A new era of smart banking in Hong Kong is anticipated to begin at the end of this year. In September 2017, one of the policy initiatives announced by the HKMA (Hong Kong Monetary Authority) relates to the facilitation of the establishment of virtual banks in Hong Kong. After completion of the public consultation in February 2018, the HKMA unveiled the long-awaited revised “Guideline on Authorisation of Virtual Banks” (“Guideline”) on 30 May 2018. The development of virtual banks in Hong Kong is intended to upgrade the banking system, to promote fintech (financial technology), innovation and financial inclusion, and to offer a new kind of customer experience.
What is a virtual bank?
A “virtual bank” is defined as a company which delivers banking services primarily, if not entirely, through the Internet or other electronic delivery channels. It does not refer to a licensed bank which makes use of the Internet or other electronic means as an alternative channel to deliver its products or services to customers.
Under the Banking Ordinance (Cap. 155) (“Ordinance”), only authorised institutions are legally permitted to carry on banking business or the business of taking deposits in Hong Kong. An authorised institution is either in the form of a licensed bank, a restricted licence bank or a deposit-taking company. A licensed virtual bank will become the fourth type of authorised deposit-taking institution in Hong Kong.
The HKMA clarified in the Guideline that both financial firms (including existing licensed banks) and non-financial firms (including technology companies) are welcome to apply for a virtual bank licence. Applicants should meet the same minimum criteria for authorisation under the Seventh Schedule to the Ordinance to which all traditional licensed banks are subject to.
Key criteria for authorisation of virtual banks
1. Capital Requirement
Virtual banks must maintain minimum levels of share capital of HKD 300 million (USD 38.2 million).
2. Physical Presence
Applicants must have a physical presence in Hong Kong to provide customer services such as handling complaints and enquiries, and to verify the identity of customers.
3. Business Plan
Applicants must provide a credible business plan for profitability in the medium term without imposing any minimum account balance requirements or low-balance fees on customers. The business model should promote financial inclusion and bring value to Hong Kong-based customers.
4. Exit Plan
Should it become necessary, virtual banks should be able to unwind the business operations without causing any disruption to the customers and the financial system.
5. Information Technology (“IT”) Security
The security controls should be ‘fit for purpose’. Regular assessment on IT systems, hardware, software and procedures and controls should be performed.
6. Risk Management
Applicants should analyse the eight types of risk identified in the risk-based supervisory framework of the HKMA (that being credit, interest rate, market, liquidity, operational, reputation, legal and strategic risk).
7. Customer Protection
Customer terms and conditions must describe the respective rights and obligations between the virtual bank and its customers. They should be fair and balanced to both the virtual bank and its customers. Customers should be made aware of how losses from security breaches, system failure or human error will be apportioned between the virtual bank and its customers.
8. Ongoing Supervision
Virtual banks are subject to the same set of supervisory requirements applicable to conventional banks. Some adaptations are used to fit virtual banks’ technology-driven business model. For example, the board of directors and senior management of virtual banks should have the requisite knowledge and experience to enable them to discharge their duties effectively.
9. Ownership & Capital Requirement
Virtual banks are required to operate in the form of a locally incorporated bank for engaging in significant retail businesses.
Both financial companies (including existing banks) and non-financial companies (including technology companies) can apply for a virtual bank licence.
The applicant can either:
- be majority-owned by a bank or financial institution in good standing and supervised by a recognised authority; or
- be held by a holding company incorporated in Hong Kong subject to the risk-based supervisory conditions mentioned in 6.
Material outsourcing should be approved by the HKMA and it must be in compliance with the principles in the HKMA’s Supervisory Policy Manual module on Outsourcing.
Applicants should ensure:
- the operations outsourced remain subject to adequate security controls;
- that the confidentiality and integrity of customers will not be compromised;
- that the requirements under the Personal Data (Privacy) Ordinance and common law customer confidentiality are complied with; and
- that powers and duties of the HKMA under the Ordinance will not be hindered by the outsourcing arrangements.
Virtual bank licensing in Singapore
Over the past couple of years, Hong Kong and Singapore have been competing for supremacy as Asia’s FinTech hub. The MAS (Monetary Authority of Singapore) has launched a number of initiatives to foster a thriving FinTech ecosystem, such as creating a regulatory sandbox in 2016 to facilitate experimentation of new innovative financial products or services in a relaxed regulatory environment. Nevertheless, for non-financial firms such as technology companies to operate as a bank in Singapore, they must have a Singapore-incorporated bank to allow them to operate as a joint-venture partner subsidiary.
In Hong Kong, for a non-bank company (such as a technology company) to operate as a virtual bank, it can be held through a holding company incorporated in Hong Kong subject to supervisory conditions such as capital adequacy, liquidity, risk management, etc. The less restrictive criterion allows technology companies to operate as a virtual bank using their own technical infrastructures without integration with more fragmented systems of conventional banks. The costs saved on integration can be invested in the core business such as financial products and services diversifications; in the enhancement of customer experiences such as simplifying mobile applications or advancing cybersecurity measures.
Although the structure of a virtual bank in Singapore is different from that in Hong Kong, the regulators in both cities emphasise that it is particularly important to the potentially high risk business to have the backing of a strong parent to provide financial, managerial and technological support. Non-bank companies who are planning to operate as a virtual bank should take this into consideration during the early stages of formalising their business plan.
Irrespective of the competition between Hong Kong and Singapore, the HKMA proactively seeks cross-border collaborations with Singapore in the development of FinTech, which will be discussed in the last section of this paper.
The convergence of banking and innovative technology brings a new risk profile to virtual banks. Firstly, with the adaptation of open APIs (application programming interfaces) and partnerships with third parties, for example, hosting systems on a virtual private cloud, virtual banks will encounter privacy data issues when handling customers’ personal data imposed by the Personal Data (Privacy) Ordinance. In addition, the use of cloud technology outside Hong Kong may trigger cross border data transfers. Virtual banks are recommended not to transfer any customers’ personal data outside of Hong Kong without customers’ consent.
Secondly, an increased vulnerability to cyber-attacks and cyber-crimes may arise from the engagement of third parties. It will be a fatal attack to the reputation of a virtual bank if a cyber-attack successfully disrupts its services, causes loss of customer data and system outages. Virtual banks are recommended to ensure a high level of IT system and network availability, to perform regular IT system assessment and to ensure business continuity.
Collaboration With Other FinTech Centres
With respect to the new risks identified, a new approach to risk management should be adopted. Closer cross-border collaboration with FinTech centres in Asia is the first step to foster the healthy development of FinTech in Hong Kong. On 25 October 2017, the HKMA and the MAS signed a co-operation agreement relating to referrals of innovative business, collaboration on innovative projects, information and expertise exchange. On 15 November 2017, the two authorities signed a Memorandum of Understanding to jointly develop a cross-border infrastructure based on distributed ledger technology to digitalise and share trade documents between two cities to reduce fraud and increase efficiency.
Given the rapid development of technology and innovation, FinTech has been changing the business landscape significantly. It is foreseeable that the network of cross-border collaborations with FinTech centres will be expanded in the region and globally. Cross-border collaborations may extend to multiple jurisdictions which could potentially not follow the English common law system in some countries such as China. As a result, the legal basis for liability will vary across different jurisdictions. To avoid uncertainty, one possible solution is to agree on a choice of jurisdiction with an arbitration clause. Using the respective jurisdictional regulatory sandbox to facilitate experimentation of various scenarios in a controlled and safe environment can provide references to which cases have no precedent. Besides, regular conversation with startups, lawyers, banks and relevant stakeholders can also help regulators to understand challenges.
After the announcement of the Guideline, about sixty companies have expressed interest in applying for a virtual bank licence including the traditional bank Standard Chartered Bank, online lender WeLab, payment platform Yedpay! and the stored value payment licensee TNG. The establishment of virtual banks in Hong Kong is the beginning of building a healthy financial ecosystem and the competent players attracted to the field will embrace the enormous opportunities brought about by marrying banking and technology to challenge the traditional banking model in Hong Kong.
Kristi L Swartz is the Managing Partner of Bryan Cave’s Hong Kong office. This article was first published on the firm’s website.