The new mandatory reference checking scheme
Financial regulators around the world have been implementing regimes to mitigate a phenomenon sometimes described as the problem of “rolling bad apples” (“RBA”): bank employees who engage in serial misconduct, moving from institution to institution without disclosing past misconduct to their new employers.
In Hong Kong, the Hong Kong Monetary Authority (“HKMA”) issued a Consultation Paper in May 2020 proposing the implementation of a mandatory reference checking (“MRC”) scheme that would apply to authorised institutions (“AIs”), with a view to combatting the RBA phenomenon. The HKMA published conclusions on the Consultation on 3 May 2021 (the “Consultation Conclusions”), with the objective of introducing the new MRC regime by November 2021.
Summary of the MRC scheme
The Consultation Conclusions reiterates the importance of an industry-led approach in taking the MRC scheme forward. With this objective in mind, the Hong Kong Association of Banks (“HKAB”) has established an industry working group (“IWG”) tasked with developing and finalising the operational details of the MRC scheme by November 2021.
Two phases
Pursuant to the Consultation Conclusions, the scheme will be implemented in two phases:
- Phase 1: This will cover more senior employees, such as directors, chief executives and executive officers.
- Phase 2: The HKMA originally proposed the inclusion of a relatively wide scope of personnel in Phase 2, including client-facing staff. But in response to comments from market players, the HKMA has refined the scope of Phase 2 to include only staff licensed or registered to carry out regulated activities under the Securities and Futures Ordinance, Insurance Ordinance or Mandatory Provident Fund Scheme Ordinance.
Scope of MRC information
The in-scope MRC information covers (i) breach of certain legal or regulatory requirements, (ii) incidents related to honesty, integrity or matters of similar nature, (iii) misconduct reports filed with the HKMA, (iv) internal or external disciplinary actions arising from conduct issues, and (v) any other information relevant to assessing whether individuals are fit and proper.
The IWG will develop practical guidance on what constitutes reportable information. The HKMA considers that only information which is material or serious in nature should be reportable. However, given AIs have different scales of business, the HKMA considers it inappropriate to set an industry-wide quantitative materiality threshold.
Duration of MRC information
The HKMA agreed that the retention period for employment records can be reduced from 10 years (as proposed in the Consultation) to 7 years, subject to further discussion by the IWG.
Obligations of recruiting AIs
Before initiating a reference check, recruiting AIs must obtain informed consent from prospective employees to ensure compliance with the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (“PDPO”). The HKMA recommended the IWG to develop an industry standard template to be used by AIs to obtain such consent.
The HKMA stated in the Consultation Conclusions that whilst it is possible for the recruiting AIs to make a conditional offer or obtain a self-declaration that the employee has not been involved in any misconduct, pending completion of the MRC process, AIs are strongly encouraged to complete the MRC process before on-boarding any prospective employee.
The HKMA stated in the Consultation Conclusions that AIs learning of negative MRC information in respect of senior appointments requiring regulatory approval are generally free to rescind the employment offer or to proceed with the employment, but should in the latter case, as a matter of best practice, document the justifications for the appointment and take appropriate mitigating measures.
Obligations of reference providing AIs
In the Consultation Conclusions, the response time of 10 working days for MRC requests is lengthened to one month from the date of the MRC request. The IWG is encouraged to further refine the response time and to set up a contact list across different banks to facilitate efficient information exchange.
The Consultation Conclusions further explains the approach expected of reference providing AIs when circumstances render them unable to observe the specified response time. For example, an interim reply should be provided by the reference providing AIs within the specified response time, explaining the difficulties that the AI is encountering and the estimated response time. The HKMA will follow up with AIs which repeatedly fail to respond to MRC requests on time.
The HKMA also encouraged the IWG to develop an industry standard MRC response template to enable the banks to understand more about the level of detail that is expected.
Practical implications
Data protection
In order to prepare for the launch of the MRC scheme, AIs will need to put in place new systems and policies. From a data protection compliance perspective, AIs are recommended to consider the following issues:
- Employees must be informed of the types of data (including MRC information regarding employees’ conduct) that will be collected, the classes of transferees (including recruiting AIs in response to MRC requests), and the purposes of the collection. This information can be provided in the form of a personal information collection statement;
- For existing employees, unless the disclosure envisaged under the MRC regime is within scope of an existing notification or consent, reference providing AIs must ensure employees provide consent before their MRC information is released to recruiting AIs. Note that the Privacy Commissioner for Personal Data, Hong Kong (“PCPD”) has emphasised that this consent only covers the purposes of conducting MRC. Any further use of the data for a purpose not directly related to MRC would be considered as a new purpose and requires prescribed consent;
- There should be an internal written policy that specifies the retention period of employment related data of no longer than seven years from the departure of the employee, unless the employee has given prescribed consent or due reasons relating to the MRC scheme, a longer retention period is required. It is therefore likely that existing retention policies will need to be updated;
- The policies in place for responding to data correction requests should be updated to ensure they cover requests to correct personal data which arises from the MRC scheme. For example, the PCPD has explained that the proposal of AIs providing a prospective employee with an opportunity to be heard in case there is any negative MRC information is in line the employees’ right to request correction of personal data under the PDPO.
Employment
Furthermore, from an employment perspective, where a recruiting AI decides to proceed with the hiring process of a prospective employee prior to the MRC process being completed, in order to avoid any dispute with the employee, recruiting AIs are recommended to ensure they include a provision in the offer letter to make clear that the offer is subject to the recruiting AI not obtaining negative MRC information. AIs are also recommended to review their employment records policies to ensure they are able to provide the relevant information in response to MRC requests which they will receive after the launch of the MRC scheme.
Pursuant to the Conclusions, ongoing investigations with allegations that are of serious nature and those which are about to conclude with disciplinary actions should be included as MRC information. The IWG is tasked with preparing further guidance on the types of ongoing investigations that should be included in the MRC scheme and relevant exemptions. In fact, the Securities and Futures Commission (“SFC”) has revamped its licensing forms in 2019. One of the changes was aimed at combating the RBA phenomenon – Form 5 (now known as Form 5U) was amended so that details of whether the employee was under any internal investigation in the six months prior to termination is required to be disclosed, and where an internal investigation which involves the employee commences after submission of the initial notification, the SFC must be informed. The SFC has published a list of examples of investigations which are required to be disclosed, such as investigations about (i) suspected breach or breach of applicable laws, rules and regulations; (ii) suspected breach or breach of the employer’s internal policies or procedures; (iii) misconduct that are likely to give rise to concerns about the fitness and properness of the departing employee; (iv) any matter that may have an adverse market or client impact; and (v) any matter potentially involving fraud, dishonesty and misfeasance. It is expected that the IWG will refer to the examples published by the SFC when preparing the guidance.
Limiting liability and litigation risk
AIs should implement internal policies, guidelines and procedures to safeguard the integrity and confidentiality of information obtained and processed during the MRC process. For example, the internal policies should clearly outline the process and personnel involved in a MRC process, and adequate security measures should be put in place to prevent unauthorised access to MRC data.
For reference providing AIs, the disclosure of information concerning a departing or ex-employee in particular as regards ongoing internal investigations that are not concluded may potentially attract civil liability and litigation risk. For example, a negative reference which includes an unsubstantiated statement that is later found to be incorrect or contained false information may potentially give rise to claims for negligence misstatement or defamation. When providing references, AIs are recommended to:
- Ensure only facts and accurate information capable of substantiation are included and disclosed to recruiting AIs.
- Ensure the information disclosed is not biased and does not contain personal opinion or comments. Where explanation from both sides are available, ensure they are both included to give a fair view.
- Where the authenticity of information collected cannot be verified (for example hearsay from another employee), exercise judgment as to whether the information should be included, and where included, make sure the source is clearly explained.
- Keep a record of all the supporting documents.
- Implement an internal policy or system to keep track of the progress of the investigations.
- Include a disclaimer as part of the reference template to expressly note that any information disclosed is true and accurate to the best knowledge of the reference providing AI at the time of provision, and no reliance may be placed on such information by the recruiting AI in the making of any recruitment decision.
Central registry
The HKMA has indicated that if there is industry-wide support, the IWG could conduct a feasibility study to explore the potential of using a API-based central register for the MRC scheme, especially given the wide scope of personnel involved in Phase 2. It is clear that such a centralized scheme could generate operational efficiencies for AIs, but work would need to be done to develop consistent reporting data and report formats, procedures to deal with out-of-date and inconsistent information and mechanisms to deal with other data protection compliance matters.
Timing
As mentioned above, it is expected the IWG will finalise the operational details of the MRC scheme by November 2021.
To allow AIs more time to make improvements to their systems and policies, a review of Phase 1 will be conducted two years after the implementation of Phase 1, rather than after one year, as originally proposed in the Consultation. The HKMA suggested a consultation on Phase 2 implementation to be conducted in conjunction with the Phase 1 review.
Authored by Mark Parsons, Mark Lin, Katherine Tsang and Yolanda Lau.
