🛡️ Business Operations and Practices

1. The Internal Control Guidelines are published by the Securities and Futures Commission under which section of the SFO?

1. Section 129
2. Section 399
3. Section 169
4. Section 213

The Introduction to the Internal Control Guidelines states that they are published under section 399 of the SFO, which covers codes and guidelines published by the Commission. Codes of conduct such as the Code of Conduct are published under section 169, the matters considered in determining whether a person is fit and proper are listed in section 129, and injunctions and other orders are dealt with in section 213.

2. Which ONE of the following statements about the legal status of the Internal Control Guidelines is CORRECT?

1. They have the force of law, and a breach of them is an offence under the SFO
2. They are not law, but non-compliance may reflect on fitness and properness
3. They are inadmissible as evidence in court proceedings brought under the SFO
4. They bind registered institutions but do not apply to licensed corporations

The Internal Control Guidelines state that they do not have the force of law, yet the Commission shall consider whether a failure to substantially follow them reflects adversely on a person's fitness and properness. They cover licensed or registered persons alike, and in proceedings under the SFO they are admissible in evidence and are taken into account if relevant, so the other statements are wrong.

3. Which ONE of the following is NOT a matter for which internal controls are intended to give reasonable assurance under the Internal Control Guidelines?

1. Safeguarding of the firm's own and its clients' assets
2. Reliability of financial and other information used in the business
3. Maximising the annual profit earned from proprietary trading
4. Compliance with applicable laws and regulatory requirements

The Introduction to the Internal Control Guidelines lists orderly and efficient operation, safeguarding of the firm's and its clients' assets, proper records and reliable information, and compliance with applicable laws and regulatory requirements. Profit maximisation from proprietary trading is not an objective of internal controls, so it is the item that is NOT included.

4. Under the Internal Control Guidelines, who is ultimately responsible for the adequacy and effectiveness of a licensed corporation's internal control system?

1. Its compliance officer, who operates every control procedure
2. Its external auditors, who review the firm's controls every year
3. The SFC, which approves the control procedures of each firm
4. Its senior management, including the board where applicable

The Internal Control Guidelines say the licensed person and its senior management, which may include the Board of Directors, Chief Executive Officer or Managing Director, are ultimately responsible. External auditors and the compliance function assist, and the SFC does not approve each firm's procedures but takes each firm's circumstances into account when assessing them.

5. Under the Internal Control Guidelines, which area of internal control deals with the integrity, security and availability of documents and electronically stored data?

1. Personnel and training
2. Information management
3. Segregation of duties
4. Risk management policies

Part IV of the Internal Control Guidelines is headed information management and requires policies to ensure the integrity, security, availability, reliability and thoroughness of all information, including documentation and electronically stored data. Personnel and training, segregation of duties and risk management are separate areas with different purposes.

6. At Harbourview Securities Limited, the research analysts report to the head of corporate finance, who also approves their published reports. Which area of the Internal Control Guidelines is MOST LIKELY to be of concern?

1. Segregation of duties and functions
2. Information management systems
3. Risk management and reporting
4. Personnel and training programmes

Part II of the Internal Control Guidelines says that, where practicable, the research and corporate finance functions should be segregated to ensure the objectivity of the research function. Reporting to the head of corporate finance undermines that objectivity. Personnel and training, information management and risk management do not address conflicts between functions.

7. Under the Internal Control Guidelines, how should the compliance function of a licensed corporation be organised, subject to constraint of size?

1. Combined with the settlement function and reporting to the head of dealing
2. Placed in the sales team so it can benefit from its business knowledge
3. Embedded in each dealing desk and reporting to the head of that desk
4. Independent of operational functions, with a direct line to Management

The compliance part of the Internal Control Guidelines requires an appropriate and effective compliance function which, subject to constraint of size, is independent of all operational and business functions and reports directly to Management. Placing it within dealing, settlement or sales would compromise that independence.

8. Which ONE of the following is NOT consistent with the Internal Control Guidelines on the internal audit function?

1. It is, where practicable, free of operating responsibilities
2. Those performing the review have the necessary technical competence
3. It has a direct line of communication to Management or the audit committee
4. It reports to the head of the dealing desk to stay close to operations

Part VI of the Internal Control Guidelines requires, where practicable, an independent and objective internal audit function free of operating responsibilities with a direct line of communication to Management or the audit committee, staffed by people with the necessary technical competence and experience. Reporting to the head of the dealing desk would destroy independence.

9. Under the Internal Control Guidelines, which of the following matters should the compliance procedures of a licensed corporation cover? I. Commission rebates and soft dollar practices. II. Preparation, approval and dissemination of research reports. III. The remuneration of the firm's non-executive directors. IV. Prevention of money laundering.

1. I, II and IV only
2. I, II and III only
3. I and II only
4. II, III and IV only

The compliance part of the Internal Control Guidelines says compliance procedures should cover business practices such as commission rebates and soft dollar practices and the preparation, approval and dissemination of research reports, as well as the prevention of money laundering. The remuneration of non-executive directors is not listed, so III is excluded.

10. Ms Lam runs Harbourview Securities Limited, a small firm that cannot practicably separate dealing from settlement duties. How will the SFC MOST LIKELY approach this under the Internal Control Guidelines?

1. It will take account of the firm's size and any compensatory measures
2. It will treat the lack of segregation as a breach of the SFO
3. It will exempt the firm from the Guidelines because it is small
4. It will require the firm to cease dealing until duties are segregated

The Internal Control Guidelines say that a pragmatic approach will be adopted, giving the inability of a small firm to segregate duties as an example, and that staff will consider whether compensatory management and supervisory measures are in place. The Guidelines are not law, so no automatic breach arises, and small firms are not exempt from them.

11. Client K makes a written complaint to Harbourview Securities Limited about Mr Chan, a licensed representative. Under the Internal Control Guidelines, who should, where possible, investigate it?

1. Compliance staff who are not directly involved in the matter
2. Mr Chan himself, because he knows the facts of the matter best
3. The head of dealing, who directs the licensed representatives
4. Mr Chan's line supervisor, who monitors his sales activities

The compliance part of the Internal Control Guidelines requires written complaints procedures and says that, where possible, complaints should be investigated by staff performing the compliance function who are not directly involved in the subject matter of the complaint. The supervisor, the representative and the head of dealing are all involved in the business concerned.

12. Under the Internal Control Guidelines, regular reconciliations of a firm's records to those issued by clearing houses, banks and custodians should be:

1. Performed and approved by the staff who record the trades in the system
2. Carried out once a year by the external auditors during the audit
3. Checked or reviewed and approved by appropriate senior staff
4. Applied to assets kept at the firm's premises but not to those held elsewhere

The operational controls part of the Internal Control Guidelines calls for regular reconciliation of internal records to those of third parties, such as clearing houses, banks, custodians, counterparties and executing brokers, with the reconciliations checked or reviewed and approved by appropriate senior staff. The other approaches lack independent review or are not stated in the Internal Control Guidelines.

13. Under the Internal Control Guidelines, which ONE statement about material non-compliance by a firm's staff with legal and regulatory requirements is CORRECT?

1. Compliance staff report it promptly to Management, which notifies the SFC and exchanges
2. It is recorded internally and disclosed if and when the firm is later investigated
3. Compliance staff report it to the SFC first, and Management hears of it after the annual audit
4. Management reports it to the SFC when client assets have been lost, but not otherwise

The compliance part of the Internal Control Guidelines requires compliance staff to report all occurrences of material non-compliance promptly to Management, and Management to notify the applicable exchanges, clearing houses and the Commission promptly. Delay until an audit or an investigation, or a limitation to lost client assets, is not provided for.

14. Which ONE of the following is NOT consistent with the Internal Control Guidelines on risk management?

1. Submitting exposure reports to Management regularly, with prompt reports of variances
2. Reviewing risks whenever there is a significant change in the key personnel
3. Taking a large position because the return is high, whatever the firm's capacity
4. Setting risk policies that match the firm's size, complexity and risk profile

Part VIII of the Internal Control Guidelines says a firm should only take on positions which it has the financial and management capacity to assume, requires regular exposure reports to Management, comprehensive reviews whenever there is significant change in the business, operation or key personnel, and risk policies commensurate with size and complexity. Exceeding capacity for return is inconsistent.

15. Which of the following are consistent with the Internal Control Guidelines on audit trails for orders? I. Client orders are recorded from the time they are received. II. Internally generated orders are recorded as well as client orders. III. Order tickets are numbered sequentially. IV. Time stamping facilities are used.

1. I and II only
2. I, II and III only
3. I, II, III and IV
4. I, III and IV only

The operational controls part of the Internal Control Guidelines calls for clear and comprehensive audit trails recording all orders, both client and internally generated, from origination, including the time the order was received or initiated, through execution and settlement, for example through sequential numbering of order tickets and time stamping. All four statements are consistent with it.

16. According to paragraph 5.1.1 of the Licensing Handbook, which ONE of the following is a matter to which the SFC has regard in deciding whether an applicant is fit and proper?

1. The applicant's nationality and place of residence
2. The applicant's number of clients in the previous year
3. The size of the applicant's annual marketing budget
4. Reputation, character, reliability and financial integrity

Paragraph 5.1.1 of the Licensing Handbook says the SFC has regard to financial status or solvency, educational or other qualifications or experience, the ability to carry on the regulated activity competently, honestly and fairly, and reputation, character, reliability and financial integrity. Client numbers, marketing spend and nationality or residence are not among those matters.

17. The directors of Harbourview Securities Limited designate Mr Chan as manager-in-charge of risk management and conclude that they are no longer responsible for the firm's risk controls. Which ONE of the following statements is CORRECT?

1. Responsibility passes to Mr Chan once he is designated as manager-in-charge
2. Responsibility passes to the SFC as soon as it is told of the designation
3. Management remains ultimately responsible for the firm's internal controls
4. Responsibility passes to the external auditors who review the risk controls

The Introduction to the Internal Control Guidelines states that the licensed person and its senior management are ultimately responsible for the adequacy and effectiveness of the internal control system. Designating a manager-in-charge assigns accountability for a function but does not transfer that ultimate responsibility to an individual, the SFC or the external auditors.

18. In corporate governance, what is the main purpose of having independent non-executive directors on a board?

1. To run the daily operations of the company on behalf of the executive team
2. To give objective oversight and independent judgement on board decisions
3. To represent the interests of the largest shareholder in board decisions
4. To take over the external auditors' work in reviewing the annual accounts

Independent non-executive directors are not part of management and have no material link with the company, so they provide objective oversight and independent judgement, acting as a check on the executive directors. Running daily operations is the role of management, a particular shareholder's interests are not their remit, and they do not replace the external auditors. The Internal Control Guidelines likewise treat the Board of Directors as part of the Management ultimately responsible for internal controls.

19. Which ONE of the following is a typical function of the audit committee of a company's board?

1. Overseeing financial reporting, internal controls and the external audit
2. Negotiating commission rates for the company's sales team members
3. Approving the company's marketing plans and advertising budget
4. Setting the daily trading limits of every dealer in the trading team

An audit committee, usually made up mainly of independent non-executive directors, oversees the financial reporting process, the effectiveness of internal controls and the relationship with the external auditors. The Internal Control Guidelines also say that, where practicable, the review function should be overseen by an audit committee. Trading limits, commission rates and marketing are executive matters.

20. Which of the following are features of good corporate governance? I. Independent non-executive directors sit on the board. II. The roles of chairman and chief executive are combined in one individual. III. An audit committee oversees internal control and the audit process. IV. Executive directors set their own pay without independent oversight.

1. I and III only
2. I and IV only
3. II and IV only
4. I, II and III only

Good corporate governance relies on checks and balances: independent non-executive directors give objective judgement, and an audit committee oversees internal control and the audit process. Combining the chairman and chief executive roles in one individual, or letting executives set their own pay without independent oversight, concentrates power and weakens those checks, so II and IV are not features of good governance. The Internal Control Guidelines refer to the Board of Directors and the audit committee as part of the structure that oversees internal controls.

21. At Harbourview Holdings Limited, Mr Chan is chairman of the board, chief executive and chairman of the audit committee, and the board has no independent non-executive director. Which governance concern does this MOST LIKELY raise?

1. Excessive separation between ownership and management
2. Over-reliance on external auditors for business decisions
3. Concentration of power with weak checks and balances
4. Too many committees duplicating the work of the board

Holding the chair, the chief executive role and the audit committee chair, with no independent non-executive director, concentrates power in one person and removes independent checks and balances on management. The structure does not create a separation of ownership from management, does not rely on external auditors for decisions, and has no excess of committees. The Internal Control Guidelines treat the Board of Directors and the audit committee as part of the oversight of internal controls.

22. Harbourview Asset Management Limited is licensed for Type 9 (asset management). It is not an exchange participant, and its licence is subject to a condition that it shall not hold client assets. Is it required to take out insurance under the Securities and Futures (Insurance) Rules (Cap. 571AI)?

1. Yes, because the Rules apply to any corporation licensed for a regulated activity
2. No, because it is not an exchange participant and cannot hold client assets
3. No, because the licence condition alone is enough to take it outside the Rules
4. Yes, because a licence condition against holding client assets does not matter

Section 3 of the Securities and Futures (Insurance) Rules applies the Rules to a corporation licensed under section 116(1) of the SFO, except one that is not an exchange participant of the Stock Exchange Company or the Futures Exchange Company and whose licence carries a condition that it shall not hold client assets. Harbourview meets both conditions, so it falls outside the Rules. The two conditions are cumulative, so the licence condition alone would not be enough; the Rules do not reach every licensed corporation, and the no-client-assets condition is one of the two tests.

23. Which of the following risks must be covered by the insurance that a specified licensed corporation maintains under the Securities and Futures (Insurance) Rules? I. Loss of client assets through fraudulent or dishonest conduct by employees. II. Loss of client assets through robbery or theft while in the firm's custody. III. Loss of client assets through forged or fraudulent instructions. IV. A fall in the market value of client assets.

1. I and II only
2. I, II and IV only
3. I, II and III only
4. I, III and IV only

Schedule 1 to the Securities and Futures (Insurance) Rules specifies risks of loss of client assets attributable to fraudulent or dishonest conduct by employees, robbery or theft while in custody, forged or fraudulent alteration of cheques, fraudulent use of an information system, and forged or fraudulent instructions. A fall in market value is a market risk and is not covered.

24. Which insured amount per period of insurance do the Securities and Futures (Insurance) Rules specify for a specified licensed corporation, not an exchange participant, whose only regulated activity is dealing in securities?

1. HK$5,000,000
2. HK$10,000,000
3. HK$15,000,000
4. HK$25,000,000

Schedule 2, Part 2 (Cap. 571AI), as in force at 1 January 2027, lists HK$15,000,000 against dealing in securities. HK$25,000,000 is the figure for a single policy spanning more than one regulated activity, while HK$5,000,000 and HK$10,000,000 do not appear in the Schedule.

25. Harbourview Securities Limited is not an exchange participant, has no licence condition against holding client assets, is licensed for Type 1 and Type 8 and buys a single insurance policy for the specified risks of both. What insured amount must that policy carry for each period of insurance?

1. HK$25,000,000
2. HK$15,000,000
3. HK$30,000,000
4. HK$50,000,000

For a corporation with two regulated activities and one policy, paragraph 2(a) of Part 1 of Schedule 2 fixes the insured amount at HK$25,000,000 (Cap. 571AI, in force at 1 January 2027). HK$15,000,000 is the single-activity figure, HK$30,000,000 adds two separate amounts, and HK$50,000,000 has no basis in the Schedule.

26. Under section 4(1) of the Securities and Futures (Insurance) Rules, which ONE of the following describes an insurer with which a specified licensed corporation may take out a policy other than the master policy?

1. It is an insurer licensed by the SFC and has a specified credit rating
2. It is not a related corporation of the firm and is approved by HKEX
3. It is an authorised institution regulated by the HKMA, with any credit rating
4. It is not a related corporation of the firm and has a specified credit rating

Section 4(1)(b) of the Securities and Futures (Insurance) Rules allows another policy with insurers that are not related corporations of the specified licensed corporation and that have a specified credit rating on the date of commencement; Schedule 3 sets ratings of A or above from named agencies. The SFC, HKEX and HKMA are not the test, and a rating is always required.

27. What is the highest deductible that section 4(4) of the Securities and Futures (Insurance) Rules allows an approved master policy of insurance to specify?

1. HK$500,000
2. HK$1,000,000
3. HK$3,000,000
4. HK$2,000,000

Under section 4(4) of Cap. 571AI, as in force at 1 January 2027, the deductible in a master policy, or in another approved policy, must not exceed $3,000,000. The lower amounts fall within the limit but are not the maximum.

28. Which body has the power under section 5 of the Securities and Futures (Insurance) Rules to approve a master policy of insurance for a regulated activity?

1. The Insurance Authority
2. The Securities and Futures Commission
3. The Stock Exchange of Hong Kong Limited
4. The Hong Kong Monetary Authority

Under section 5, it is the Commission that approves the master policy for a regulated activity, and only if each insurer holds the specified credit rating on the date of approval. The Insurance Authority, the Hong Kong Monetary Authority and the exchange company are given no such role.

29. Which of the following are obligations of a reporting financial institution under Part 8A of the Inland Revenue Ordinance (Cap. 112)? I. Keeping the evidence relied on for due diligence for 3 years. II. Establishing procedures to identify the jurisdiction of residence of each account holder. III. Establishing procedures to identify whether a financial account is a reportable account. IV. Furnishing returns directly to the SFC.

1. II and III only
2. I, II and III only
3. I, II and IV only
4. I, III and IV only

Section 50B of the Inland Revenue Ordinance requires procedures to identify the jurisdiction of residence of the account holder and whether an account is reportable. The evidence and record of steps must be kept for 6 years, not 3, and under section 50C returns are furnished in response to a notice given by an assessor of the Inland Revenue Department, not to the SFC.

30. The Common Reporting Standard for the automatic exchange of financial account information, which Hong Kong implements through Part 8A of the Inland Revenue Ordinance, was developed by which organisation?

1. The Financial Action Task Force on Money Laundering
2. The Organisation for Economic Co-operation and Development
3. The International Organization of Securities Commissions
4. The Financial Stability Board set up by the G20

The Common Reporting Standard was developed by the Organisation for Economic Co-operation and Development (OECD), and Part 8A of the Inland Revenue Ordinance requires reporting financial institutions to carry out due diligence and furnish returns. The FATF sets anti-money laundering standards, IOSCO is the international body of securities regulators, and the FSB monitors the global financial system.

31. Under section 3(1)(b) of Schedule 2 to the AMLO, a financial institution must carry out customer due diligence before carrying out for a customer an occasional transaction involving at least which amount?

1. HK$8,000
2. HK$50,000
3. HK$500,000
4. HK$120,000

Section 3(1)(b) of Schedule 2 to the AMLO requires customer due diligence before an occasional transaction of $120,000 or more, whether carried out in a single operation or in linked operations. HK$8,000 is the lower figure that section 3(1A) applies to wire transfers and virtual asset transfers, and section 3(1B) to occasional transactions of a licensed VAS provider; it is not the general limit. HK$50,000 and HK$500,000 are not thresholds in section 3.

32. Ms Lam, an account executive at Harbourview Securities Limited, notices an unusual pattern of incoming funds in Mr Chan's two-year-old account and suspects money laundering. His planned trade is small. What must Harbourview do under Schedule 2 to the AMLO?

1. Rely on the due diligence done when the account was opened
2. Wait until the trade reaches the HK$120,000 occasional limit
3. Carry out due diligence once Mr Chan is shown to be a PEP
4. Carry out customer due diligence despite the small amount

Section 3(1)(d) of Schedule 2 to the AMLO requires customer due diligence measures when the institution suspects that the customer or the customer's account is involved in money laundering or terrorist financing. The suspicion triggers the duty whatever the size of the trade, so waiting for the HK$120,000 limit in section 3(1)(b) is wrong. PEP status is a separate matter under section 10, and earlier due diligence does not remove the duty.

33. In relation to a corporation, a beneficial owner under Schedule 2 to the AMLO includes an individual who owns or controls, directly or indirectly, which proportion of its issued share capital?

1. More than 25%
2. More than 10%
3. More than 20%
4. More than 5%

Section 1 of Part 1 of Schedule 2 to the AMLO defines a beneficial owner of a corporation as an individual who owns or controls, directly or indirectly, “more than 25% of the issued share capital of the corporation”. The same 25% test applies to voting rights, and exercising ultimate control over the management also qualifies. The 5%, 10% and 20% figures are not the AMLO test.

34. After a business relationship with a customer ends, for at least how long must a financial institution keep the customer's identification and verification records under Schedule 2 to the AMLO?

1. 3 years
2. 10 years
3. 7 years
4. 5 years

Section 20(3) of Schedule 2 requires the customer records in section 20(1)(b) to be kept throughout the business relationship and for at least 5 years beginning on the date on which it ends. Three years is shorter than the statutory minimum. Seven and ten years are longer than the minimum, although a relevant authority may require a longer period by written notice under section 20(4).

35. Before establishing a business relationship with a customer known to be a politically exposed person, which ONE of the following must a financial institution do under Schedule 2 to the AMLO?

1. Obtain the SFC's written approval and verify the source of wealth
2. Obtain senior management approval and check source of wealth and funds
3. Refuse the relationship, because a PEP cannot become a customer of an FI
4. File a suspicious transaction report with the JFIU before opening the account

Section 10(1) of Schedule 2 requires the institution, before establishing the relationship, to obtain approval from the senior management and to take reasonable measures to establish the source of wealth and the source of the funds. The SFC does not approve individual PEP relationships, and the duty covers source of funds as well as wealth. A PEP relationship is not prohibited, and being a PEP is not in itself grounds for an STR.