Employment in Financial Services

The NBB has issued a Fit & Proper Handbook, which was last updated on 22 December 2022.

Besides, Febelfin has adopted codes of conduct and regulations for relations between financial institutions and their customers, which can be considered standard practice in the sector.

Each financial institution may also provide more concrete or more precise quality standards for its clientele.

There is no general code defined by law or regulation.

Each company can adopt its standard of behaviour as a rule.

Certain activities require specific protocols for the Prevention of Money Laundering and Combating the Financing of Terrorism:

• the capture, intermediation, and investment of financial resources from third parties in national or foreign currency;

• the purchase and sale of foreign currency or gold as a financial asset or exchange instrument; and

• the custody, issuance, distribution, settlement, negotiation, intermediation, or securities administration.

Within the scope of the Brazilian System for Preventing and Combating Money Laundering and the Financing of Terrorism, it is up to institutions and their employees to adequately comply with Central Bank regulations. Also, institutions must promote the effectiveness of the apparatus to combat and prevent money laundering, carry out risk management with the implementation of effective policies, procedures, and controls, and help the Brazilian state locate suspicious financial operations so that they can be investigated.

First of all, various obligations discussed so far have the effect of forcing, if they were not already there, employees in the financial services sector to behave in an honourable manner and respect prudential rules.

In addition, Law 2016-1691 of 9 December 2016 on transparency, the fight against corruption and the modernisation of economic life states in article 17 that in certain large companies, managers must take all measures to prevent and detect the commission, in France or abroad, of acts of corruption or influence peddling.

This means setting up a code of conduct that will be integrated into the internal regulations, in compliance with the procedure for consulting employee representatives provided for in article L. 1321-4 of the French Labour Code.

This code of conduct involves the implementation of measures and procedures that will be monitored by the French Anti-Corruption Agency. In particular, the code of conduct must define and provide examples of the various types of behaviour to be prohibited as likely to constitute corruption or influence peddling. It must also establish an evaluation and control system, as well as a disciplinary system, enabling the company's employees to be sanctioned if there is a violation of the company's code of conduct.

In addition to this code of conduct, which is part of the internal regulations, almost all players in the financial services sector have put in place charters and policies to protect confidential information and regulate risky activities.

Employees must conduct themselves in line with their respective roles and responsibilities, which in client-facing roles indirectly leads to them being subject to specific behavioural obligations (such as having to adhere to certain procedures and documentation obligations before selling a service or product to a client). In addition, company policies required by the regulator (eg, on sustainability or equal treatment) often include behavioural standards.

In addition, there are voluntary standards adopted by various professional associations, such as the Code of Conduct of the Federal Association of Financial Services, which apply to their respective members.

SFC

Under the SFO, licensed representatives and ROs are required to be “a fit and proper person” to carry on the regulated activities and must adhere to the standards of behaviour set out in the “Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission”. Other relevant guidelines regarding standards of behaviour include:

• “Fit and Proper Guidelines”, which set out the general expectations of the SFC of what is necessary to satisfy the licensing or registration requirements that a person is fit and proper.
• “Guidelines on Competence”, which set out the competence requirements and its objective to ensure a person is equipped with the necessary technical skills and professional expertise to be “fit”, and is aware of the relevant ethical standards and regulatory knowledge to be “proper” in carrying on any regulated activities.

HKMA

Under the BO, employees of an authorised institution that carry on regulated activities under the SFO are required to be fit and proper. In addition, the HKMA needs to be satisfied that the chief executive, directors, controllers and executive officers of the authorised institutions are fit and proper. Other relevant guidelines regarding standards of behaviour include:

• “Code of Banking Practice”, which is to be observed by authorised institutions in dealing with and providing services to their customers.
• Supervisory Policy Manual CG – 2 “Systems of Control for Appointment of Managers”, which sets out the system of control that authorised institutions should have for ensuring the fitness and propriety of individuals appointed as managers.

IA

The conduct requirements for licensed insurance agents and brokers are set out in Division 4 of the IO. Other relevant codes and guidelines include:

• “Code of Conduct for Licensed Insurance Agents”, which sets out the fundamental principles of professional conduct that buyers of insurance are entitled to expect in their dealings with licensed insurance agents.
• “Code of Conduct for Licensed Insurance Brokers”, which sets out the fundamental principles of professional conduct that buyers of insurance are entitled to expect in their dealings with licensed insurance brokers.
• “Guideline on ‘Fit and Proper’ Criteria under the Insurance Ordinance”

Financial services regulators like the RBI, SEBI and Insurance Regulatory and Development Authority of India (IRDAI) regulate employees through prescribed frameworks and their organisation-specific rules.

The obligations for the conduct of employees in financial services are determined depending upon the type of organisation: public sector banks (majorly owned by the state) or private banks; sectors (banking, non-banking, insurance, capital market); regions (different local laws); and level of seniority (liability of officers or manager is different from regular employees or clerical staff).  Though there are no statutory standards, judicial pronouncements have set a higher threshold of duty of care for employees in the financial services sectors. The Andhra Pradesh High Court in Harinarayan Seet v Andhra Bank[1] held dismissal of service as a proportionate punishment for dereliction of duty by banking employees, which would have otherwise attracted a lesser penalty for employees in less-critical sectors.

In terms of general labour legislation also applicable to financial services employees, financial services organisations fall under the definition of “commercial establishments”, whose definition has been laid down by the Shops & Commercial Establishments Act (state level). They provide certain conduct-specific obligations, for example, a prohibition against discrimination, suspension or dismissal for misconduct.

The other major piece of labour legislation that lays down standards of conduct is the Industrial Employment (Standing Orders) Act, 1946 (IESOA). However, its applicability to commercial establishments or to a specific industry is dependent upon state-wide laws. For example, the states of Haryana and Karnataka have notified the application of the IESOA to commercial establishments with a minimum of 50 employees. This implies that financial services institutions in these states, meeting the above criteria, are bound to comply with the IESOA. Upon the application of the IESOA, the establishments are required to submit to the certifying officer draft standing orders proposed for their establishment, which should cover acceptable standards for employees.

In the banking sector, employees of public-sector banks, private-sector banks and foreign banks are bound by the obligations laid down by the RBI and their organisation rules. The provisions of these rules, which are different from other industries, are stricter: observance of secrecy; prohibition against using influence to secure employment for family members; bypassing regular compliance checks for availing of banking facilities; prohibition against media contributions, participating in politics or standing for election; demonstrations prejudicial to the public interest; and acceptance of gifts in an official capacity.

In terms of financial propriety, employees must not indulge in speculation in stocks and shares, but must avoid personal insolvency and even disclose their moveable and immoveable assets. During employment, they are also forbidden from engaging in any outside employment (stipendiary or honorary) without the prior approval of the organisation. Higher managerial employees are subject to additional scrutiny. Those belonging to public sector enterprises are brought within the jurisdiction of the Central Vigilance Commission, the apex vigilance institution. It is due to the gravity of corruption cases that the senior management of private sector banks is also included within the ambit of “public servant”, which usually includes employees of only public sector organisations. This was upheld by the Supreme Court of India in the case of Central Bureau of Investigation v Ramesh Gelli[2].  The organisations in the insurance and capital markets sectors also have similar institution-wide conduct and disciplinary rules.

Directors of organisations in the financial services sector may also be subject to duties stated in Schedule IV of the Companies Act 2013 and the SEBI (Listing Obligations and Disclosure Requirements) Regulations 2015.

When it comes to outsourcing activities, financial institutions formulate a board-approved “Code of Conduct” as part of the “Outsourcing Agreement”, which is to be complied with by the outsourced service providers and their employees.[3]

Though financial services employees are held to a higher set of moral standards, their right to participate in trade union actions for voicing their concerns has been upheld time and again. Recently, the Madras High Court in the case of D Thomas Franco Rajendra Dev v The Disciplinary Authority and Circle Development Officer and State Bank of India[4] observed bank officers’ right to unionise.  However, the right of bank employees to go on a strike gets limited since banks and other financial institutions are declared as ‘Public Utility Services’ (“PUS”). Accordingly, while they are not barred from going on strike, they must adhere to certain pre-requisites namely service of notice of at least 6 weeks before going on a strike, prohibition of any strike within 14 days from date of service of above notice, prohibition of going on a strike before the expiry of the date of that strike and non-authorization of any strike during the pendency of any conciliation proceedings or 7 days after the conclusion of such a proceeding. Upon being declared a PUS, the concerned industry must adhere to these conditions failing which the strikes would be declared as illegal.

Yes there are. They are:

• the F&P Standards;
• the minimum competency regime; and
• the IAF and SEAR (see question 1).

There are also sector-specific conduct of business requirements in legislation and codes, including the Consumer Protection Code 2012, the MiFID II regime, and other regulatory requirements applicable to RFSPs based on their industry sector that apply and deal with matters such as:

• error handling,
• disclosures to customers,
• acting in the best interests of customers; and
• complaints handling.

Yes, financial institutions are required to comply with the rules and standards of conduct as set out in the Rule Book (as a minimum).

Financial institutions must notify the IoM FSA of any departure or intended departure of an employee who undertakes a Controlled Function within ten business days. Furthermore, where a financial institution discovers an event which may lead to a final warning being given to, or other serious disciplinary action being taken against, any of its employees, the financial institution must inform the IoM FSA within ten business days. The notice must specify the event, and the name of the employee where the employee holds a Controlled Function or is a “key person”. Where the employee is not a “key person” and does not hold a Controlled Function role, the financial institution is not required to inform the IoM FSA of the name of the employee unless – following an investigation – the employee is given a final warning or other serious disciplinary action is taken (in which case, the financial institution will have to inform the IoM FSA of the employee’s name at that point).

Financial entities must establish, implement and apply, among other things:

• confidentiality policies;
• policies for internal control to confirm the acts, operations and services of individuals are carried out in an ethical, professional and legal manner;
• policies regarding the prevention of acts and operations with illegal resources;
• policies to prevent psychological risk factors;
• policies that allow the identification, follow-up and control of risks inherent to operations; and
• conflict of interest resolution policies.

Under the general provisions applicable to operations with securities carried out by members of the board of directors, officers and employees of financial entities and other obligated parties, the principles that must be complied with are the following:

• transparency in operations;
• equal opportunity before all other market participants in sureties operations;
• compliance with fair stock market customs and practices;
• absence of a conflict of interest; and
• prevention of improper behaviour that may have as its origin the use of privileged or confidential information.

Policies, manuals and codes must also include guidelines for the resolution of potential conflicts of interest, as well as the mechanisms to avoid the existence of such conflicts.

Financial entities must inform the CNBV annually, within 15 days, a report on the conduct, operations, and services of individuals. If any act or operation with illegal resources is detected, financial entities must inform the authorities immediately, including the CNBV and the SHCP.

The board of directors of operating companies of investment funds, distribution entities, and stock appraisers of investment funds must approve a code of conduct, which must consider:

• activities in compliance with the applicable laws;
• internal control rules for the compliance of provisions and policies contained in the code, including investment provisions issued by the CNBV;
• security mechanisms to ensure confidential information is used solely for authorised purposes and security measures to protect clients’ files from fraud, robbery or misuse;
• an obligation on the general manager, officers and employees to conduct themselves in a fair, honest and professional manner in the performance of their activities; and
• a prohibition on officers, employees and proxies executing any type of operation with the public that contravenes market practices.

Members of the board of directors, the general manager, officers, regulatory comptrollers, proxies, and other employees must immediately report the existence of illegal or unethical conduct or activity to the regulatory comptroller.

Under Dutch law, financial services companies must maintain integrity and ensure safety, stability and integrity within their company. This also means that financial services companies must prevent their employees from committing criminal offences, other violations of the law or socially inappropriate behaviour that undermines confidence in the financial services sector or financial markets. For these reasons, it is common to implement company-specific codes of conduct.

There are many statutory general regulations and standards of behaviour that financial services employees are expected to adhere to. Moreover, all industries have their own specific industry-wide guidelines and codes of conduct.

An important statutory obligation for directors, (other) policymakers and employees with customer contact is to take an oath or promise before entering into employment. The oath or promise contains a declaration that – among other things – the employee will perform his or her duties with care and integrity, will put customer interests first and will make every effort to maintain and promote confidence in the financial services sector.

In addition to the oath or promise as mentioned above, there is also the “banker's oath”. This oath goes further than the oath or promise mentioned above and is mandatory for all employees who work for banks.

Breaching guidelines, codes of conduct or the statutory oath could lead to disciplinary sanctions being taken by the company itself (such as termination of the employment contract) or by disciplinary supervisors (such as a reprimand or a fine).

Generally, MAS’ Guidelines on Individual Accountability and Conduct emphasises the importance of reinforcing standards of proper conduct among all employees, while employees conducting regulated activities must remain fit and proper for their roles under MAS’ Guidelines on Fit and Proper Criteria.

Guidelines, codes, directions, notices and legislation in relation to corporate governance and risk management (including those mentioned in questions 5 and 6) should also be considered.

Depending on the regulatory status of the employing entity and, as the case may be, on the exact activities of a financial service employee, a financial service employee needs to adhere to certain code of conduct rules (eg, regarding transparency and care, documentation and accountability).

Supervised companies in Switzerland are, in principle, required to set up an organisation that ensures the compliance with Swiss financial market laws and its statutory code of conduct rules. For this purpose, among others, companies are required to issue regulations that their employees must follow.

Under Swiss financial market laws, code of conduct rules are generally based on abstract statutory rules and concretized by recognised privately organised associations.

In particular, several professional organisations (eg, the Swiss Bankers Association or the Asset Management Association) and self-regulated organisations issue their own set of code of conduct rules that members are required to follow.

In the DIFC, the DFSA General Rulebook provides that authorised individuals must adhere to six principles, as follows:

• Principle 1 – Integrity
• Principle 2 – Due skill, care and diligence
• Principle 3 – Market conduct
• Principle 4 – Relations with the DFSA
• Principle 5 – Management, systems and control
• Principle 6 – Compliance
   

In the ADGM, the FSRA General Rulebook provides that authorized individuals must adhere to eleven principles, as follows:

• Principle 1 – Integrity
• Principle 2 – Due skill, care and diligence
• Principle 3 – Management, systems and control
• Principle 4 – Resources
• Principle 5 – Market conduct
• Principle 6 – Information and interests
• Principle 7 – Conflicts of Interest
• Principle 8 – Suitability
• Principle 9 – Customer assets and money
• Principle 10 – Relations with regulators
• Principle 11 – Compliance with high standards of corporate governance

Yes. Both the FCA and PRA have established their own high-level required standards of conduct known as the Conduct Rules. The FCA’s conduct rules are set out in the FCA’s Code of Conduct sourcebook. The PRA’s conduct rules are set out in the PRA Rulebook (and different versions apply to different types of PRA-regulated firms).

The FCA’s conduct rules apply to most individuals working at an SM&CR firm. The PRA’s conduct rules apply to more limited individuals working at dual-regulated SM&CR firms: senior managers (approved by the PRA or FCA); individuals within the PRA’s certification regime; key function holders; and non-executive directors.

The Conduct Rules apply to conduct relating to the carrying out of an individual’s role. They do not extend to conduct within an individual’s private life, provided that the conduct is unrelated to the activities they carry out for their firm. Nevertheless, an individual’s behaviour outside of work can still be relevant to the separate consideration of their fitness and propriety.

There are two tiers of Conduct Rules: a first tier of rules applicable to all individuals subject to the Conduct Rules; and a second tier applicable to senior managers only.

The rules of the first tier are:

• Rule 1 – You must act with integrity.
• Rule 2 – You must act with due skill, care and diligence.
• Rule 3 – You must be open and cooperative with the FCA, PRA and other regulators.
• Rule 4 – You must pay due regard to the interests of the customer and treat them fairly.
• Rule 5 – You must observe proper standards of market conduct.

The rules of the second tier (applicable to senior managers) are:

• SC1 – You must take reasonable steps to ensure that the business of the firm for which you are responsible is controlled effectively.
• SC2 – You must take reasonable steps to ensure that the business of the firm for which you are responsible complies with the relevant requirements and standards of the regulatory system.
• SC3 – You must take reasonable steps to ensure that any delegation of your responsibilities is to an appropriate person and that you oversee the discharge of the delegated responsibility effectively.
• SC4 – You must disclose appropriately any information for which the FCA or PRA would reasonably expect notice.
• SC5 (certain dual-regulated firms only) – When exercising your responsibilities, you must pay due regard to the interests of current and potential future policyholders in ensuring the provision by the firm of an appropriate degree of protection for their insured benefits.

Firms must notify the FCA if they take disciplinary action against an individual for a breach of the Conduct Rules.

Employees in some states, including California and New York, are required to receive periodic sexual harassment training.

Employers are also required to implement anti-discrimination and anti-harassment policies that:

• contain information about where and how employees can report improper conduct;
• prohibit retaliation for reporting or opposing improper conduct, or participating in an investigation regarding misconduct; and
• comply with state and local provisions that require employer policies to contain certain provisions (eg, New York, Los Angeles and San Francisco).

New York law prohibits employers from mandating confidentiality or non-disclosure provisions when settling sexual harassment claims (though it allows such provisions where it is the employee’s preference to include them).

California law prohibits employers from mandating confidentiality or non-disclosure provisions in employment agreements, settlement agreements, and separation agreements that are designed to restrict an employee's ability to disclose information about unlawful acts in the workplace, including information pertaining to harassment or discrimination or any other conduct the employee has reason to believe is unlawful.

FINRA and the SEC both have requirements and recommendations for social media use.

FINRA requires that broker-dealers retain records of social media communications related to the broker-dealer’s business made using social media sites and adopt policies and procedures designed to ensure that their employees who use social media sites for business purposes are appropriately supervised and trained, and do not present an undue risk to investors.

The SEC similarly requires that social media use complies with all federal security laws, including antifraud, compliance, and recordkeeping provisions.

Banking regulators provide guidance stating that each financial institution is expected to carry out an appropriate risk assessment that takes social media activities into consideration.

If a new element occurs that can influence one or more of the five criteria assessing the suitability of a person for the “fit and proper” authorisation (see question 2), the financial institution must file the adequate form with the NBB.

Notification to the NBB is also required in the event of termination or reappointment.

From a labour perspective, there are no circumstances in which notifications relating to the employee or their conduct must be made to local or international regulators.

Considering that the National Financial System is extremely regulated, there may be cases in which a mistake by an employee results in a duty to report to the authorities (information security breach, prevention of money laundering, and prevention of terrorist financing, among others, which could not be exhaustively included in this questionnaire).

There is no general code defined by law or regulation.

Each company can adopt its standard of behaviour, as a rule.

Some activities require specific protocols for the prevention of money laundering and combating the financing of terrorism:

• the capture, intermediation, and investment of financial resources from third parties in national or foreign currency;

• the purchase and sale of foreign currency or gold as a financial asset or exchange instrument; and

• the custody, issuance, distribution, settlement, negotiation, intermediation, or securities administration.

Within the scope of the system for preventing and combating money laundering and the financing of terrorism, it is up to institutions and their employees to adequately comply with Central Bank regulations; promote the effectiveness of the apparatus to combat and prevent money laundering; carry out risk management with the implementation of effective policies, procedures, and controls; and help the Brazilian state to locate which financial operations are suspicious so that they can be investigated.

In principle, the relationship between companies and employees in the financial services sector is private. As such, companies do not have to communicate confidential information about their employees to third parties, as this would constitute an infringement of their fundamental freedoms. However, in certain cases, employers must alert the competent authorities in the event of behaviour or "suspicions" of behaviour by one of their employees that is contrary to the law.

Thus, the Monetary and Financial Code provides that companies in the financial services sector, referred to in article L.561-2 of the code (the list of which was updated by Ordinance no. 2023-1139 of December 6, 2023 on credit managers and credit buyers to include "Credit managers"), must report to the national financial intelligence unit (Tracfin) all sums or transactions that they suspect to be the result of an offence punishable by a prison sentence of more than one year, or related to the financing of terrorism or tax evasion. This declaration may be made in respect of any employee of one of these companies.

In addition, when facts likely to constitute violations of the anticorruption code of conduct or to qualify as corruption or influence peddling are brought to the attention of the company and its managers, an internal investigation must be conducted (article 17 of Law No. 2016-1691 of 9 December 2016 on transparency). If the investigation confirms the suspicions, the employer must, on the one hand, sanction the employee, but also inform the prosecuting authority of the facts.

In smaller companies, the employer will also be able to report to the prosecution authorities any behaviour that could lead to criminal sanctions.

Yes. Under section 87 WpHG, investment firms must notify BaFin of any changes regarding employees providing investment advice, sales representation, and compliance advice. This includes, for example, personal data or a change of the responsible sales representative, but also the termination of the activity. Changes must be communicated to BaFin within one month.

Further, investment firms must notify BaFin as soon as a substantial customer complaint is made against one or more employees based on his or her activities in connection with investment advice. This applies, for example, to allegations of incorrect investment advice. The notification to BaFin must be submitted within six weeks of receipt of the complaint. Details on the content of the notification are governed by section 8 paragraph 4 of the Securities Trading Act Employee Notification Ordinance.

There are further notification obligations if there are doubts about an employee‘s reliability under the relevant statutory rules. For example, in their initial declaration of reliability under section 24 paragraph 1 No. 1 KWG and section 5b Ordinance on Notifications and Submission of Documents under the KWG, future managing directors and persons acting as sole representatives of credit institutions and financial services institutions must immediately report to BaFin in writing any subsequent changes that may be relevant to their reliability. This applies to all facts that were also relevant for the initial reliability assessment (eg, because an employee was convicted of certain financial crimes). In addition, BaFin must also receive notifications of preliminary proceedings, indictments and convictions of certain financial sector employees according to the Order on Notifications in Criminal Matters.

SFC – Self-reporting obligation

An SFC-licensed intermediary is subject to the self-reporting obligation under paragraph 12.5 of the “Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission”. A licensed or registered person should report to the SFC immediately upon the occurrence of any material breach, infringement or non-compliance with any laws, rules regulations, and codes administered or issued by the SFC, exchange or clearing house of which it is a member or participant of, and the requirement of any regulatory authority applicable to that intermediary. This encompasses both actual and suspected breaches, infringements or non-compliance. In the report, the particulars of the actual or suspected breach, infringement or non-compliance, and relevant information and documents must be included to fulfil the obligation.

The same is to be reported by the registered institutions to the HKMA. The HKMA also requires authorised institutions to submit an incident report on the same day of discovering the incident.

SFC - Internal investigation disclosure obligation

In addition, a licensed corporation is required to provide the SFC with information about whether a licensed individual who ceases to be accredited to it (outgoing employee) was under any investigation commenced by the licensed corporation within six months preceding his or her cessation of accreditation. If the internal investigation commences after the notification of cessation of accreditation, the licensed corporation should also notify the SFC as soon as practicable. In addition, even if a firm has completed its investigation and made no negative findings against an outgoing employee, the firm will still be required to notify the SFC of the investigation.

The SFC expects licensed corporations to proactively disclose information about all investigative actions and the following is a non-exhaustive list of examples of investigations involving an outgoing employee that a licensed corporation should disclose to the SFC:

• investigations about a suspected breach or breach of applicable laws, rules and regulations;
• investigations about a suspected breach or breach of the licensed corporation's internal policies or procedures;
• investigations about misconduct that are likely to give rise to concerns about the fitness and properness of the outgoing employee;
• investigations about any matter that may have an adverse market or client impact; and
• investigations about any matter potentially involving fraud, dishonesty and misfeasance.

HKMA – Reporting incidents to HKMA

According to the “Incident Response and Management Procedures” published by the HKMA, once an authorised institution has become aware that a significant incident has occurred, the authorised institution concerned should notify the HKMA immediately and provide it with whatever information is available at the time. An authorised institution should not wait until it has rectified the problem before reporting the incident to the HKMA.

According to the Supervisory Policy Manual SB-1 “Supervision of Regulated Activities of SFC-Registered Authorized Institutions”, to be in line with the reporting requirements imposed by the SFC on licensed representatives, authorised institutions will be required to notify the HKMA in writing within seven business days upon knowledge of the occurrence of certain information (including any subsequent changes) of the relevant individuals. The required information is on whether or not the person is or has been:

• convicted of or charged with any criminal offence (other than a minor offence) in Hong Kong or elsewhere;
• subject to any disciplinary action, or investigation by a regulatory body or criminal investigatory body (as the case may be) in Hong Kong or elsewhere;
• subject to, or involved in the management of a corporation or business that has been or is subject to, any investigation by a criminal investigatory body or any regulatory body in Hong Kong or elsewhere concerning offences involving fraud or dishonesty;
• engaged in any judicial or other proceedings, whether in Hong Kong or elsewhere, that is material or relevant to the fitness and propriety of the individual; or
• bankrupt or aware of the existence of any matters that might render him insolvent or lead to the appointment of a receiver of his property under the Bankruptcy Ordinance.

HKMA – Guidance Note on Cooperation with HKMA Investigations

Under the “Guidance Note on Cooperation with the HKMA in Investigations and Enforcement Proceedings”, the HKMA encourages and recognises the cooperation of authorised institutions, banks and their staff in investigations and enforcement proceedings. Under this Guidance Note, cooperation includes early and voluntary reporting of any suspected breach or misconduct, taking a proactive approach to assist the HKMA’s investigation, and making timely arrangements to provide evidence and information.

IA – Self-reporting obligation

Under “the Code of Conduct for Licensed Insurance Agents/Brokers”, there is a self-reporting obligation by licensed insurance agencies or brokerages to the IA. A licensed insurance agency or brokerage is required to have proper controls and procedures to ensure the following incidents are reported to the IA as soon as is reasonably practicable:

• a disciplinary action taken by the HKMA, the SFC or the Mandatory Provident Fund Schemes Authority;
• a criminal conviction (other than a minor offence) by any court in Hong Kong or elsewhere;
• any material breaches of requirements under the IO or any rules, regulations, codes or guidelines administered or issued by the IA; and
• any material incidents which happen to the agency or brokerage.

The RBI requires banks to conduct an annual review of fraud committed and provide a note of the total number to the board of directors or the local advisory board. These reports are not to be sent to the RBI but are to be preserved for verification by the RBI’s inspecting officers[1]. Necessary disclosures may also need to be made to SEBI under some of its regulations.

Publicly listed financial services companies may be required to make necessary disclosures, including to the stock exchanges and their auditors, in case of workplace fraud.

The CBI expects RFSPs to be open and transparent in their engagement, including concerning compliance with the F&P Standards and the Common Conduct Standards. While early versions of the IAF regulations and related guidance contained an obligation on a RFSP to report to the CBI if disciplinary action had been taken against an individual, the obligation was removed from the latest version of the draft legislation. The Guidance indicated that the CBI would expect that they would have already received relevant details as it provides that firms and persons performing PCF roles are required to report to the CBI where they suspect that a "prescribed contravention" may have occurred for the purposes of the CBI legislative framework and the CBI states that a breach of the Common Conduct Standards and/or Additional Conduct Standards is a "prescribed contravention" for these purposes.

Yes, please see question 9.

Financial institutions in the Isle of Man are required to comply with various statutory requirements. Breaches of those statutory requirements impose an obligation on the relevant entity to self-report to the IoM FSA. While ordinarily, businesses will endeavour not to supply information about individuals within the business to the regulator as part of this reporting, from time to time this may be necessary to comply with their regulatory obligations. Where this is the case, usually the regulator will be asked to use their powers of compulsion to seek the information rather than such information being given voluntarily. This is particularly the case where the regulator may have formed concerns about an individual’s fitness and propriety and wishes to investigate this further.

Regulators from other jurisdictions may use certain reciprocal agreements and reciprocal enforcement legislation to seek information from the IoM FSA or more directly from a financial services business. Where such requests are made, this may include information about individual employees (ordinarily those exercising Controlled Functions). However, any mechanism for reciprocal enforcement or exchange of information is subject to scrutiny and such information would normally only be offered by an employer under compulsion.

Pursuant to the Federal Law for the Prevention and Identity of Transactions with Illegally Obtained Resources, all acts carried out by financial entities are considered a vulnerable activity; therefore, financial entities must:

• set forth measures and procedures to prevent and detect acts and operations;
• file reports to the SHCP regarding acts, operations and services carried out by clients and employees if they suspect illegal resources are involved; and
• keep for at least 10 years any information and documents related to the identification of clients and users.

Given the above, if any action, operation or service is identified as undertaken with illegal resources or there is a breach of any of the provisions outlined in the above law, employers must inform the SHCP and prosecutor.

Also, if officers and general managers no longer comply with the legal requirements to occupy their positions (eg, not having a satisfactory credit record, or no longer being in good standing), financial entities may inform the CNBV or CNSF, as applicable, so the authorities may disqualify or remove those individuals from their positions.

Furthermore, if there is a breach of the code of conduct, the regulatory comptroller must inform the board of directors and keep such information available to the CNBV at all times. The board of directors will be in charge of establishing disciplinary measures.

Finally, if employees breach psychological risk prevention obligations (see question 11), employers must inform the labour authorities to impose corresponding sanctions.

Financial services companies must report to local regulators any behaviour or event that poses a serious threat to the ethical conduct of the business of the company or may affect the reliability of policymakers, sound and controlled business operations and continuity.

Furthermore, there are several local disciplinary authorities where reports can be made about financial services employees who fail to comply with Dutch law, guidelines and rules of conduct.

Forms need to be submitted to the MAS when an individual ceases to act as a representative in regulated activities or financial advisory services. Depending on the FI, the MAS may also have to be informed of appointments or changes of representatives, directors, chief executive officers, and other key officeholders (see questions 2 and 4).

MAS notices are also required for the reporting of misconduct for employees who are representatives of certain capital market service providers, financial advisers, and insurance broking staff. Examples of reportable misconduct include acts involving fraud, dishonesty or other offences of a similar nature, and non-compliance with regulatory requirements. Specific declaration forms and timelines may apply depending on the FI. An FI may also be required to submit updates on cases where investigations have not concluded or disciplinary action was not taken, or submit a declaration that there was no misconduct reported in a given calendar year.  

While not specific to financial services employees, the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 requires any person with knowledge, or reasonable grounds to suspect, that any property is being used in connection with criminal activity to file a Suspicious Transaction Report with the Suspicious Transaction Reporting Office. MAS notices concerning the prevention of anti-money laundering and incidents of fraud emphasise this obligation.

As a general principle, supervised companies are required to ensure that persons holding, in particular, executive, overall management, oversight or control functions fulfil the requirements of the “fit and proper” test. Consequently, such persons must be of good repute and can guarantee compliance with applicable laws and regulations.

If a person cannot guarantee that the regulatory requirements are fulfilled at all times (eg, because of a material breach of its duties) the employing entity and its audit companies may be required to immediately report to FINMA, respectively, any incident that is of significance.

Both the DFSA General Rulebook and FSRA General Rulebook provide that where an authorised firm requests the withdrawal of an authorised individual, they must provide to the regulator details of any circumstances in which they consider the individual is no longer fit and proper.  Where the individual is to be dismissed or has requested to resign, the firm must provide to the regulator a statement of the reason, or reasons, for the dismissal or resignation.

In addition, the DFSA and FSRA General Rulebooks contain broad obligations on any authorised firm to report to the regulator if it becomes aware of a range of occurrences, including any matter which could have a significant adverse effect on the authorised firm’s reputation, or a matter in relation the authorised firm which could result in serious adverse financial consequences to the financial system or to other firms, or a significant breach of a rule by the authorised firm or its employees.

Yes. There are multiple potential reporting obligations with various timing imperatives. We include below a snapshot of some of the key obligations:

• under FCA Principle 11, firms have a general duty to inform the FCA of matters about which it would reasonably expect notice;
• a firm must notify the FCA immediately it becomes aware, or has information which reasonably suggests, that a matter which could have a significant adverse impact on the firm’s reputation has occurred, may have occurred or may occur in the foreseeable future;
• a firm must notify the FCA immediately it becomes aware, or has information which reasonably suggests, that a significant breach of a rule (including a significant breach of a Conduct Rule) has occurred, may have occurred or may occur in the foreseeable future; and
• a firm must also notify the FCA if it takes disciplinary action against an individual for a breach of the Conduct Rules. Where the relevant individual is a senior manager, the notification must be made within seven business days. Where the relevant individual is certified staff, the notification must be made in the firm’s annual reporting.

FINRA members must report to FINRA within 30 calendar days after the firm has concluded, or reasonably should have concluded, that an associated person of the firm or the firm itself has violated any securities, insurance, commodities, financial or investment-related laws, rules, regulations or standards of conduct of any domestic or foreign regulatory body or self-regulatory organisation.

While there is no requirement to report misconduct to regulators, the SEC routinely gives credit to organisations that voluntarily choose to self-report, which can lead to reduced fines, non-prosecution agreements, deferred prosecution agreements, waivers of disqualification following regulatory or criminal actions, or more organisation-friendly language in settlement documents. However, such disclosed information may later be discoverable by private plaintiffs.

The SEC has issued guidance that a failure to self-report significant misconduct can lead to more severe penalties.