This month sees the implementation of the Securities and Futures Commission's (SFC's) 'Managers in Charge Regime' (MICR) for all licensed corporations. Veronique Marquis and Catriona Kellas, of Eversheds, look at the compliance implications for organisations caught by the MICR and the wider implications of the SFC's intention to strengthen senior management accountability in Hong Kong.

On 16 December 2016 the SFC published a circular and FAQ document introducing measures designed to heighten the accountability of senior managers in licensed corporations. The circular clarifies the existing liability of senior managers, and introduces new corporate governance requirements which apply to all licensed corporations. The MICR will come into effect on 18 April 2017 and there is a hard deadline of 17 July 2017 for compliance with the key aspects of the regime. It is expected that corporations will need to dedicate resources immediately in order to meet the SFC's challenging deadlines. The SFC has made governance and accountability a priority in terms of ongoing supervision and enforcement. The new MICR serves to emphasise that this focus is unwavering and heralds an era of increased personal accountability for management in Hong Kong. The regime echoes the similar UK Senior Managers Regime which came into force in March 2016, and the sharp focus on individual accountability in the US.

Key elements of the new regime

The regime requires licensed corporations to appoint at least one 'manager in charge' (MIC) in respect of each of the eight new 'core functions’ (see graphic below). MICs need to be fit and proper under pre-existing rules, and to have the relevant seniority and authority to properly supervise the relevant function and report to the board of the licensed corporation. MICs are personally accountable for their relevant functions. Potential sanctions include disciplinary action and civil and criminal penalties. For most core functions, MICs are not required to be 'responsible officers’ (ROs). There are two exceptions: MICs in respect of the 'overall management oversight’ and 'key business line' functions will need to be (or to become) ROs. To the extent that managers occupying these two core functions are not currently ROs, licensed corporations have until 16 October 2017 to apply for RO status in respect of those individuals. One of the key components of the new regime is the requirement for the board to adopt a formal document setting out the management structure of the corporation. This formal document should include information as to reporting lines, responsibilities, and the roles and accountability of senior management personnel. Whilst this document does not need to be formally submitted to the SFC, the SFC may request sight of it at any time. Licensed corporations must submit details of all MICs and an organisational structure chart showing certain prescribed details on the SFC online portal by 17 July 2017. The information must be regularly reviewed and kept up to date. The regime also requires that MICs formally acknowledge their appointment, and the scope of their roles and responsibilities.

Timeline

The SFC has prescribed a short period of time for licensed corporations to satisfy the new regime, with a three-month window from 18 April to 17 July 2017 to satisfy the mandatory requirement to submit information as to management structure (see table below). Licensed corporations who need to apply for their newly appointed MICs to become ROs will benefit from a three-month grace period to submit their application in that respect to 16 October 2017. Still, this compressed timeline is expected to present a challenge for many licensed corporations. Various factors can complicate compliance with the regime. Corporations that are parts of larger groups of companies, where back or middle office functions are discharged by other corporate entities within the group, need to prepare the terrain and start a dialogue with any non-employees that they believe are fulfilling core functions, and to ensure that the relevant individuals will be prepared to formally acknowledge their appointment. In many cases, specific training will be required to ensure new MICs understand their role and discharge their duties under the regime. Even more challenging is the scenario where core functions, such as IT, are fully outsourced to external service providers, and where no senior manager currently has the required degree of oversight over that function. While the SFC has left the door open to outsourced MICs, it has not waived the requirements that all MICs, including any outsourced ones, must have seniority, authority, and a direct reporting line to the board. In practice, few outsourcing scenarios will lend themselves to the outsourcing of MIC responsibilities. The most difficult part of the regime will likely be the demarcation of responsibilities between various MICs. For corporations that operate on matrix management models, with various dotted reporting lines, or where key business lines are overseen by multiple managers, there will need to be clarity over each MIC's scope of responsibility, with no grey areas remaining. Such an exercise requires careful planning and meticulous execution, as well as stakeholder engagement from an early stage. Corporations that have gone through the similar Senior Managers Regime in the UK, which provided inspiration for the MICR, will remember all too well that the drawing of responsibilities maps can be fraught and require sensitive management.

Enforcement: impact of the regime on senior management accountability

The SFC has made it clear that it wants to strengthen the corporate governance of licensed corporations. The personal responsibility element of the MICR is the cornerstone of this approach, and is mirrored in the SFC's enforcement priorities. In its Enforcement Reporter published on 8 December 2016, the SFC gave a warning shot, requiring corporations to ensure that 'senior management (whether or not licensed by us) are fully aware that they are accountable for the misconduct of their firms’. Clearly the SFC hopes that a combination of the new regime and the SFC's existing enforcement powers, will help to drive the financial services industry in Hong Kong further towards attaining an exemplary standard of responsible conduct and investor protection. Despite this, the SFC has made it clear that it considers the MICR to be within the ambit of its existing powers, and that no new regulation or legislation is required for its implementation. This is particularly interesting considering that the MICR turns the spotlight on middle and back office functions, such as IT and compliance, which have not traditionally been associated with senior accountability. It is fair to say that, although the SFC may have had the ability to pursue enforcement action against personnel in those functions, historically their focus has been trained on the front office. However, the SFC's decision to predicate the MICR on the basis of their power to pursue regulated persons (see 'The underlying regulatory regime', below), regardless of whether the relevant individuals are licensed or not, signals that the pool of those who may be held to account could be dramatically expanded. It is expected that enforcement action will follow an upward curve. As ever, it is difficult to be definitive as to the circumstances in which the SFC will seek to take enforcement action against individuals under the MICR. No new guidance has been provided, and the SFC has reiterated that each scenario will be analysed on its individual facts. The SFC will be looking to establish where responsibility for breaches lie, and the degree of responsibility borne by each member of senior management. Various factors will be taken into account, including:

• the extent of each individual manager's authority in the firm's business
• the individual's level of responsibility within the licensed corporation concerned, including any supervisory duties he or she may perform, and
• the level of control or knowledge he or she may have concerning any failure by the licensed corporation or persons under his or her supervision, to follow the Code of Conduct.

Regulators have long decried the difficulty to ascertain and allocate responsibility in the event of a breach. Since the principal deliverable of the MICR is an organisation and responsibility chart, in the future, the SFC should find it much easier to exercise disciplinary powers against individuals who will be unable to claim that they were not aware of the extent of their responsibility. In that sense, the MICR provides a roadmap to enforcement against senior managers.

The underlying regulatory regime: what are the penalties?

Under Part 9 of the Securities and Futures Ordinance (SFO), the SFC may exercise its disciplinary powers to sanction a 'regulated person’ if the person is guilty of misconduct or is considered not fit and proper 'to be or to remain the same kind of regulated person’ (see Section 194 of the SFO). Importantly, the term 'regulated person’ means:

• a licensed person
• a responsible officer of a licensed person, or
• a person involved in the management of the business of a licensed person (regardless of whether he or she is licensed). As MICs are, by definition,
• involved in the management of a licensed corporation, they automatically fall within the ambit of 'regulated persons’.

Under Section 193(2) of the SFO, where a licensed corporation is found guilty of misconduct, managers may also be guilty of misconduct if the misconduct arose through their conduct, or with their consent or connivance, or as a result of their negligence. 'Misconduct’ in this context includes an act or omission relating to the carrying on of any regulated activity, which is or is likely to be prejudicial to the interest of the investing public or to the public interest. Outside of these statutory powers, it is worth bearing in mind that a failure to ensure compliance with the MICR may in itself call into question an MIC's own fitness and properness. Senior managers should note that disciplinary sanctions available to the SFC are both civil and criminal in nature. Civil liability under Part 9 of the SFO is set out in Section 194 of the SFO and includes the following disciplinary sanctions:

• fines not exceeding HK$10 million or three times the amount of the profit gained or loss avoided by the regulated person as a result of the misconduct
• revocation or suspension of the licence
• revocation or suspension of approval to be an RO
• prohibition of a regulated person from applying for licences or registration, becoming an RO, executive officer or relevant individual, and
• public or private reprimand.

In addition, where a corporation has been found guilty of an offence under parts XIII and XIV of the SFO (such as false trading, price rigging, market manipulation and disclosure of misleading information), the SFC may seek to extend criminal liability to any of the corporation's officers, or partners in a partnership, where the offence is committed with their consent, connivance or otherwise attributable to their recklessness. The criminal liability of officers in such cases carries a sanction of a maximum 10 years imprisonment and fines of up to HK$10 million (Section 390 SFO). 'Officers’ includes directors, managers, company secretaries, or any person involved in the management of the corporation – which, again, would presumably include all MICs.

Extra-territoriality

The disciplinary powers under Part 9 of the SFO apply to all regulated persons. Importantly, these powers do not differentiate between regulated persons caught within the SFO definition wherever they are located. Enforcement risk therefore applies equally to MICs located abroad and who may, in practice, have had – so far – very little exposure to or awareness of the SFC's regulatory regime. This will have to change, as the regime requires MICs to formally acknowledge their appointment and role definition.

How can licensed firms look to support their senior managers?

Some licensed corporations will want to review the insurance coverage in place for directors and officers, and consider whether additional cover is needed for MICs. Typically, directors and officers will already be covered for civil liability, including the costs of legal representation. However, this cover may not extend to the often problematic early stages of a regulatory investigation, before any claim is made. The costs of securing independent legal advice for senior managers, which is often needed in those early stages, can be substantial. Some policies only offer a capped cover, or will cover only if the individual is specifically identified as the target of the investigation. If several managers share the sub-limit, cover can quickly prove inadequate. Licensed corporations will also need to consider rolling out training and enhancing their compliance infrastructure. Implementing the new regime will mean casting a fresh eye on employment contracts, HR and supervision policies and compliance manuals, among other documents.

What next?

With the implementation of the SFC's MICR, Hong Kong becomes the first Asian jurisdiction to adopt a senior management regime and becomes part of a global trend towards personal accountability. Concerns have been expressed that the industry will struggle with implementing the regime within the given timeframe and to find the additional resources that need to be allocated to compliance. Time will tell whether the regime will prove successful in enhancing stability and confidence in Hong Kong as a financial market. Veronique Marquis Partner and Registered Foreign Lawyer (England and Wales), Eversheds Catriona Kellas Registered Foreign Lawyer (England and Wales), Eversheds For more on the UK's Senior Managers Regime see the International Report article in CSj September 2016 (pages 24–29).

SIDEBAR: Five things you need to know

1. The new regime applies to all licensed corporations.
2. The deadline for complying is 17 July 2017.
3. The new regime highlights personal accountability and liability for front office, middle office and back office managers.
4. Implementing the new regime may require significant resources, particularly for groups of companies, corporations operating in multiple jurisdictions and organisations which adopt matrix management (with multiple or dotted reporting lines).
5. Potential civil and criminal sanctions can apply to personnel who may not previously have considered themselves to be within the SFC's enforcement remit.