Expired Standing Authority

As required by the Client Securities Rules ("CSR") under the SFO, a broker firm is only allowed to repledge its clients' securities collateral to banks if it has obtained their valid standing authority (but exemption is applicable to professional investors).  The CSR also requires annual renewal of the standing authority, where the broker firm must send a renewal notice to clients 14 days prior to the expiry date.  Negative consent is allowed (i.e. if a client doesn't object, the standing authority is automatically renewed for another 12 months).

Yesterday SFC reprimanded China Everbright Securities (HK) Limited ("CESHK") and fined it $2.5 million for pledging its clients’ securities with banks for financial accommodation without valid authorization.

Between 1 April 2018 and 19 August 2018, CESHK relied on expired standing authority given by around 6,841 clients to pledge their securities as collateral in obtaining credit line from three banks in Hong Kong.  The standing authority in question had expired on 31 March 2018.

Details of the incident leading to the breach:

• Starting from late 2017, China Everbright Securities International Group (of which CESHK is a member) and Everbright Sun Hung Kai Group (EBSHK Group) were going through an amalgamation.
• In late February 2018, the Compliance Department of the EBSHK Group (EBSHK Compliance) was instructed to take over CESHK’s compliance function.
• At CESHK, the standing authority renewal exercise was handled by its compliance team in or around March every year.  At EBSHK, the same process was handled by its operations team in or around August every year.
• It was not highlighted to EBSHK Compliance that the standing authority of CESHK’s clients should be handled by the compliance team.
• In mid-August 2018, when EBSHK Group began the process of renewing the standing authority of its clients, it discovered that CESHK had not delivered standing authority renewal notices to its clients at least 14 days before 31 March 2018 in respect of standing authority that had expired on 31 March 2018 pursuant to section 4(3) of the CSR.
• On 20 August 2018, CESHK made a self-report to SFC regarding its failure to renew its clients’ standing authority which expired on 31 March 2018.

It appears that this incident was caused by internal miscommunication, i.e. CESHK wrongly believed that the standing authority renewal exercise would be handled by EBSHK Compliance.  But in my opinion, it is not appropriate for the compliance team to take over such operational duties.  I reproduce below the following paragraph from SFC's Internal Control Guidelines:

Management ensures that, where practicable, policy formulation, supervisory and other internal review or advisory functions, including where applicable compliance and internal audit, are effectively segregated from line operational duties. Such segregation serves to ensure the effectiveness of supervisory and other internal controls established by Management.