SFC Bans Ping An Former CEO for 1 Year over Internal Control Failures

The Hong Kong Securities and Futures Commission (SFC) has banned the former chief executive officer of Ping An of China Securities (Hong Kong) Company Limited (Ping An), Mr. He Zhi Hua (He), for twelve months for serious deficiencies in the company’s internal controls.

An SFC investigation found that He had been complicit in a series of suspicious transactions conducted by clients at Ping An. Notwithstanding a number of apparent red flags, there was a 4-month delay in these transactions being reported to the SFC and the Joint Financial Intelligence Unit in breach of the requirement for timely reporting under the Organised and Serious Crimes Ordinance (OSCO). Ping An’s internal control failures in the period from 1 August 2010 to 30 April 2011 (the Relevant Period), were attributed to He. In particular, He failed to ensure that:

• Ping An had sufficient anti-money laundering (AML) internal control procedures in place;

• adequate training was provided to Ping An staff in relation to AML;

• appropriate and effective procedures existed to protect client assets in effecting payments; and

• Ping An’s internal policies on employee dealings and account opening procedures were properly communicated and enforced.

The SFC’s investigation of Ping An in relation to the same matter led to the company being reprimanded and fined HK$6 million in July 2014.

Ping An Internal Control Failures

The SFC’s investigation revealed the following failures on the part of Ping An:

• lack of AML internal control procedures;

• failure to identify and report suspicious dealings to the SFC and the Joint Financial Intelligence Unit (JFIU) in a timely manner;

• failure to provide AML training to its staff;

• lack of internal procedures to protect client assets in effecting payments;

• ineffective implementation of internal policies on employee dealings;

• failure to enforce its account opening procedures in relation to address proofs; and

• lack of an effective compliance function.

Breaches by He

He occupied the most senior position at Ping An and had authority to manage the company’s business during the Relevant Period. Despite his decision-making role, however, the SFC’s news release of 23 February 2015 notes that He, “tried to abdicate responsibility and offload blame to subordinates when [these] deficiencies were uncovered” and that the resulting conflict between He and his subordinates exacerbated Ping An’s internal control deficiencies. The SFC found that He’s conduct fell short of the standard required of him as chief executive officer and a director of Ping An and that he either did not understand what was required of him in that capacity or “blatantly disregarded” such requirements. It thus concluded that He bore responsibility for Ping An’s internal control failures as he failed to ensure the maintenance of appropriate standards of conduct and adherence to proper procedures.

The SFC’s Statement of Disciplinary Action¹, identified the following failures of Ping An:

1. Lack of Hong Kong Anti-Money Laundering Internal Control Procedures

   The SFC noted that as CEO and a director of Ping An, He had acted as a nominee in a number of suspicious transactions carried out by clients of Ping An in October and November 2010. Ping An failed to actively identify and report these suspicious transactions to the SFC and the JIFUA in a timely manner as is required under Section 25A of the OSCO. That section requires a person who suspects that any property represents the proceeds of, or was used in connection with, or is intended to be used in connection with an indictable offence, to disclose that suspicion to an authorised officer “as soon as it is reasonable for him to do so”. Despite a number of apparent red-flags, these transactions were not identified and followed-up and resulted in a 4-month delay in the suspicious transactions being reported.

   Ping An also lacked properly formulated internal AML policies and failed to provide AML training to its staff during the Relevant Period.

   Ping An’s failures breached paragraphs 4.2, 9, 10 and 11 of the Prevention of Money Laundering and Terrorist Financing Guidance Note which was in force at the time. They also breached paragraph 5.4, General Principle (GP) 2, GP3 and GP7 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct).

2. Hong Kong Requirements for Handling Client Assets

   The SFC found that Ping An’s manner of handling client assets and its lack of policy and controls in relation to third party payments breached the following provisions:

   • Sections 5(1)(b) and 5(3) of the Securities and Futures (Client Money) Rules;

   • Paragraphs 2 and 3 of The Suggested Control Techniques and Procedures for Enhancing a Firm’s Ability to Comply with the Securities and Futures (Client Securities) Rules and the Securities and Futures (Client Money) Rules; and

   • Paragraph 9 under Part VII of the Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission (Internal Control Guidelines) and paragraph 12.2, GP2, GP6 and GP7 of the Code of Conduct.

   37 third party payments were made in the Relevant Period without Ping An making any assessment on the reasons for making such payments. In 23 of these transactions, Ping An also failed to obtain identity proof of the payment recipients. In some cases, Pin An effected third party payments without having received proper written directions from the relevant client and this had been condoned by He. The company once even effected a third party payment from a client’s account to an employee of Ping An, who happened to be the client’s daughter.

   He approved a number of third party payments without ensuring that proper written directions were received from relevant clients as follows:

• clients’ signatures were obtained only after the relevant third party payments were made (which payments were nevertheless approved by He and processed despite the lack of clients’ signatures);

• third party payment instruction forms were signed by another client (which forms were confirmed by He);

• a client’s third party payment instruction form was signed by a Ping An staff member (which form was again approved by He and payment processed);

• a client’s signature was incomplete and on an incorrect instruction form; and

• a client’s signature on a third party payment instruction forms did not match with account opening documents (but the payment was nonetheless processed).

3. Failure to Implement Hong Kong Employee Dealings Requirements

   The SFC found that Ping An did not properly implement its staff dealing policies designed to minimise conflicts of interests. 2 of the 15 employees who joined Ping An during and prior to the Relevant Period did not submit their employee declaration forms until 12 and 19 after joining the firm. These failures constituted breach of paragraphs 2 and 3 of Part III of the Internal Control Guidelines and paragraphs 12.2, GP2, GP6 and GP7 of the Code of Conduct.

   The SFC noted that the staff dealing policy of the firm lacked clarity, and was neither communicated to its employees nor enforced. As mentioned above, Ping An did not provide sufficient staff training to ensure their awareness of conflicts of interests and compliance requirements.

4. Hong Kong Client Account Opening Procedures

   Despite a set of account opening procedures being in place, Ping An did not follow these procedures strictly. During the Relevant Period, 117 accounts were created and activated without the approval of a responsible officer and 15 were opened without valid address proof. Ping An was found to have breached paragraph 1 of Part VII of the Internal Control Guidelines, and paragraph 5.4 and GP2 and GP7 of the Code of Conduct.

5. Compliance Function

   Ping An did not have an independent designated compliance officer during the Relevant Period. The company’s failure to have an effective compliance function breached Part V of the Internal Control Guidelines and paragraph 12.1, GP2, GP3 and GP7 of the Code of Conduct.

Disciplinary Action

The SFC found He had breached paragraph 4.2, GP2 and GP9 of the Code of Conduct and suspended him for 12 months from seeking approval to conduct any regulated activity for an SFC licensed intermediary.

Ping An has since removed He from his position.