million. - Ownership: two joint ventures by banking groups; one local fintech firm; two supported by Mainland insurance firms; three by Mainland technology firms. - As of 30 September 2020: seven VBs officially launched; one conducting a pilot trial via HKMA sandbox. - HKMA expectations and requirements: - Same supervisory requirements as conventional banks (including Basel III). - Independent assessments pre-launch and within six months of full launch. - Technology risk assessments, C-RAF maturity assessment, self-attestation on payment system security. - Key risks: Technology Risk Management; Customer Protection and Data Privacy; AML/CFT. - Recommendation: close monitoring of initial operations and comprehensive assessment of medium- to long-term viability before granting additional licenses. - Third-Party Risk / Outsourcing and Open Banking (Open API) - Increasing use of third-party technology service providers (TSPs); over 500 interconnections identified since 2015. - AIs required to submit a Risk Assessment Form for material technology-related outsourcing. - Open API implementation in four phases: - Phase One (Product Information): 20 retail banks launched over 500 Open APIs; about 800 TSP registrations (March 2019). - Phase Two (Customer Acquisition): available since end-October 2019. - Phases Three (Accessing Account Information) and Four (Conducting Transactions): technical standards to be published in 2021. - Recommendation: develop methodology to recognize interconnectedness and concentration risk; aggregate banks’ registers of outsourced service providers; continue close monitoring into Phases III and IV and consider strengthening security and consumer protection (¶88). - Payments, settlement and FMIs - Key initiatives and projects: - FPS (launched September 2018): round-the-clock; connects banks and SVFs; HKMA issued 18 SVF licenses (as at end-September 2019). - Common QR Code Standard. - CBDC Project LionRock (PoC commenced March 2017) — domestic retail potential limited, wholesale and cross-border potential noted. - Project Inthanon-LionRock (cross-border with Bank of Thailand; initiated September 2019). - eTradeConnect (DLT-based trade finance platform; launched September 2018; 12 licensed banks). - HKEX initiatives: smart contracts, cloud computing, RPA, AI, big data. - Oversight and legal considerations: - HKMA oversight remit from PSSVFO; FMIs must seek HKMA approval for technology changes. - DLT and BigTech raise governance, legal enforceability, settlement finality, and cross-jurisdiction challenges. - Recommendations: - Update Hong Kong’s overall fintech strategy leveraging existing payment and settlement infrastructure (¶101). Recipient(s): HKSAR authorities. Timing: I. - Review regulatory and oversight frameworks as fintech innovations enter payments and settlement (¶105). Recipient(s): HKMA. Timing: ST. - Assess if payment and settlement infrastructures should adopt DLT-based solutions for critical functions (¶107). Recipient(s): HKMA. Timing: C. - Encourage network-based critical service providers to accommodate international communication and message standards (¶110). Recipient(s): HKMA. Timing: ST. - Virtual Assets (VAs) and VASPs - Market activity and exposures: - HKSAR ranked fourth in number of cryptocurrency exchanges (22 exchanges) and high monthly trading volumes (US$32.5 billion based on December 2018 data). - ICOs largely disappeared since 2018; IEOs raised significant amounts (e.g., US$1.4 billion in Q2 2019). - Financial sector exposures: - HKMA 2018 banking survey: banking industry’s financial exposures to VAs remain negligible; banks have no appetite to establish relationships with VA customers. - SFC surveys: few managers reported exposures; none intended to invest more than 10 percent of NAV in VAs. - Regulatory approach: - SFC treats VAs as securities/futures/CIS where applicable under the SFO; voluntary framework for VA trading platforms launched November 6, 2019. - SFC Terms and Conditions for licensed VA trading platforms include strict custody, investor protection, AML/CFT, market surveillance, accounting/auditing, risk management, conflicts of interest, and listing/removal criteria. - Platform custody expectation: store 98 per cent of clients’ VAs in cold wallets. - Planned statutory regime: - FSTB launched public consultation on a proposed statutory licensing regime for VA trading platforms: licensing for platforms incorporated/with permanent address in HKSAR; restrict services to professional investors; prohibit unlicensed platforms from actively marketing to HKSAR public; impose AML/CFT obligations and sanctions. - Recommendations: - Enhance monitoring of holdings of VAs by financial sector entities via systematic data collection (¶112). Recipient(s): HKSAR authorities. Timing: ST. - Continuous monitoring of VA trading activities to identify and address risks including criminal misuse (¶124). Recipient(s): HKSAR authorities. Timing: C. - Continue cooperation among regulators on VA activities and stablecoins; increase cross-sectoral engagement and systematic approach (¶127). ### Key supervisory tools: sandboxes, RegTech, SupTech and staffing - Sandboxes and pilots: - HKMA Fintech Supervisory Sandbox (FSS) launched 2016; upgraded to FSS 2.0 in 2017; features fintech supervisory chatroom and single point of entry for cross-sector trials. - Accumulated sandbox activity (end-November-2020): 189 pilot trials conducted; 175 trials completed; 132 initiatives fully launched after trials. - Product counts in HKMA sandbox (accumulated figures): Biometric authentication 8; Soft token 4; Chatbot 3; DLT 6; API 13; RegTech 95; Mobile app enhancement 13; Other 47; Total 189. - Constraint: standalone fintech companies generally cannot use the sandbox without partnering with a financial institution. - RegTech and SupTech: - HKMA RegTech promotion roadmap (November 2020); initiatives focused on AML/CFT surveillance, prudential risk management and compliance, and machine-readable regulations. - HKMA SupTech study (April 2019) identified three directions: - Unified Authorized Institution Supervisory Platform with Smart Knowledge and Data Management. - Process digitalization and automation (RPA, Speech-to-text). - Forward-looking supervision using Machine Learning, Network Analytics and Big Data Analytics. - HKMA established a Digitalisation Office to lead digital transformation and recruit data science talent. - SFC SupTech initiatives: - DAG (Data Analytics Group) developing a KRI platform. - Market Intelligence Program and IRIS graph database (launched March 2019). - Data Standards for Order Life Cycles issued July 2019; expected implementation timeline H2 2021. - Cybersecurity and incident reporting: - Cybersecurity Fortification Initiative (CFI) implemented 2016; CFI 2.0 launched November 2020. - Fraud/phishing reporting to HKMA (Table 7 totals): 2015 TOTAL 31; 2016 TOTAL 28; 2017 TOTAL 41; 2018 TOTAL 131; 2019 TOTAL 114. - HKMA incident reporting timeframes: - Initial report: same day of discovery or next working day if late; final updates within 4 weeks; follow-up declaration upon rectification. - Cross-sector differences in reporting: insurers report to IA within 72 hours for severe incidents; SFC Code of Conduct requires reporting of material failures "so soon as practicable". - Recommendation: harmonize incident reporting frameworks across sectors and expand cyber intelligence sharing (consider opening CISP access beyond licensed banks). ### Selected key recommendations (highlights from Table 1) - Institutional and coordination: - Develop more robust information exchange process among regulators (¶16). Recipient(s): HKSAR authorities. Timing: C. - Review regulatory perimeter of non-bank fintech companies as necessary (¶17). Recipient(s): HKSAR authorities. Timing: C. - Promote consistency and information sharing on cyber risk supervision; review incident reporting frameworks and apply best practices (¶43-46). Recipient(s): HKSAR authorities. Timing: ST. - Consider adding clarity and transparency to minimum requirements on Immediate Holding Companies of Virtual Banks by revising Authorization Guidelines (¶69). Recipient(s): HKMA. Timing: ST. - Map network interdependencies of key financial sector elements and key technology systems (¶82). Recipient(s): HKSAR authorities. Timing: MT. - Continue close monitoring of Open API implementation into Phases III and IV and consider strengthening security and consumer protection (¶88). Recipient(s): HKMA. Timing: ST. - Payments and settlement: - Update Hong Kong’s overall fintech strategy balancing competition and cooperation, leveraging payment and settlement infrastructure (¶101). Recipient(s): HKSAR authorities. Timing: I. - Review regulatory and oversight framework as fintech innovations enter payments/settlement (¶105). Recipient(s): HKMA. Timing: ST. - Assess adoption of DLT-based solutions for payment and settlement critical functions, focusing on legal and operational bases (¶107). Recipient(s): HKMA. Timing: C. - Encourage network-based critical service providers to accommodate international communication and message standards (¶110). Recipient(s): HKMA. Timing: ST. - Virtual Assets: - Enhance monitoring of VA holdings across all financial sector entities via systematic data collection (¶112). Recipient(s): HKSAR authorities. Timing: ST. - Continuously monitor VA trading activities to address risks, including criminal misuse (¶124). Recipient(s): HKSAR authorities. Timing: C. - Continue cross-regulator cooperation to monitor VAs and identify potential system risks (¶127). Recipient(s): HKSAR authorities. Timing: C. *People’s Republic of China—Hong Kong SAR, International Monetary Fund (content unit 1hkgea2021004).* ### EXECUTIVE SUMMARY __________________________________________________________________________________ 5 ### EXECUTIVE SUMMARY ### INTRODUCTION - This technical note (TN) covers the implications of fintech for the regulation and supervision of the HKSAR financial services sector and is part of the 2019 Financial Sector Assessment Program (FSAP). - The TN draws on virtual discussions with HKSAR government officials held from April 28 to May 8, 2020, supplemented by materials provided by authorities and publicly available information. - The TN uses international guidance and relevant frameworks (e.g., Financial Stability Board publications, BCBS, IOSCO, CPMI, PFMI, Bali Fintech Agenda) to anchor views and recommendations. - The TN is structured in three main sections: - Industry landscape for fintech in the HKSAR and key initiatives. - Distribution of responsibilities across sectoral financial regulators and their engagement with RegTech and SupTech, including sandboxes. - Detailed analysis of virtual banking, third-party risk/open API, payment system initiatives, and virtual assets (VAs). ### FINTECH INDUSTRY OVERVIEW - The HKSAR is among the world’s major fintech hubs, driven by: - presence as an international financial center; - free-flowing talent and capital; - a highly developed information and technology communication (ITC) infrastructure; - geographical and strategic advantage by proximity to Mainland China. - The HKSAR Government has launched initiatives covering funding, training, promotion, B2B and B2C fintech adoptions; supporting fintech is a government priority. - The Hong Kong Monetary Authority (HKMA) received more than 530 notifications of major digital banking and other fintech initiatives from banks as of November 2020 since January 2017. - Most fintech initiatives are related to banking and mobile payment activities, followed by capital markets and insurance initiatives: - Banking: virtual banks (VBs), open banking and payments leading activity. - Capital markets: surge in the offer and trade of virtual assets (VAs). - Insurance: gradual adoption of technology in product distribution with reduced reliance on face-to-face interactions. ### REGULATORY APPROACH - Regulation and supervision of fintech are carried out and coordinated by sectoral financial regulators, overseen by the Financial Services and Treasury Bureau (FSTB). - HKMA, Securities and Futures Commission (SFC), and Insurance Authority (IA) regulate fintech activities within their mandates: banking; securities and futures markets; and insurance, respectively. - Coordination mechanisms: - FSTB oversight and bilateral cooperation between sectoral regulators. - Money lenders and alternative financing (including fintech-enabled lenders) are governed by the Money Lenders Ordinance (Cap. 163) (“MLO”); these activities are currently immaterial but may grow—reviewing the regulatory perimeter of non-bank fintech companies may be warranted. - HKMA approach: - Proactive to encourage innovation, competition, and financial inclusion. - Established the Fintech Facilitation Office (FFO). - Launched “Smart Banking” initiatives: Faster Payment System (FPS), virtual banking, Banking Made Easy initiative, and Open API. - Adopts a risk-based and technology-neutral approach; created a Digitalization Office to digitally transform the HKMA into a more data-driven regulator. - Suggested roles: more active encouragement of interconnectivity and interoperability between new fintech solutions and existing infrastructures (including payments), and encouraging network-based critical service providers to accommodate international communication and message standards where applicable. - SFC approach: - Active monitoring of VA industry; regulatory initiatives range from investor warnings on ICOs to frameworks for VA trading platforms. - Implemented a relatively recent voluntary framework for regulation and supervision of VA trading platforms that covers key risks and lays a foundation for subsequent proposals under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (“AMLO”) to meet FATF requirements. - Encouraged continued monitoring of VA activities (including non-licensed platforms) to contain risks including criminal misuse. - Cross-sectoral coordination: - Authorities are encouraged to deepen cooperation to maintain a proactive cross-sectoral approach as fintech pervades activities. - Priority areas for coordination include cyber-/IT-related incident reporting, information sharing, and implications of artificial intelligence adoption by the financial sector. ### AREAS OF FOCUS - Virtual Banks (VBs): - VBs have gained traction and promote competition in banking. - Many newly licensed VBs delayed launch to the second half of 2020 partly due to the COVID-19 pandemic. - Incumbent banks are strengthening mobile services and accelerating digital financing in response. - Recommendation: close monitoring of initial operations (e.g., aggressive behaviors to build market share) and comprehensive assessments of VBs’ medium- to long-term viability before granting additional licenses. - Third-Party Risk / Outsourcing and Open Banking: - Use of third-party technology service providers is increasing. - HKMA monitors interconnectedness and dependencies via supervisory activities, but deeper engagement and a systematic methodology to recognize interconnectedness and concentration risk are needed. - HKMA adopts a collaborative and phased approach in Open API implementation and acknowledges the importance of more detailed standards for safe implementation across the industry. - Recommendation: continue close monitoring of Open API implementation, particularly how Authorized Institutions (AIs) manage risks and challenges into Phases III and IV, and consider strengthening security and consumer protection. - Payment Systems: - HKMA launched FPS and other Smart Banking initiatives to leverage existing payment and settlement infrastructure. - Recommendations include updating Hong Kong’s overall fintech strategy, reviewing regulatory and oversight frameworks as fintech innovations enter payments and settlement, and assessing whether critical payment and settlement infrastructures should adopt DLT-based solutions with appropriate legal and operational bases. - Where applicable, encourage network-based critical service providers to accommodate international communication and message standards. - Virtual Assets (VAs): - SFC has been active on VA regulation; voluntary VA trading platform framework is detailed and comprehensive. - Recommendation: enhance monitoring of holdings of VAs by financial sector entities via more systematic data collection for all entity types. - Continuous monitoring of VA trading activities in the HKSAR is recommended to identify and address risks, including criminal misuse. - Encouraged ongoing cooperation among regulators to monitor VA activities and identify potential risks to the financial system. ### KEY RECOMMENDATIONS (selected highlights from Table 1) - Institutional Setting and Regulatory/Supervisory Approach to Fintech - Develop a more robust process for information exchange amongst regulators to facilitate better understanding and supervision of cross-sector fintech issues (¶16). Recipient(s): HKSAR authorities. Timing: C. - Continue to review as necessary the regulatory perimeter of non-bank fintech companies (¶17). Recipient(s): HKSAR authorities. Timing: C. - Promote consistency and facilitate information sharing across financial sectors with respect to cyber risk supervision; review and compare incident reporting frameworks (including minimum incident reporting parameters) across sectors and apply best practices (¶43-46). Recipient(s): HKSAR authorities. Timing: ST. - Consider adding more clarity and transparency to the minimum requirements on Immediate Holding Companies of Virtual Banks by revising the Authorization Guidelines (¶69). Recipient(s): HKMA. Timing: ST. - Consider undertaking an exercise to map network interdependencies of key elements of the financial sector, including key technology systems in use by supervised firms (¶82). Recipient(s): HKSAR authorities. Timing: MT. - Continue to closely monitor the progress of open API implementation including how AIs manage the relevant risks and challenges going into Phases III and IV, and further consider the need to strengthen security and consumer protection (¶88). Recipient(s): HKMA. Timing: ST. - Payments and Settlement Infrastructure - Update Hong Kong’s overall fintech strategy, driven by a balance between competition and cooperation, and by leveraging existing payment and settlement infrastructure (¶101). Recipient(s): HKSAR authorities. Timing: I. - Review the regulatory and oversight framework as fintech innovations are introduced in the payments and settlement space (¶105). Recipient(s): HKMA. Timing: ST. - Assess if payment and settlement infrastructures should adopt DLT-based solutions for their critical functions, particularly regarding legal and operational bases (¶107). Recipient(s): HKMA. Timing: C. - Where applicable, encourage network-based critical service providers to accommodate international communication and message standards (¶110). Recipient(s): HKMA. Timing: ST. - Virtual Assets (VAs) - Enhance monitoring of holdings of VAs by financial sector entities by making a more systematic data collection for all types of entities (¶112). Recipient(s): HKSAR authorities. Timing: ST. - Continuous monitoring of VA trading activities in the HKSAR to identify and address any risks, including of criminal misuse (¶124). Recipient(s): HKSAR authorities. Timing: C. - Continue ongoing cooperation among regulators to monitor VA activities and identify potential risks to the financial system (¶127). Recipient(s): HKSAR authorities. Timing: C. *This technical note was prepared by Hee Kyong Chon, Cristina Cuervo and Elias Kazarian (IMF/MCM).* ### 4. The case studies described in this note do not indicate endorsement of the underlying ### 4. The case studies described in this note do not indicate endorsement of the underlying ### Fintech industry overview and metadata - This technical note was produced by Hee Kyong Chon, Cristina Cuervo and Elias Kazarian. - This technical note is based on available information as of November 30, 2020. ### HKSAR fintech strengths and adoption - HKSAR ranked fifth in digitalization of the traditional financial sector in 2018; percentage of fintech users reached 35 percent. - In 2019, the consumer fintech adoption rate increased to 67 percent. - Key enabling factors: presence as an international financial center, free-flowing talent and capital, highly developed ICT infrastructure, proximity to the Mainland Chinese market. - Collaboration patterns: - B2B: large financial institutions leveraging fintech startups to reduce costs. - B2C: incumbents and newcomers providing consumer-centric services (e.g., VBs, e-wallets). ### Digital payments and fintech transaction context (summary of figure notes) - “Digital payments made” definition: percentage of respondents, ages 15+, who report using mobile money, a debit or credit card, or a mobile phone to receive a payment through an account in the past 12 months. - “Mobile or Internet for Payment” definition: percentage of respondents, ages 15+, who report using a mobile phone or the internet to make or receive payments, to make a purchase, or to send or receive money through their financial institution account or through the use of a mobile money service in the past 12 months. - Fintech transaction value (as percentage of domestic GDP) includes digital payments, online crowdfunding, robo-advisers and automated wealth services, and marketplace lending. ### Investment, listings, and government support - In the first half of 2019, Hong Kong fintech companies raised US$152 million (up 561 percent from the same period last year). - A total of 84 new listings were recorded, raising HK$69.8 billion in the capital markets (up 35.2 percent from the same period the year before). - Government initiatives and capacity: - Cyberport counts about 1,200 companies and over 500 start-ups. - Government has earmarked HK$5.5 billion for the development of Cyberport 5, expected to attract a further 100 tech companies and 700 start-ups. - HKSAR Government has launched funds aimed at encouraging local businesses to upgrade everyday technology and to stimulate private investment in local innovation and technology start-ups. ### Industry activity and project notifications to HKMA (as of November 2020) - Over 530 notifications of major digital banking and other fintech initiatives from banks received by the HKMA since January 2017. - More than 100 projects related to mobile payments. - Over 130 projects related to cloud computing. - Around 80 customer authentication initiatives including biometric authentication and soft tokens. - More than 30 remote customer onboarding projects. - Remaining projects included AI-powered chatbots, enhanced financial services leveraging DLT, and social media platform integration using API. ### Fintech company composition and trends (counts and percentages) - Fintech companies increased to 600 in 2019, compared to 230 in 2017. - Distribution by focus (largest percentages): - 18 percent on big data and artificial intelligence. - 12 percent on blockchain (non-digital assets). - 12 percent on InsurTech. - 9 percent on compliance and RegTech. - 9 percent on payment solutions. - Identified fintech unicorns in the HKSAR as of 2019: 4 companies. - A quarter of fintech companies view HKSAR as a launchpad for entering the Southeast Asian markets. ### Market shifts: digital channels and banking behavior - HKMA data show: - Steady growth in retail internet banking and mobile payments. - Decline in phone banking over recent years. - Rapid growth in number of bank accounts opened online in recent years. - Insurance digital shift: - Slower but picking up for insurance products. - Increasing proportion of online sales through banks’ digital platforms for relatively simple products (e.g., non-participating endowment insurance and term life insurance). - For general insurance policies, majority of travel insurance sold via banks were through online sales. ### Retail transactions by channel (Table 2: Monthly average amount in billion HKD, 3-year rolling average) - Internet banking accessed via personal computers: - 2016: 392 - 2017: 466 - 2018: 492 - 2019: 495 - Internet banking accessed via mobile devices: - 2016: 42 - 2017: 60 - 2018: 123 - 2019: 176 - Phone banking: - 2016: N/A - 2017: 117 - 2018: 64 - 2019: 56 - Self-service terminals (e.g., ATMs, cash deposit machines, cheque deposit machines): - 2016: N/A - 2017: N/A - 2018: N/A - 2019: 203 - Contactless mobile payments: - 2016: N/A - 2017: 0.235 - 2018: 1.343 - 2019: 1.673 - Source: HKMA. ### Insurance distribution channels (Table 3: New Insurance Production (General Business) by Distribution Channel, In percent) - 2017 distribution: Agents 30; Banks 0; Brokers 14; Direct Sales 41; Online Others 5; Telemarketing 7; Others 2; Total 1; 100 - 2018 distribution: Agents 29; Banks 1; Brokers 13; Direct Sales 42; Online Others 5; Telemarketing 7; Others 2; Total 1; 100 - Source: IA. ### Internet banking accounts and non-face-to-face account openings - Number of Internet banking accounts by year (Table 4): - 2014: 10,426,966 - 2015: 11,322,176 - 2016: 12,148,725 - 2017: 13,236,506 - 2018: 14,329,367 - 2019: 15,758,220 - Non-face-to-face opening of bank accounts (Table 5): - Accumulated no. of bank accounts open (as of Dec 2018): Total 9,261 - Accumulated no. of bank accounts open (as of Dec 2019): Total 28,037 - No. of bank accounts opened in 2018: 9,261 - No. of bank accounts opened in 2019: 18,776 ### Regulatory approach — institutional setting and coordination - Regulators involved: HKMA (banks), SFC (securities and futures), IA (insurers). Each authority has industry outreach channels and sandboxes. - FSTB coordinates domestic financial regulators on cross-sector and industry-wide fintech issues; holds regular meetings on financial stability, investor protection, cybersecurity, and fintech. - InvestHK has a dedicated fintech team as part of its investment promotion mandate. - 2017: single point of entry created linking sandboxes of HKMA, SFC, and IA to facilitate pilot trials of cross-sector fintech products. - Examples of inter-agency cooperation: - 2018: SFC, in consultation with HKMA, provided guidance on online distribution and advisory platforms for investment products. - 2018: HKMA and IA collaborated to streamline suitability assessment requirements and strengthen product disclosure for certain life insurance products through digital channels. - 2020: IA and HKMA collaborated to provide guidance on sandbox applications for using video conferencing tools in the sale of insurance products. ### Identifying and closing regulatory gaps - FSTB, HKMA, and SFC coordinating a review of local regulatory approaches for virtual assets (VAs) in the HKSAR. - Council of Financial Regulators (CFR) and Financial Stability Committee (FSC) facilitate exchanges among Government and financial regulators on fintech matters. - Conduct-risk related collaboration active with respect to AIs’ sale of investment or insurance products through digital channels. ### Areas for improvement and supervisory observations - Coordination could be improved by more proactively identifying cross-sector information needs at an early stage and enhancing information exchange via high-level cross-sector platforms (CFR and FSC). - HKMA conducted a survey in Q3 2019 on the use of artificial intelligence by banks; findings: - Banks leverage technology firms’ know-how across customer-facing services (chatbots, remote onboarding, personalized marketing) and internal processes and risk management (operational automation, cyber security and fraud detection, AML). - November 2019: HKMA published a set of high-level principles on the use of artificial intelligence and big data analytics covering governance, design and development, monitoring and maintenance, and consumer protection. - Mission view: the HKMA survey could have been expanded to other sectors such as securities and insurance; general principles could be applied across the whole financial sector beyond banking. ### Regulatory perimeter and non-bank fintech - Money lending business in the HKSAR is subject to the Money Lenders Ordinance (MLO); persons carrying on business as a money lender must obtain a money lender’s license. - Alternative financing currently immaterial but may become more significant in the medium term. - Credit reference agencies providing personal credit information through online platforms are under the purview of the data protection authority and not directly included in the financial regulatory ambit. - Banking and non-bank industry associations are developing an industry code of practice, to be endorsed by the HKMA, to strengthen governance of credit reference agencies. ### Digital lending platforms (Box 1 summary) - Digital lending performs each step in the lending process through digital channels, using expansive data and sophisticated algorithms. - Borrowers: consumers and small businesses; lenders: individuals and institutional investors via digital platforms and online auctions. - Large lending start-ups in HK include: - MoneySQ.com — partnered with a licensed fund manager; online lending platform for individuals and businesses. - WeLab — analyzes unstructured mobile big data within seconds to make credit decisions for individual borrowers. - Qupital — online invoice trading platform that helps businesses raise funding against unpaid invoices in 24 hours or less. ### HKMA general approach and initiatives - HKMA’s stance: proactive to encourage innovation and competition, and to improve financial inclusion and coverage for underserved clients in banking. - September 2017: HKMA launched the “7 Smart Banking Initiatives”: - FPS - Enhanced FSS - Promotion of virtual banking - Banking Made Easy initiative - Open API - Closer cross-border collaboration - Enhanced research and talent development - HKMA established the Fintech Facilitation Office (FFO) in 2016; FFO led by a Chief Fintech Officer with about 20 full-time employees. - Financial inclusion initiatives: - Mobile branches serving customers in public housing estates (PHEs) on a rotating basis. - Self-service banking centres with automated banking machines. - Video Teller Machines for real-time conversations with customers. - Virtual banks expected to improve remote onboarding and lower costs for customers to open and maintain bank accounts. *This technical note was produced by Hee Kyong Chon, Cristina Cuervo and Elias Kazarian. This technical note is based on available information as of November 30, 2020.* ### 19. The rapid expansion of fintech in payment, clearing and settlement adds challenges to ### The rapid expansion of fintech in payment, clearing and settlement adds challenges to the HKMA ### Regulatory and supervisory approach to fintech - Fintech evolution in the HKSAR is driven by technology players bringing new business models to payment and settlement, challenging conventional clearing and settlement and raising questions on adequacy of current regulatory and supervisory oversight. - HKMA objectives: spur healthy innovation while addressing impacts on the soundness, safety and efficiency of payment and settlement infrastructures. - Key initiatives and supervisory adjustments: - Banking Made Easy initiative launched in September 2017 as one of seven Smart Banking initiatives; a task force consulted banks and technology firms to assess adjustments to regulatory requirements and practices. - Updates to supervisory requirements focusing on remote onboarding, online finance, and online wealth management. - Remote Onboarding: following amendment of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, HKMA amended the relevant Guideline to allow banks to reduce unintentional barriers to technology for remote onboarding and issued a circular in February 2019 articulating key principles of identity authentication and identity matching for remote on-boarding of individual customers. - Online Finance: HKMA allowed banks to adopt new credit risk management techniques such as big data and consumer behavioral analytics; banks are required to implement enhanced disclosure measures in the form of “double reminder” to mitigate potentially higher risks of impulsive borrowing, over-borrowing or inappropriate borrowing decisions in the online environment. - Online Wealth Management: HKMA sought SFC comments when providing guidance to AIs on online distribution of investment products and collaborated with the IA to revise online distribution requirements for insurance products; HKMA and IA also provided guidance on sandbox applications for using video conferencing tools in the sale of insurance products. - Technology risk guidance: SPMs, circulars and guidelines on technology risk management, cybersecurity, operational risk management (ORM), outsourcing, and business continuity planning. - Stored Value Facility (SVF) licensing introduced to regulate SVF issuers with proportionate regulatory requirements. - Allowance for AIs to adopt big data/consumer behavioral analytics for a portion of personal lending portfolios; as of July 2020, ten AIs have rolled out such online personal lending products and more are planning similar services. ### Organizational capacity and supervisory resourcing - Fintech supervisory work is spread across HKMA departments as if fintech were an operating business: - 22 staff in the technology risk specialist team of the Banking Supervision Department (BSD) in 2019 focused on policy and supervision of technology risk covering fintech services (including FSS operations and Open API implementation). - Over 20 staff in other teams dealing with fintech-related case management or supervision of fintech-driven specialist risk areas (e.g., credit risk management or treasury risk management). - Consumer protection policy issues handled by the existing consumer protection policy team of the Banking Conduct Department (BCD). - AML Division has a dedicated team engaging the banking industry on fintech-related money laundering/terrorist financing matters. ### COVID-19 response and fintech - HKMA supports AIs’ remote customer on-boarding and digital delivery of financial services during COVID-19, acknowledging pandemic impacts on AML/CFT systems and customer due diligence processes. - HKMA issued a circular in April 2020 setting out support, guidance and assistance; encourages AIs to work closely with HKMA to maintain availability of essential banking services during the pandemic. ### Fintech monitoring and market implications - HKMA does not have direct authority to supervise non-bank fintech companies; InvestHK collects fintech-related data and shares trends with HKMA. - HKMA will act if fintech firms use the word “bank” or claim to take “deposits” (require removal of misleading representations, issue public alerts, report potential breaches of the Banking Ordinance). - Monitoring channels: - International fora participation, FSS fintech supervisory chatroom, collection and analysis of fintech-related statistics (online banking, cloud computing, AI application), surveys/questionnaires, direct communication with fintech/TechFin firms and via financial sector firms. - Strategic and operational risks: - AIs may find it increasingly difficult to maintain current operating models; banking risks may change with growing fintech adoption. - Operationally, AIs may rely more on third-party service providers (TSPs) or partner with fintech firms under Open API Framework, increasing risks of losing direct customer relationships or being displaced by fintech firms offering superior customer experience. - Increased reliance on technology firms could raise exposures to cyberattacks or fallout from major technology firm failures. - HKMA supervisory expectations: - HKMA requires senior management of AIs to assess strategic risks from fintech and develop plans to monitor and manage such risks; assessments should be presented to boards of directors. - HKMA performed an impact study on potential reduction of banks’ income in its recent financial stability report. - Thematic reviews may be considered where necessary, focusing on risks from increased reliance on data analytics, complex algorithms and black-box tools (e.g., unsupervised learning); supervisors should possess relevant skillsets and resources. ### Sandbox (Fintech Supervisory Sandbox, FSS) - FSS launched in 2016 and upgraded to FSS 2.0 in 2017 with new features: - Fintech supervisory chatroom for early-stage feedback to banks and tech firms. - Tech firms can access the sandbox via the chatroom without going through a bank. - Single point of entry for pilot trials of cross-sector fintech products. - Sandboxes of HKMA, SFC and IA are connected to provide a single point of entry for cross-sector pilot trials. - Usage and outcomes as of end-November-2020: - Total pilot trials conducted in the sandbox: 189 pilot trials conducted, with 175 trials completed and 132 initiatives fully launched after trials. - Sandbox testing is primarily bank-led and many trials are partnerships between banks and fintech companies; standalone fintech companies cannot perform testing unless partnered with financial institutions. - Table (Total Number of Products Tested/Being Tested in the HKMA Sandbox — Accumulated figures): - Biometric authentication: 7 (end-2017), 7 (end-2018), 8 (end-2019), 8 (November-2020) - Soft token: 3, 4, 4, 4 - Chatbot: 2, 2, 3, 3 - DLT: 4, 5, 6, 6 - API: 0, 5, 10, 13 - RegTech (e.g. remote onboarding): 0, 4, 42, 95 - Mobile app enhancement: 0, 0, 10, 13 - Other: 12, 15, 20, 47 - Total: 28, 42, 103, 189 - Observed constraint: fintech start-ups may be limited in ability to define market space in banking because standalone fintech companies cannot use the sandbox without a financial institution partner. ### Domestic and cross-border fintech collaboration - HKMA collaboration with other regulators: - Collaborated with SFC and IA on fintech matters, especially AI’s conduct-risk related matters (e.g., 2018 SFC guidance on online distribution and advisory platforms in consultation with HKMA). - Joint annual survey with SFC on sale of non-exchange traded investment products; survey to collect information on online platform sales and robo-advice usage. - IA and HKMA guidance on sandbox applications for video conferencing in insurance product sales; joint review of InsurTech sandbox applications for non-face-to-face sale channels. - Monitoring of fintech-related FMIs: - HKMA and SFC closely monitor fintech issues relating to FMIs; they will discuss cooperation in reviewing regulatory frameworks and implications as fintech projects develop. - Cross-border supervisory cooperation: - Existing international cooperation arrangements between home and host regulators remain effective; material supervisory issues would be raised at supervisory colleges or bilateral meetings in accordance with Memoranda of Understanding or similar agreements. - Cross-border initiatives and outreach: - HKMA entered into fintech co-operation agreements with ten jurisdictions and co-founded GFIN. - Facilitating cross-border trials in trade finance and central bank digital currency (CBDC); initiatives include Inthanon-LionRock (cross-border payment system with the Bank of Thailand) and a PoC to connect HKMA’s eTradeConnect and PBoC’s trade finance platform. - HKMA organizes industry events (annual Fintech Week); 2019 HKSAR Fintech Week attracted over 12 000 participants from over 60 economies. - HKMA participates in G20/OECD Task Force on Financial Consumer Protection and international forums such as BIS, CPMI, and Executives' Meeting of Asia-Pacific Central Banks to exchange views on fintech and FMI matters. - BIS and HKMA signed an Operational Agreement on the BIS Innovation Hub Centre in the HKSAR in September 2019. ### RegTech and SupTech - HKMA initiatives to facilitate RegTech adoption (announced September 2018) focusing on AML/CFT surveillance technologies, prudential risk management and compliance, and a study on machine-readable regulations. - Ad-hoc bank survey in June 2019 to assess RegTech use by banks and SVF licensees for ML/TF risk management; growing use observed in AML/CFT surveillance, cybersecurity, fraud monitoring, credit risk management and regulatory compliance. - HKMA opened FSS to RegTech projects and is discussing machine-readable regulations (experimental stage). - In November 2020, HKMA developed a RegTech promotion roadmap to foster a larger and more diverse RegTech ecosystem. *Source: PEOPLE’S REPUBLIC OF CHINA–HONG KONG SAR, INTERNATIONAL MONETARY FUND (content unit 1hkgea2021004).* ### 35. The HKMA is actively adopting SupTech to support and enhance supervisory processes ### 1hkgea2021004 - 35. The HKMA is actively adopting SupTech to support and enhance supervisory processes ### SupTech adoption: objectives and main directions - HKMA aim: explore SupTech to enhance effectiveness and forward-looking capability of supervisory processes and to streamline AIs’ regulatory data collection mechanism through digital transformation. - April 2019: HKMA commissioned a consultancy study to identify possible strategies and roadmaps for SupTech development and implementation; study completed and identified three main directions for SupTech adoption: - (a) Development of a Unified Authorized Institution Supervisory Platform with Smart Knowledge and Data Management technologies that interfaces with the HKMA's internal centralized data base and external data sources. - (b) Development of efficient supervisory processes through process digitalization and automation by using technologies such as Robotic Process Automation and Speech-to-text Tool. - (c) Enhancing forward-looking supervision via the use of Machine Learning, Network Analytics and Big Data Analytics to enhance capabilities in identifying emerging trends and risks, as well as monitoring financial interconnectedness. - Specific platform capability (as described): provide supervisors with ready access to up-to-date and comprehensive information of banks, such as the profile information of banks and their senior management, financial positions, risk assessment results, major supervisory issues, and supervisory plans. - Examples of automation and NLP applications identified: using RPA to automate data collection and calibration, as well as generation of standard reports; using natural language processing in monitoring mis-selling processes of financial and investment products. - HKMA is exploring use of Machine Learning, Network Analytics and Big Data Analytics in supervision of corporate credit risk and liquidity risk. ### Institutional arrangements and capability building - HKMA is setting up a “Digitalisation Office” tasked with overseeing digital transformation to become a more data-driven regulator. - The Digitalisation Office’s remit covers multiple functions including banking supervision, AML/CFT, financial stability surveillance, economic research, and reserves management. - The office is recruiting talents in data science to work on data processing and analysis, formulate a long-term digital development strategy and promote a culture of technology and digital mindset within the HKMA. ### Cyber risk: threat landscape and supervisory actions - Observed trend: increasing cyberattacks and technology crimes globally; cyber risk rising in importance as AIs rely more on TSPs, partner with fintech firms and/or launch fintech products and services (e.g., Open API frameworks, remote onboarding). - Key cyber risks cited: phishing and business email compromise attacks, and data breach attacks affecting various industries including financial services. - Table 7 — Hong Kong SAR: Number of Fraudulent Websites or Phishing Emails Reported by AIs to the HKMA - 2015: Phishing Emails 3; Fraudulent websites 28; TOTAL 31 - 2016: Phishing Emails 4; Fraudulent websites 24; TOTAL 28 - 2017: Phishing Emails 7; Fraudulent websites 34; TOTAL 41 - 2018: Phishing Emails 62; Fraudulent websites 69; TOTAL 131 - 2019: Phishing Emails 51; Fraudulent websites 63; TOTAL 114 - Supervisory activities: HKMA undertakes on-site examinations and off-site supervisory activities to assess operational/cyber resilience of AIs including their fintech products and services. - Industry-wide crisis management exercises: HKMA participated in October 2019 exercise; similar simulations held in 2015 and 2017; exercises simulate responses to significant cyberattacks and disruptions to critical infrastructures. ### Operational risk guidance and industry initiatives - SPM “Operational Risk Management” provides guidance to banks on key elements of effective ORM including information technology risk; banks expected to have policies and procedures for IT capabilities, security and change of IT systems, facilities and equipment. - HKMA expects AIs launching fintech products and services to observe ORM guidance and other applicable HKMA guidance related to fintech initiatives. ### Cybersecurity Fortification Initiative (CFI) and CFI 2.0 - CFI (implemented 2016) aims to increase cyber resilience of the banking industry; applicable to AIs’ fintech products and activities; consists of three pillars: - (i) Cyber Resilience Assessment Framework (C-RAF): assessment tool for inherent risk assessment, maturity assessment and intelligence-led cyberattack simulation testing. - (ii) Professional Development Programme: seeks to increase the supply of qualified professionals in cybersecurity. - (iii) Cyber Intelligence Sharing Platform (CISP): infrastructure for sharing intelligence on cyber attacks. - CFI 2.0 launched in November 2020 to respond to latest trends in technology and incorporate recent development in global cyber practices. ### Cyber intelligence sharing and scope considerations - Current CISP access limited to members of the HKAB (i.e., licensed banks in the HKSAR). - Observations and suggestions: - Cyber risk affects more than licensed banks; it may be desirable to open CISP to restricted license banks and deposit taking companies if HKAB members are comfortable. - Suggestions exist to make the platform available to securities and insurance companies; insurance industry planning to establish its own cyber intelligence sharing platform. - Authorities may consider exploring more ways to share cyber threats and intelligence across the financial sector. ### Incident reporting frameworks and inter-sector alignment - HKMA has defined clear processes and formats on incident reporting; standardized incident reporting form for AIs; AIs exercise professional judgement on whether an operational incident should be reported. - Scope of cyber incidents for reporting includes suspected or confirmed cyber-attacks that may cause: - potential loss/leakage of sensitive data of the AI or its customers, - potential financial loss to customers, - potential material financial loss to the AI, - or significant impact on the AI’s reputation. - Reporting timeframes described: - AIs required to submit the incident reporting form to the HKMA within the same day of discovery or the next working day if the incident is less time-critical and identified during late working hours or after office hours. - Final updates should be reported within 4 weeks starting from the initial reporting date. - AIs’ risk management follow-up declaration should be submitted upon implementation of all rectification actions and preventive measures. - Cross-sector differences noted: - Insurance sector: insurers required to report to the IA within 72 hours of detection all incidents relating to a system malfunction/cybersecurity issues that have a severe and widespread impact on an insurer’s operations or materially impact the insurer’s service to its existing/potential policy holders. - SFC’s Code of Conduct requires licensed corporations and registered institutions to report any material failure, error, or defect in the operation to the SFC so soon as practicable upon identification. - Recommendations and observations: - Incident reporting is important for understanding sector threat landscape and can trigger supervisory action. - Regulators would benefit from further collaboration toward sharing of common principles and good practices and exchanging information on cyber/IT related incidents. - It is advisable to review adequacy of cyber/IT incident reporting frameworks across sectors to ensure a common understanding on what to report, when, and at what level of detail. - Authorities should ensure current processes prevent under and late reporting, which hinders ability to act promptly in a crisis. ### Cross-border cyber information sharing - HKMA has established bilateral cyber information sharing arrangements with two overseas regulators to facilitate sharing of cyber threats and intelligence (including those arising from fintech) on a cross-border basis. - HKMA participates in a cross-border multilateral cyber information sharing platform for central banks and financial authorities operated by the Financial Services Information Sharing and Analysis Center to exchange information on cyber threats, vulnerabilities, incidents and other threat intelligence that could impact financial services. ### Data protection and fintech-related BDAI guidance - Banks required to comply with the Personal Data (Privacy) Ordinance (PDPO) and relevant codes of practice issued by the Privacy Commissioner for Personal Data (PCPD). - HKMA has engaged with the PCPD to provide more guidance to the banking industry on proper collection, use, and storage of personal data. - PCPD publications and good practices on fintech and Big Data Analytics and Artificial Intelligence (BDAI) include: “Ethical Accountability Framework”, “Data Stewardship Accountability, Data Impact Assessments and Oversight Models”, and “Information Leaflet on Fintech”. - HKMA circular (November 2019) on consumer protection aspects of BDAI requires banks to consider: - embedding data protection in design of a product or system from the outset (privacy by design), - collecting and storing only the minimum amount of data for the minimum amount of time (data minimization). ### SFC general approach to fintech, industry contact and Sandbox - SFC jurisdiction: regulates and supervises securities and futures markets under the Securities and Futures Ordinance (SFO); fintech activities fall under SFC where they amount to a “regulated activity” or involve “securities” or “futures contracts” as defined by the SFO. - SFC stance: facilitative approach to innovation where fintech improves customer experience, increases financial inclusion or makes markets more efficient and reliable; more cautious where fintech poses serious investor risks (e.g., VA activities associated with illiquidity, volatility, opaque pricing, hacking, money laundering and fraud). - Fintech coordination within SFC: - Dedicated fintech unit responsible for formulation of fintech policies, acting as first point of contact (Fintech Contact Point, FCP), coordination within SFC, and industry/overseas regulator engagement. - Fintech unit currently has five staff members; staff from other divisions also engage on fintech matters (Intermediaries Supervision Department, Enforcement Division with Data Analytics Group). - Fintech Contact Point (FCP) and Fintech Advisory Group (FAG): - FCP manages communication with businesses intending to conduct SFO-regulated activities using fintech. - FAG composed of SFC staff and industry members to obtain fintech trend information, collect stakeholder input, identify opportunities/risks/regulatory perimeter implications, and broaden understanding of fintech. - SFC Sandbox (created 2017): confined regulatory environment for qualified firms to operate regulated activities under the SFO before fuller launch; aims to enable close dialogue and supervision to identify and address risks. - Sandbox features: - a. Eligibility: Firms must be fit and proper, utilize innovative technology and demonstrate genuine commitment to carry on regulated activities through fintech; any firm carrying out SFO regulated activities must be licensed by the SFC. - b. Licensing conditions: SFC may impose conditions (e.g., client type limits, maximum exposure per client, compensation schemes). - c. Closer monitoring and supervision by the SFC: more intensive dialogue and highlighted compliance areas for improvement. - d. Investor protection measures: firms expected to have adequate investor protection measures to address risks identified while in the Sandbox. - e. Exit: Firms may apply for removal or variation of licensing conditions once technology and controls are proven; licenses may be revoked if SFC deems a firm not fit and proper to remain licensed. - Note: SFC expects the great majority of applicants using fintech to go through normal license application process; Sandbox entry considered case by case. *Source: 1hkgea2021004 — Excerpt from IMF Hong Kong SAR country report.* ### 53. There are currently three licensed corporations operating under the Sandbox. The first ### 1hkgea2021004 - 53. ### Sandbox firms and onboarding - There are currently three licensed corporations operating under the Sandbox. - The first company provides trading services on trade receivables in the HKSAR and the other one is an equity fundraising platform. - Both firms went through an initial onboarding process, which involved discussions with the FCP and, subsequently, the licensing department, to understand the business model and determine the specific licensing conditions to be imposed (professional investors only, maximum amount to be invested and closer SFC monitoring including monthly reports on specific issues). - These firms have been in operation for about one year and are still refining their business model in close dialogue with the SFC. - Once their operations have run smoothly for some time, the firms will be able to apply for the uplifting of the additional licensing conditions and migrate from the sandbox into the general SFC supervisory regime. - The SFC expects VA trading platforms to be the next to enter the Sandbox and are currently processing the application of a few firms under the new regulatory regime. ### Fintech monitoring by the SFC - The SFC monitors fintech developments through outreach initiatives, desktop surveillance and international cooperation. - Ongoing industry dialogue channels include the FCP and the Fintech Advisory Group, industry events, and ongoing contact with FMIs. - The SFC typically conducts soft consultation with industry when formulating policy to identify opportunities, risks and regulatory implications. - Intelligence sources: public sources, investor complaints, and regular monitoring of developments in VAs and artificial intelligence/machine learning. - International engagement: participation in IOSCO fintech initiatives and the GFIN, where both the HKMA and the SFC are members. - Footnote: The SFC has also entered into seven bilateral fintech cooperation agreements with foreign counterparts. ### SupTech initiatives and objectives - The SFC is increasingly deploying SupTech to move toward more proactive and forward-looking supervision relying on better data collection, sophisticated analytics, and greater storage and mobility. - The SFC has three standing initiatives addressing technological developments to improve supervision: - a. DAG (Data Analytics Group) - Aims to study, identify and apply new data analytic technologies and techniques to develop insights about capital market segments through data trends, alerts, anomalies and relationships. - Ongoing projects include a key risk indicator (KRI) platform to enhance monitoring and supervision of global financial institutions in the HKSAR by standardizing submission of their risk data indicators. - The KRI platform will automatically and consistently analyze data submitted by licensed corporations; conduct prudential risk profiles of each firm; and present dashboards with alerts of high-risk areas identified for supervision. - b. Market Intelligence Program - Focuses on solutions for three priority conduct risk areas: collusion between parties (e.g. market manipulation, insider dealing), networks of companies and nominees (share warehousing, vote rigging). - Implemented IRIS (Intelligence Relationship Identification System), a graph database to search for and visualize connections among people and entities. - IRIS launched in March 2019 and will gradually incorporate external data sources with the SFC’s internal structured and unstructured data, using natural language processing, machine learning and other relevant technologies. - c. Data Standards for Order Life Cycles - Issued in July 2019 to prescribe minimum content and presentation format of trading-related data to be submitted by licensed corporations upon request. - The SFC is developing data analytics capabilities to perform automated compliance assessment steps to identify red flags of potential trading-related misconduct or control deficiencies (e.g. short selling and best execution). - The expected implementation timeline is H2 2021. - Recommendation in text: The IMF encourages the SFC to continue strengthening its dedication to SupTech and RegTech. ### Approach to cyber risk (SFC) - The SFC considers cyber risk one of the key threats to financial institutions in Hong Kong, including CCPs and regulated entities. - Enhanced communications with CCPs, IT vendors and other regulated entities to ensure adequate cybersecurity measures and compliance with international guidance (e.g. IOSCO Cyber Resilience Guidelines). - Principal requirements included in the Code of Conduct for financial corporations to employ adequate and appropriate security controls to protect electronic trading systems. - Cybersecurity guidelines issued in October 2017 mandate internet trading firms to implement 20 baseline cybersecurity controls, such as two-factor authentication for system login and strong data encryption. - A thematic review assessed internet brokers’ compliance with the cybersecurity guidelines, with additional focus on mobile trading application security controls. - A circular and thematic review report were issued in September 2020 summarizing key findings and providing guidance on expected standards. - In April 2020 a circular reminded licensed corporations to assess operational capabilities and implement measures to manage cybersecurity risks associated with remote office arrangements. - For virtual assets (VAs), the SFC issued the “Pro forma terms and conditions for licensed corporations which manage portfolios that invest in virtual assets” setting out principal security control requirements for virtual asset fund managers. - The SFC has an assessment framework for oversight of FMI operational activities and services, including regular and ad-hoc meetings and requests for regular reports on risk assessment, cybersecurity measures and follow-up work. ### Investor education and financial literacy - The SFC prioritizes investor education on fintech through the Investor and Financial Education Council (IFEC), a wholly owned subsidiary of the SFC dedicated to improving financial literacy in the HKSAR. - In 2018, the HKSAR Government and IFEC, with support from the SFC, launched a public education campaign on risks associated with ICOs and cryptocurrencies. - Campaign components: advertisements in subway stations and digital media, television and radio advertisements, educational videos shared on popular social media platforms. - The Chin Family website, IFEC’s financial education platform, developed educational articles and infographics to explain features and risks of ICOs and cryptocurrencies. - The SFC will continue to use IFEC to address investor education needs arising from fintech. ### Insurance Authority (IA) — general fintech approach - Digitalization in insurance activities has been slower than in other sectors; the IA is actively encouraging increased digitalization. - Historically, fintech in insurance mainly streamlined procedures and compressed cost structures at limited scale; both industry and customers have relied heavily on agents, so direct online channels are limited. - Fintech adoption objectives: improve productivity and customer experience. - Examples cited: - Motor Insurance DLT Based Authentication System (MIDAS) — deploys blockchain to enable vehicle owners to authenticate cover notes and policies to tackle fake documents. - Insurance Fraud Prevention Claims Database (IFPCD) — leverages BDAI to help underwriters detect suspicious claim patterns, starting with motor, health and personal accident policies, to be followed by life and travel policies. - Other innovations: chatbots for simulated human interaction; facial recognition for e-KYC; artificial intelligence systems to streamline claim management and automate services; big data analytics for persistency, risk profiling and precision pricing. ### IA industry contact, sandbox and Fast Track - The IA established the InsurTech Facilitation Team as an interface with external stakeholders to provide general enquiries and advice, promote awareness and assist with regulatory issues. - The IA maintains contact with industry through the Working Group on Embracing Fintech underpinning the Future Task Force. - The IA has signed three bilateral fintech cooperation agreements with foreign counterparts. - Two key IA initiatives: - a. Insurtech Sandbox - Provides a platform for authorized insurers to run pilot trials of innovative applications in a controlled environment demonstrating broad compliance with regulatory requirements. - IA expects adequate consumer safeguards and exit strategies to be embedded into trial projects. - Nine applications approved through the Insurtech Sandbox to date; six of which were successfully rolled out to the market. - All approved projects concerned selling long-term insurance policies through a digital platform without intermediaries or with a streamlined process. - The IA anticipates acceleration of this trend and is contemplating issuance of additional guidance on ethical use of artificial intelligence/machine learning. - b. Fast Track scheme - Pilot scheme for expedited handling of applications for new authorization involving only digital distribution channels. - A dedicated queue has been set up without compromising regulatory requirements; four cases approved thus far. - As a prudential measure, applicants under Fast Track intending to carry out long term insurance business must team up with a traditional player. - Virtual insurers are using BDAI and machine learning for customer onboarding, marketing and claims handling, and moving gradually into underwriting and pricing. - The IA is using COVID-19 challenges to encourage shift from saving-oriented to protection-focused products via a three-pronged strategy: - temporary facilitative measures with alternative compliance requirements for remote selling of designated insurance products; - approval of trial projects meeting full compliance under the Insurtech Sandbox; - development of a shared-use platform for smaller market participants to launch cost-effective remote distribution solutions. - The shift impacts license applications, continuous professional development courses and qualifying examinations for intermediaries. - Suggested further focus: exploring RegTech and SupTech developments to enhance the IA’s regulatory and supervisory approach. ### Virtual banks — licensing, structure and business models - New licenses aim to enable non-bank players with innovative digital business models to offer banking services, promoting financial innovation, customer experience and financial inclusion. - The HKMA granted banking licenses to eight VBs in the first half of 2019 among 33 VB applications. - The HKMA issued a revised Guideline on Authorization of Virtual Banks in May 2018 to facilitate VB introduction. - The minimum paid-up capital requirement imposed is HK$300 million, which is the same requirement as that for all licensed banks. - Eligible applicants to own and operate a VB include banks, financial institutions and technology companies. - VB ownership composition among the eight authorized VBs: - two are joint ventures set up by established banking groups; - one is formed by a local fintech firm; - two have been established with the support of Mainland insurance firms; - three are established by Mainland technology firms (bigtech). - Partnership arrangements: a few VBs formed through partnerships between AIs and fintech firms (including joint ventures). - If a VB is not owned by a bank or financial institution, the VB applicant should be held by an immediate holding company (IHC) in the HKSAR, with supervisory conditions imposed on the IHC (same requirement for local AIs under section 70 of the BO). - Among the 8 VBs authorized, 7 are held through an IHC incorporated in the HKSAR. - The Guideline states supervisory conditions to be imposed on IHC will “likely” cover capital adequacy, liquidity, large exposures, intra-group exposures and charges over assets, group structure, activities undertaken, risk management, fitness and propriety of directors and senior management and the submission of financial and other information to the HKMA. - Conditions on ultimate holding companies (UHCs) tend to focus on containing UHC influence on the locally-incorporated AI and requiring regular submission of information and independent assessment reports by the UHC. - The report notes that adding greater clarity on minimum supervisory conditions to be imposed would be desirable. - Business model and market developments: - Many newly licensed VBs delayed launch to the second half of 2020 due to longer than anticipated lead times to meet regulatory requirements and the COVID-19 pandemic. - As of 30 September 2020, seven VBs have officially launched services to the public, and the remaining one is conducting a pilot trial to a confined group of customers through the HKMA’s sandbox mechanism. - There is no hard deadline for licensed VBs to launch operations. - Incumbent banks are strengthening mobile services and accelerating digital financing in response to VBs; several large retail banks removed minimum balance fees for basic banking accounts shortly after HKMA granted VB licenses. - VBs generally plan to offer a basic suite of services (e.g. deposits, loans and fund transfers) at the outset with greater focus on new customer experiences. - Medium to longer term, VBs aim to expand into wealth management and insurance product sales; certain VBs plan cross-border services such as cross-border payments and remittances. - Customer scope: VBs are expected to focus on serving retail customers (including small- and medium-sized enterprises) in the HKSAR in initial years. They should consult the HKMA if intending to promote or provide banking services targeting potential depositors or other customers residing outside the HKSAR. *People’s Republic of China—Hong Kong SAR, International Monetary Fund* ### 71. The HKMA expects that the VBs will be relatively small players in the HKSAR banking ### The HKMA expects that the VBs will be relatively small players in the HKSAR banking ### Virtual banks: market size, competitive effects, and lending practices - The HKMA expects that the VBs will be relatively small players in the HKSAR banking sector in the initial years of operation. - VBs’ financial projections submitted with license applications indicate total deposits in the first few years will correspond to only a small portion of aggregate retail customer deposits of existing conventional retail banks in the HKSAR. - Preliminary HKMA analysis suggests the introduction of VBs is not likely to trigger price wars or other aggressive behaviors that would affect banking stability, although: - Some short-term competitive pressures and talent poaching may arise. - VBs can enhance overall competitiveness by adopting the latest fintech solutions and more flexible operational processes. - Increased competition may undermine incumbents’ fee-income but may also inspire incumbent banks, especially small- to mid-sized banks, to become more competitive and facilitate fintech development. - Credit underwriting and lending by VBs: - VBs may utilize big data and behavioral assessment in credit assessments to facilitate loans to individuals and micro and SMEs by easing the burden of providing financial records. - Presently VBs have started applying big data to machine learning models for underwriting and risk management, but uncertainties remain about model performance (e.g., “through-the-cycle” robustness is yet to be seen). - If VBs continue to rely on existing Credit Bureau data like incumbent banks, differentiation may be weak; weak differentiation could lead VBs to aggressively build market share at the expense of recording losses in the initial years. ### Supervisory approach for VBs and required assessments - VBs are subject to the same set of supervisory requirements applicable to conventional banks, including micro- and macro-regulatory requirements (including Basel III requirements). - Monitoring and specific pre- and post-launch requirements: - Before commencement of business, VBs must perform an independent assessment of compliance with relevant requirements, focusing on policies and procedures, management oversight, corporate governance standards, and control and monitoring measures. - In six months of full launch of business, VBs must perform another independent assessment focusing on implementation of relevant policies and procedures. - Before business commencement, VBs must conduct an independent assessment evaluating whether adequate and effective risk management controls are in place to manage technology-related risks. - VBs should complete the maturity assessment under the C-RAF to evaluate cyber resilience and take remedial actions to strengthen relevant risk management controls. - VBs should perform self-attestation to ensure compliance with the security programs of interbank payment systems (including the SWIFT Customer Security Programme). - Supervisory responsibilities: - Case Management Divisions of BSD are responsible for day-to-day prudential supervision of the eight VBs. - Ongoing conduct supervision is primarily performed by the existing incident handling teams of the BCD. - Staff supports HKMA’s plan to conduct a comprehensive assessment of VBs’ business performance and their impact after the first group of licensed VBs have officially launched services; close monitoring of initial operations and comprehensive assessment of medium- to long-term viability are critical, particularly before processing further license applications. ### Key risk areas emphasized by HKMA - The HKMA identified three key risk areas more pertinent to VBs and will devote resources to supervising these: - Technology Risk Management - Technology risk management is vital given VBs’ technology-driven business model and primary use of digital channels. - HKMA requires and will assess whether VBs have security and technology-related controls that are “fit for purpose”. - Customer Protection and Data Privacy - General customer protection requirements applicable to conventional banks are equally relevant to VBs. - VBs are expected to become signatories to the Treat Customers Fairly Charter and comply with the Code of Banking Practice. - VBs face potentially higher data privacy risks due to likely use of big data and behavioral data analytics; they are required to put in appropriate safeguards and implement measures to ensure compliance with data privacy requirements in the HKSAR and embody the spirit of data ethics. - AML/CFT - VBs’ risk assessments should reflect risks specific to internet/electronic delivery models, such as impersonation risk, and ensure controls effectively mitigate these risks. ### Third party risk, outsourcing, and concentration monitoring - Industry trends and statistics: - According to a recent industry survey, 95 percent of the responding banks are developing artificial intelligence capacities through partnership with external technology firms. - Over 100 AIs’ business processes have been outsourced to Cloud service providers, with the vast majority being non-mission critical (e.g., customer relationship management, human resources). - A few TSPs are commonly engaged by some AIs but carry out non-core functions (e.g., statement printing). - Major banks’ mission-critical systems are generally hosted by the banks themselves or their intra-group companies. - HKMA outsourcing framework and monitoring: - HKMA established the SPM on outsourcing in 2001, which covers banks’ use of Cloud computing. - A 2016 review updated pre-notification requirements for material outsourcing initiatives and provided additional examples including those related to Open API implementation; the definition of “material outsourcing arrangement” includes new material outsourcing arrangements and material changes to existing material outsourcing arrangements. - AIs are required to submit the Risk Assessment Form on Technology-related Outsourcing (including Cloud Computing) Project for technology-related outsourcing initiatives that are considered material or meet certain criteria (criteria include involvement of hosting, operation or administration of (a) critical systems or (b) systems that store, access or transmit consumer data; or involvement of the use of public cloud or similar cloud computing arrangements). - AIs are expected to appoint independent assessors to evaluate due diligence on service providers and compliance with relevant guidelines before material outsourcing initiatives are implemented. - Since 2015, the HKMA has identified more than 500 interconnections between AIs and their outsourcing service providers. - Concentration risk monitoring and recommendations: - The pre-notification arrangement enables the HKMA to identify and assess interconnectedness between AIs and fintech firms through material outsourcing initiatives. - The HKMA monitors material concentration risk of fintech firms engaged by AIs via pre-notification, direct discussions with major outsourced providers and cloud service providers, and a 2017 survey on AIs’ outsourcing activities. - Staff recommends developing a methodology to recognize degree of interconnectedness and concentration risk more systematically and comprehensively. - Supervisors could aggregate banks’ registers of outsourced service providers to form a comprehensive picture of TSPs across the system. - The HKMA would benefit from developing a financial sector map, in collaboration with other domestic sectoral regulators and the FSTB, to provide an overview of critical functions, organizations, systems, and service providers in the HKSAR financial sector; the map would assist in identifying systemic risks from key nodes, interconnections, and critical service providers and inform risk-based supervisory and oversight approaches. ### Open Banking / Open API: implementation, guidance, and monitoring - HKMA’s collaborative approach and timeline: - HKMA facilitated development of the Open API Framework following a public consultation from January to March 2018; the Framework was published in July 2018. - Open APIs are progressively implemented in four phases: - Phase One (Product Information) – 20 retail banks launched over 500 Open APIs in early 2019 covering information of deposits, loans, insurance, investments, and other banking products and services. About 800 registrations from TSPs to access banks’ Phase I Open APIs had been recorded in March 2019. - Phase Two (Customer Acquisition) – Third-party applications have been able to conduct customer onboarding and product application for banks since the end of October 2019; banks are developing partnerships with TSPs and collaborative services have been gradually launched. - Phases Three (Accessing Account Information) and Four (Conducting Transactions) – A set of technical standards on data definitions and payments transfer processes will be published in 2021, following which an implementation timetable will be set. - HKMA guidance and industry baselines: - HKMA facilitated development of a common baseline on TSP management with HKAB, TSP representatives, and other parties, containing common requirements and risk management considerations for selecting and monitoring TSPs. - HKMA communicated expectations that banks should (i) carry out onboarding checks on TSPs, (ii) conduct ongoing monitoring of TSPs, and (iii) enter into a bilateral contractual relationship with each TSP for each Open API collaboration accessing Phase II Open APIs. - In October 2019, HKMA issued supervisory guidance (FAQs and circular) on technology risk management controls, outsourcing arrangements, and consumer protection in respect of Open API; a circular on 29 October 2019 reminded banks to adopt adequate consumer protection measures in Open API initiatives in line with the Code of Banking Practice and other applicable regulatory requirements. - Risks, capacity constraints, and monitoring needs: - Open banking remains a developing area and its ability to drive consumer demand is yet to be explored. - A collaborative approach where TSPs offer solutions under partnership with banks may be appropriate for the HKSAR currently; HKMA does not consider prescribing rigid and detailed requirements at this stage and has requested AIs adopt a risk-based approach. - Relevant technology risk management control principles include, but are not limited to: - (i) effective network segregation and access management, - (ii) adequate controls over the confidentiality and integrity of information, - (iii) effective monitoring and incident response, - (iv) robust capacity planning and business continuity management. - Many fintech companies involved in Open APIs are start-ups that may not be able to afford bank-like stringent cyber risk governance and controls (e.g., penetration testing) and other compliance requirements. - When entering Phases III and IV, HKMA may need to strengthen monitoring and collect more comprehensive information on market participation in Open API including overall market share, size, number of transactions, change of customer base and growth rate of the Open API, its impact on the banking sector, etc. - Staff welcomes HKMA’s plan to consider more regular surveys on progress and/or further thematic reviews. *Source: PEOPLE’S REPUBLIC OF CHINA–HONG KONG SAR chapter content provided.* ### 88. Several initiatives and projects of payment and settlement services are either based on ### 1hkgea2021004 - 88. Several initiatives and projects of payment and settlement services are either based on ### Key projects and initiatives - FPS (Faster Payment System) - Introduced in September 2018; launched by the HKMA and operated by the Hong Kong Interbank Clearing Limited (HKICL). - Operates on a round-the-clock basis and connects banks and SVFs. - As at end-September 2019, the HKMA has issued a total of 18 SVF licenses (including three banks with SVF business). - Framework: banks maintain clearing and settlement accounts; SVFs have access only to clearing accounts and rely on banks for settlement. - Each participant bank has a currency-specific FPS ledger account for settlement purposes (HKD and RMB supported by FPS). - The FPS ledger account and the RTGS ledger account together constitute the settlement account each bank maintains. - As of end November 2019, the FPS has processed 39 million transactions involving an aggregate amount of HKD 675 billion and RMB 16 billion. - Common QR Code Standard - HKMA introduced the Common QR Code Standard for retail payments. - A mobile application tool converts multiple QR codes in compliance with the Standard into a single combined QR code to facilitate merchant acceptance of different payment schemes. - Central Bank Digital Currency (CBDC) — Project LionRock - Study commenced in March 2017 in collaboration with the three note-issuing banks; included a PoC on token-based CBDC and debt securities issued into a single DLT system to explore domestic interbank payments, corporate wholesale payments, and delivery-versus-payment debt securities settlement. - HKMA conclusion: potential use of CBDC for domestic retail payment remains limited given efficient existing payment systems and proliferation of electronic payment products (e.g. FPS, e-wallets, credit and debit cards). - HKMA view: CBDC may have greater potential at the wholesale level and for cross-border payment by reducing layers of correspondent banking and enabling direct transactions between non-bank entities. - Project Inthanon-LionRock - Initiated September 2019 by HKMA and BOT to leverage DLT for cross-border payments and improve liquidity management between HKSAR and Thailand using CBDC. - Purpose: facilitate payment versus payment among banks in the HKSAR and Thailand via a DLT-based network; potential to scale to other jurisdictions if successful. - Note: Inthanon project (by BOT) developed a proof-of-concept for domestic wholesale funds transfer using CBDC issued by BOT. - eTradeConnect - DLT-based electronic trade finance platform launched since September 2018 by a consortium of major banks (currently comprises 12 licensed banks). - Aims to digitize paper-based/manual trade documentation and financing processes to enhance efficiency and reduce risks. - HKMA is enhancing functionalities and broadening geographical coverage; PoC on connectivity with we.trade completed March 2019. - HKMA and PBoC established a working group to explore connecting the platform to PBoC’s trade platform for the Greater Bay Area; a central bank in Southeast Asia indicated interest. - Hong Kong Exchanges and Clearing Limited (HKEX) fintech initiatives (Technology Empowered pillar of 2019-2021 Group Strategic Plan) - Smart contract for trade allocation: building smart contract-powered multilateral workflow for allocation of trades on the ‘northbound’ Stock Connect channel to enable T+0 settlement processing for onshore China equity trades. - Cloud computing: introduced a virtual private cloud for business applications, testing, and market connectivity services such as API interfaces. - Automation: robotic process automation (RPA) programme in production since March 2019; over 50 business processes automated to date. - Artificial intelligence: AI-assisted workflow platform extracts corporate actions data; achieves a 90 percent time saving and handles around 1,300 documents per week. AI also used for compliance assessment, prioritising market surveillance alerts, tracking multilingual adverse news, and providing a conversational chatbot. - Big data: introduced enterprise data lake, data wrangling and analytics tools, and specialist software for relationship detection among counterparties for risk monitoring and market analysis. ### Issues for consideration — fintech coordination policy - Rapidly changing payments and settlement landscape - Fintech in retail payment and settlement in HKSAR driven mainly by large overseas and Mainland-based technological service providers. - Risk of segmentation of the payment landscape due to closed-loop solutions, potentially leading to higher economy-wide costs. - Fintech-based products may exacerbate risks related to money laundering and terrorist financing, cyber-resilience, and personal data protection. - HKMA should continue active engagement with private sector to understand complexity, financial stability impact, and regulatory perimeter applicability. - Update of jurisdictional fintech strategy warranted - 2017 fintech strategy promoted HKSAR as fintech hub and coordinated authorities (HKMA, SFC, IA, others). - HKMA could act as facilitator to coordinate private sector innovation with existing infrastructure. - Recommendation: encourage and enable interconnectivity and interoperability between new fintech solutions and existing infrastructures via harmonization and compatibility through standards, guidelines and recommendations. - HKMA may actively encourage new fintech-based payment services to rely on the Faster Payment System. ### Regulatory and oversight framework — observations and considerations - Legal basis and mandate - HKMA derives regulatory and oversight function from the PSSVFO to promote safety and efficiency of payment, clearing and settlement systems. - HKMA responsibilities include: (i) designation and oversight of clearing and settlement systems and their links; (ii) monitoring compliance of designated systems with PSSVFO safety and efficiency requirements; (iii) instigating changes to bring systems into compliance; (iv) issuing a certificate of finality if criteria met. - FMIs must seek HKMA approval under the PSSVFO for adoption of any new technology requiring changes to operating rules and procedures. - Oversight challenges from innovative technology entities - Regulated infrastructures may rely on unregulated TSPs for platform, cloud, or other critical functions. - BigTechs (e.g. Alipay and WeChat) introduce systemic importance: millions of customers and sizable transaction value/volume; offer bundled services and cloud solutions to conventional providers, posing systemic implications if failures occur or cloud providers are compromised. - HKMA mandate allows requiring regulated entities to submit data on third-party providers or issue oversight expectations; however, data from third parties may be incomplete or selectively filtered. - International consensus lacking on regulatory remit to directly oversee unregulated third-party services; HKMA may consider strengthening legal basis to directly oversee unregulated third-party services related to payment and settlements, with regard to international practices. - Decentralization and complexity of new technology - DLT-based payment solutions change asset registration, clearing, settlement and safekeeping processes; rights and obligations, timing of discharge, and governance may be ambiguous. - Nodes and ledgers can be spread over several jurisdictions; cloud services may be located in different jurisdictions. - HKMA may need to review oversight approach to designated payment systems to account for implications arising from innovative technology entities. - Need to update regulatory framework as fintech innovations are introduced - HKMA adopts a functional, risk-based, and technology-neutral approach; regulatory requirements are based on intrinsic characteristics of activities and aimed at addressing associated risks. - Entrance of BigTech and increased role of third-party providers, plus decentralized features, may require updates to framework in risk sensitivity, completeness, and consistency across provider types. - HKMA should continue to assess adequacy of existing framework to identify, monitor and mitigate inherent fintech risks, and consider mechanisms with foreign host authorities for access to information on cloud activities serving HKSAR markets. ### Legal risk - PFMI legal basis requirement - An FMI should have a well-founded, transparent, and enforceable legal basis; applying this to decentralized, cross-jurisdiction arrangements requires identification of applicable law and assessment of conflict of law and enforceability. - Legal basis of nature and ownership of assets issued and settled by fintech arrangements, and enforcement of obligations and rights, must be clearly defined; settlement finality should be legally supported. - Particular DLT considerations - DLT-based environments comprise multiple service providers, including unregulated entities across jurisdictions; legal basis and procedures may not be clear or enforceable everywhere. - Some DLT arrangements entail latency to update and synchronize ledger state changes; settlement finality may not be well defined or achieved in good time. - Irrevocability of transactions depends on probability and degree of consensus among nodes and time passed; in permissionless DLT, participants may revise previously added transactions through consensus processes. - Existing law may lack clear legal protection for DLT-based services; HKMA needs to assess each business case to establish whether legal basis, including settlement finality, can be ensured without ambiguity. *Italic line: People’s Republic of China–Hong Kong SAR — International Monetary Fund (extracted from content unit 1hkgea2021004).* ### 107. The PFMI promotes the need for sound and transparent governance arrangements to ### 1hkgea2021004 - 107. The PFMI promotes the need for sound and transparent governance arrangements to ### Governance of FMIs (PFMI principles and implications) - The PFMI promotes the need for sound and transparent governance arrangements to promote the safety and efficiency of FMI. - Governance arrangements of FMI should support: - the stability of the financial system, - public interest considerations, and - the objectives of relevant stakeholders. - Governance affects FMI’s operational resilience and reliability; roles, responsibilities, operational reliability objectives and potential vulnerabilities should be: - well defined, and - monitored. - The relationship between owners, decision-making bodies, management, and relevant stakeholders should be clear and transparent. ### DLT-based arrangements: governance challenges - DLT-based arrangements present challenges to the governance structure of payment and settlement entities due to: - the decentralized process of executing a transaction, which increases complexity of decision-making, - different roles and responsibilities of involved stakeholders including owners, board of directors, management, external service providers. - Important governance considerations for DLT-based arrangements: - ownership and governance of all components of a DLT-based arrangement (for example, components relying on open-source code) should be considered (note: example technologies cited include Hyperledger Fabric, R3 Corda and Ethereum). - liability questions may arise if a settlement failure occurs (e.g., liability of the code provider or the payment and settlement entity). - payments and settlement may not be the core business of a fintech firm, leading to: - less focus on soundness and safety of payment and settlement, and - potential conflicts of interest with other activities such as IT innovation, network, communication, etc. ### Network-based service providers: standards and market fragmentation - Recommendation: The HKMA should, where applicable, encourage network and network-based critical service providers to accommodate international communication and message standards. - Rationale: - The PFMI requires the FMI to use, or at a minimum accommodate, relevant internationally accepted communication procedures and message standards to facilitate efficient payment, settlement, and recording. - Several network-based service providers offer digital platforms/networks (e.g., RippleNet) that are identical to conventional traditional payment messaging systems. - DLT networks are offered as technical platforms to execute payment transfer arrangements, often based on non-negotiable rule books and conditions. - Most of these entities operate without being regulated and subject to system risk specific requirements. - Many solutions are conceptualized in isolation within the payment and settlement ecosystem, increasing risk of market fragmentation. - Policy action: - HKMA should monitor international developments and join international efforts in encouraging network and DLT-based service providers to adopt international communication and message standards. ### Virtual Assets (VA): activity, exposures, and regulatory stance - Observations on VA activity in HKSAR: - In a 2019 ranking of cryptocurrency exchanges, the HKSAR was listed as the fourth-largest with 22 exchanges, after the European Union, United States and United Kingdom, and just ahead of Singapore (with 19 exchanges). - Based on December 2018 data, the monthly trading volume was much larger in HKSAR (US$32.5 billion) than in the other jurisdictions, with the exception of Malta. - Newer data for 2019 confirm the top position of the HKSAR’s crypto trading platform volumes, especially for crypto to crypto exchanges. - ICOs are no longer an active form of VA fundraising, but other forms have attracted interest, including initial exchange offerings (IEOs). - Reportedly, the total number of funds raised by IEOs in the second quarter of 2019 exceeds US$1.4 billion. - Footnote/terminology: - There is no legal definition of VAs in Hong Kong, but authorities typically follow the definition by the FATF when referring to these instruments. - According to the FATF, a VA is a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes. - The term VA may be interchanged with “crypto assets” in the note. ### Financial sector exposures to VAs: survey findings and data collection - HKMA 2018 banking survey findings: - Banking industry’s financial exposures to VAs remains negligible. - Banks have not engaged in proprietary trading of crypto-related investment products or offered/recommended any crypto-related investment products to their clients. - Banks have no appetite for establishing business relationships with customers dealing in VAs. - No investment bank has established VA trading desks in the HKSAR. - SFC findings from surveys: - SFC’s 2018 hedge fund manager survey (over 550 SFC-licensed hedge fund managers as of 30 September 2018) found only a few managers reported exposures to VAs and derivatives on VAs; none intended to invest more than 10% of the NAV in VAs. - SFC’s 2018 biennial survey on sale of non-exchange traded products found only a few licensed corporations sold crypto-related products and the amount involved was immaterial. - SFC believes VA proprietary holdings by licensed corporations to be minimal because such holdings cannot be counted towards liquid assets when computing capital maintained by the firm. - Data collection and recommendation: - SFC will continue to collect information through a new annual survey to be jointly conducted with the HKMA from 2020 onwards. - Recommendation: A more systematic approach to collection of information on VA holdings by all financial sector entities would be beneficial; data for the whole financial sector should be gathered via this survey (including insurance entities to the extent they can hold VAs). ### Regulatory approach and guidance by HKMA and SFC - Regulators’ stance: - HKMA and SFC keep an active approach to VAs and VASPs within their respective mandates, monitoring activities and issuing guidance where needed. - HKMA approaches VAs from financial stability monitoring and supervision of banks’ exposures; SFC’s remit covers offer, trading, custody of and investment in VAs. - HKMA current assessment and supervisory expectations: - HKMA considers the size of VAs remains small and therefore does not pose a material threat to financial stability but remains vigilant. - HKMA requires banks which incur financial exposures to VAs to have adequate risk management controls. - Banks planning to engage in crypto asset activities should discuss with the HKMA whether appropriate systems and controls are in place. - In 2019, HKMA issued a circular drawing attention to the BCBS Statement on prudential expectations regarding banks’ exposures to VAs and related services. - HKMA issued updated guidance to banks following the amendment of Recommendation 15 by the FATF. - Banks are expected to: - (i) conduct thorough customer due diligence against VASPs before establishing any customer relationship with them, and - (ii) undertake ML/TF risk assessments and take appropriate measures to manage and mitigate identified risks before offering any new banking or investment products relating to VAs. ### Planned statutory regime and SFC regulatory perimeter - Planned actions: - HKSAR is planning to introduce a statutory regime for regulating VAs and VASPs, in addition to existing legislation governing financial institutions where applicable. - SFC jurisdictional approach: - If individual VAs fall under definitions of “securities”, “futures contracts”, or “collective investment schemes” of the SFO, such assets will be subject to securities regulation and under the remit of the SFC. - Since 2017 the SFC has issued statements and circulars clarifying how existing legal framework may apply to different VA activities, focusing on offer/issuance, intermediation in VA investment products, trading services involving VAs and investment in VAs via CIS. ### Offers of VAs: securities and CIS implications - Offers of VAs falling under SFO definitions: - Subject to securities laws. - September 2017 SFC statement: depending on facts and circumstances of an ICO, digital tokens offered or sold may be “securities” as defined in the SFO. - Activities related to such tokens may constitute a regulated activity and may require a license from the SFC. - If the offer involves an offer to the HKSAR public to acquire securities or participate in a Collective Investment Scheme (CIS), registration or authorization requirements apply unless an exemption applies (e.g., offer to professional investors only). - Non-security VAs: - There are no other mandatory disclosure requirements applicable to an offer of non-security VAs in the HKSAR. ### SFC enforcement actions and market developments on offers - SFC actions during 2017–2018: - Reached out to ICO issuers, warning them about compliance with the SFC’s regulatory regime where tokens qualify as securities. - Most issuers confirmed compliance or ceased to offer tokens to HKSAR investors. - SFC issued a public warning of cryptocurrency risks in February 2018 and halted one ICO to the HKSAR public in March 2018 (considered VAs as CIS units under the SFO). - Market outcome: - ICO activity virtually disappeared since its peak in 2018. - SFC continues to monitor potential offers of VAs but currently does not consider it a significant source of risk to investors. ### Intermediation of VA investment products: notification and licensing - Notification requirements and supervisory engagement: - Financial intermediaries must notify the SFC before engaging in any activity related to VAs and are advised to discuss activities with the SFC beforehand. - If crypto assets business is conducted in HKSAR by other entities in the same group as an intermediary, the intermediary is encouraged to inform the SFC as soon as reasonably practicable. - June 2018 SFC circular reminded intermediaries of notification requirements under the Securities and Futures (Licensing and Registration) Rules to promptly notify the SFC of significant changes in business nature. - Licensing of crypto-asset related products: - Dealing in crypto asset related investment product may be a regulated activity requiring a license. - December 2017 SFC Circular: some crypto-based futures have features of a futures contract and dealing/marketing such products requires licensing under the SFO. - SFC warned in 2019 it had not licensed or authorized any person in Hong Kong to offer or trade VA futures contracts. ### VA Trading Platform Activities: voluntary framework and licensing conditions - Voluntary framework (SFC): - Starting from November 6, 2019, a firm operating a centralized VA trading platform in the HKSAR and intending to offer trading of at least one security token may apply for a license from the SFC for Types 1 (dealing in securities) and 7 (providing automated trading services) regulated activities. - Upon licensing, the VA trading operator would be placed in the SFC Regulatory Sandbox and should expect more frequent monitoring, reporting and reviews. - Licensing would impose a set of regulatory standards/terms and conditions; the SFC’s regulatory remit would cover both security and non-security token activity of the platform. - Main licensing conditions the SFC will impose if it grants a license: - (i) Licensee must only provide services to professional investors; - (ii) Must comply with the Terms and Conditions for VA Trading Platform Operators; - (iii) Must obtain the SFC’s prior written approval for any plan/proposal to introduce or offer a new or incidental service, activity or to make a material change to existing ones; - (iv) Must obtain the SFC’s prior written approval before adding any product; must provide monthly reports to the SFC on its business activities; - (v) Must engage an independent professional firm acceptable to the SFC to conduct an annual review of its activities and operations and prepare a report confirming compliance with licensing conditions and all legal and regulatory requirements. ### Terms and Conditions for VA Trading Platform Operators: key regulatory expectations - Areas covered by Terms and Conditions: a. Safe custody of assets: - Platforms hold VAs on behalf of clients; SFC expects client protection equivalent to traditional securities-sector institutions. - Client assets must be held on trust for clients through a wholly owned subsidiary incorporated in the HKSAR and holding a “trust or company service provider” license under the AML/CFT Ordinance. - Platform operators must ensure they store 98 per cent of clients’ VAs in cold wallets and should minimize transactions out of the cold wallet in which a majority of client VAs are held. - Procedures required for events such as hard forks or air drops; adequate processes for handling deposit/withdrawal requests to guard against theft, fraud, professional misconduct or omissions. - Insurance policy must be in place at all times, covering custody risks in both hot and cold storage. - Strong internal controls for private key management: cryptographic seeds and keys securely generated, stored and backed up. b. Investor protection: - Platforms must ensure clients have sufficient knowledge of VAs and relevant risks before providing services. - Platforms must assess concentration risks by setting trading limits, position limits or both with reference to client’s financial situation to ensure sufficiency of net worth to assume risks and bear potential trading losses. c. AML/CFT: - Platforms should establish and implement adequate and appropriate AML/CFT policies, procedures and controls and regularly review their effectiveness and introduce enhancements as appropriate, taking into account SFC guidance and updates from the Financial Action Task Force. - Platforms should take reasonable steps to establish true and full identity of clients, their financial situation, investment experience and investment objectives. - SFC permits deployment of virtual asset tracking tools to trace on-chain history but reminds operators they have primary responsibility for AML/CFT obligations and that such tools have limited reach and can be compromised by anonymity-enhancing technologies or mechanisms. d. Prevention of market manipulative and abusive activities: - Platforms must establish written policies and controls for surveillance to identify, prevent and report market manipulative or abusive trading activities. - Measures include taking immediate steps to restrict or suspend trading upon discovery (e.g., temporarily freezing accounts) and adopting effective market surveillance systems from reputable independent providers. - Note: Parts XIII and XIV of the SFO enabling SFC action against market misconduct in securities and futures markets will not apply to any licensed VA trading platform because it is not a recognized stock or futures market and the VAs are not securities or futures contracts listed or traded on such a market. e. Accounting and auditing: - Platform operators must exercise due skill, care and diligence in selection and appointment of auditors for financial statements, considering auditors’ experience and track record in auditing VA related business and capability to audit a platform operator. f. Risk management: - Platform operator and associated entities need a sound risk management framework to identify, measure, monitor and manage full range of risks. - Platforms should require customers to pre-fund their accounts. - In limited cases, SFC may allow off-platform transactions for institutional professional investors, settled intra-day. - Platform operator is prohibited from providing any financial accommodation to clients to acquire VAs. g. Conflicts of interest: - Licensed platform operators cannot engage in proprietary trading or market making on a proprietary basis. - If platform plans to use market-making services to enhance liquidity, SFC expects this to be done at arm’s length by an independent external party using normal user access channels. h. VAs for trading: - Platforms should establish a function responsible for establishing, implementing and enforcing: - (i) rules setting out obligations of and restrictions on VA issuers; - (ii) criteria for a VA to be included on its platform and application procedures; and - (iii) criteria for halting, suspending and withdrawing a VA from trading, options available to clients holding that VA and any notification period. *Italic: Source: 1hkgea2021004 - 107. The PFMI promotes the need for sound and transparent governance arrangements to (PDF).* ### 122. While the regime for VA trading platforms provides a comprehensive framework to ### 1hkgea2021004 - 122. While the regime for VA trading platforms provides a comprehensive framework to ### Voluntary VA trading-platform regime: scope and limitations - The SFC’s voluntary regime "intends to enable close supervisory interactions with an evolving industry, while addressing AML/CFT and investor protection concerns arising from these platforms." - Main limitation: the voluntary nature of the regime. - "It does not adequately prevent criminal misuse of VAs and does not eliminate the potential for regulatory arbitrage and reputational risk to the regulator." - Platforms may "decide to operate an entirely unregulated business (by avoiding to trade VAs that qualify as securities under the SFO)." - Certain key issues, including "the inability of the SFC to take action against market misconduct in licensed platforms," could only be overcome "by amending securities legislation." - The SFC will "continue to monitor VA activities and consider the need for legislative changes in the longer term, while using the IFEC to address investor education needs in relation to trading platforms." ### Proposed statutory licensing regime for VA trading platforms (FSTB consultation) - The FSTB "has recently launched a public consultation of a proposed statutory licensing regime for Virtual Asset trading platforms." - The legislative proposal: - "Sets out features of a regulatory regime for VA trading platforms which are similar to those of the existing voluntary regime and allows VA platforms that have opted in to be regulated under the voluntary regime to continue their operations." - Proposes to subject "all VA platforms incorporated and with a permanent address in HKSAR to licensing requirements which include fit-and-proper tests based on criteria comparable to those applicable in other financial sectors." - Would restrict VA trading platforms to dealing with "professional investors", defined to include "high net-worth individuals and institutional investors (licensed financial institutions)." - "Unlicensed VA trading platforms, whether in Hong Kong or elsewhere, would be prohibited from actively marketing their services to the public of HKSAR." - Licensed VA exchanges would be subject to the full range of AML/CFT obligations: "customer due diligence, record keeping and filing suspicious transaction reports," and would be subject to AML/CFT supervision by the SFC. - Proposed sanctions for breaches include "criminal liabilities and administrative penalties." - Policy limitation noted in proposal: HKSAR authorities "do not propose to regulate other standalone activities that fall under the FATF standard such as transfer and custodian services on the basis of such activities being 'limited' in HKSAR but it is unclear whether they are proven to be of low ML/TF risks." - The proposal "gives the SFC the authority to impose, and vary as need be, licensing conditions, on VASPs, as well as to publish regulatory requirements covering, inter alia, the main regulatory elements set out by the voluntary regime for VA trading platforms." ### Recommendations to HKSAR authorities prior to and after legislation - Near-term actions: - "Closely monitor VA activities in the HKSAR to be able to properly identify and address any risks building up in the system, and to advance investor education efforts." - The Consultation paper "is a step in the right direction and the authorities are encouraged to push the necessary legal reforms forward." - After enactment: - "Once the legislation is enacted, the authorities should ensure its effective implementation." - Identify and assess ML/TF risks stemming from VA activities outside the proposed licensing regime (i.e., "transfer, custodian and initial coin offering") and "subject them to the AML/CFT regulatory framework in line with the FATF standards unless the ML/TF risks are proven to be low." - Authorities "intend to build flexibility into the framework to facilitate future expansion of the scope of VA activities covered, which is welcomed." - The SFC "should also continue to regularly communicate with investors and address any investor education needs that may come up." ### Collective investment schemes (CIS) and SFC guidance for VA investment - SFC guidance for managers of funds investing in VAs: - "The Proforma Terms and Conditions for Licensed Corporations which Manage Portfolios that invest in VAs (Terms and Conditions) apply to corporations that manage funds that invest at least 10 per cent of their assets in VAs or funds whose stated investment objective is to invest in VAs (VA Fund Manager)." - The Terms and Conditions "cover key fund management regulatory requirements and provide specific guidance on VA related issues, where relevant," including heightened attention to custody, selection of custodial arrangements, and disclosure. - Under the Terms and Conditions, "VA Fund Managers should only allow professional investors to invest in a VA fund." - Where the fund is distributed through distributors, "the VA Fund Manager should establish measures to ensure that it is only distributed to professional investors." - Distribution and intermediary obligations: - The SFC’s "Circular on Distribution of VA Funds" clarifies intermediaries who distribute VA funds (whether or not authorized by the SFC) "are required to be licensed or registered for Type 1 regulated activity (dealing in securities)." - Guidelines for VA fund distributors focus on investor protection by: - Requiring that "VA funds are only targeted to professional investors" and requiring distributors "to assess whether clients have knowledge of investing in VA or related products and avoid clients’ concentrated exposure to these assets;" - Requiring distributors "to conduct proper due diligence on VA funds not authorized by the SFC, their fund managers and other relevant entities;" - Requiring distributors "to comply with certain disclosure requirements." ### Cross-sectoral monitoring and stablecoin considerations - HKSAR financial regulators "should continue to cooperate to monitor VA activities and identify potential risks to the financial system." - VAs and related activities "will continue to evolve and authorities should remain vigilant and strictly monitor developments to ensure an adequate regulatory perimeter." - Developments regarding stablecoins "are also likely to significantly change the VA and VASP landscape and a joint approach will be required to fully understand the risks and implications for the financial system." - Recommendation: "Increase cross-sectoral engagement on this topic (in the lines of the current cooperation between the HKMA and the SFC), under the auspices of the FSTB or otherwise. A systematic cross-sectoral approach to VA activities will pave the way to a better understanding of these and those of stable coins and enable a faster reaction from authorities when needed." *Source: PEOPLE’S REPUBLIC OF CHINA—HONG KONG SAR, INTERNATIONAL MONETARY FUND (excerpts).* --- _Source: https://www.imf.org/-/media/files/publications/cr/2021/english/1hkgea2021004.pdf_