FAQs

Individual banks are required to develop their own account opening procedures taking into account all relevant legal and regulatory requirements, including but not limited to the Anti-Money Laundering and Counter Terrorist Financing Ordinance (Cap. 615), and Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions), as well as the Code of Banking Practice and their own business strategies.

According to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and related Guideline, banks are required to identify and take reasonable measures to verify the identity of the beneficial owner of corporate customers so that the bank is satisfied that it knows who the beneficial owner is, including measures to enable the bank to understand the ownership and control structure of the corporate customer. A beneficial owner normally refers to a natural person who ultimately owns or controls the corporate customers.

Following the principle of a risk-based approach, banks should differentiate the risks of individual customers within a particular segment or grouping by looking not only at country risk but at a range of factors including business risk, product risk and delivery channel risk. It is inappropriate to adopt a one-size-fits-all approach when looking at the risks a customer may present and banks are expected not to take decisions that are discriminating, disproportionate or unreasonable.

Either a customer or a bank may close an account at any time subject to any specific terms and conditions that may apply. However, according to the Code of Banking Practice, a bank should give at least 30 days’ notice or, upon the customer’s request and where practicable, a longer period of notice to the customer before closing an account, except under exceptional circumstances, for example, where the account is being used or is suspected of being used for illegal activities. The bank should, where appropriate and not against the law, also consider providing a reason to the customer for closing the account.

According to the Code of Banking Practice, a bank should provide account statements to a customer at monthly intervals unless, (a) a passbook or other record of transactions is provided; (b) there has been no transaction on the account since the last statement; or (c) otherwise agreed with the customers.

According to the Code of Banking Practice, banks should give customers 30 days’ notice before any variation of the terms and conditions which affects fees and charges, and the liabilities or obligations of customers takes effect. For all other variations, banks should give customers reasonable notice before such variation takes effect.

It is banks’ commercial decision on whether or not to apply fees and charges on their banking services, and if so, the level of such fees and charges. Nonetheless, according to the Code of Banking Practice, banks should make readily available to customers details of the fees and charges payable in connection with banking services provided.

It is banks’ commercial decision on whether or not to apply charges on dormant accounts. Nonetheless, according to the Code of Banking Practice, banks should give 14 days’ prior notice to customers when a charge accrues on dormant accounts for the first time, and advise them of what can be done to avoid such charges or where they can obtain such information. The HKMA always encourages banks to consider the public need for banking services while operating on commercial principles. All the retail banks which previously charged dormant account fee have abolished the fee.

The level of fees and charges on banking services is banks’ commercial decision. However, according to the Code of Banking Practice, banks should give at least 30 days’ notice to affected customers before any changes in the level of fees and charges (including any change in the basis on which fees and charges are determined) take effect, unless such changes are not within their control. These requirements aim to provide customers with adequate information which enables them to make informed decisions in selecting banking services most suitable for them.

It is banks’ commercial decision on whether or not to implement minimum balance requirement on customers’ accounts and levy charges on accounts with balance falling below the minimum balance requirement. However, according to the Code of Banking Practice, banks should make readily available to customers information on the minimum balance requirement and the charges payable if the account balance falls below the requirement. The HKMA always encourages banks to consider the public need for banking services while operating on commercial principles. All retails banks exempt vulnerable customers from low-balance fees. Digital banks are required not to impose minimum balance requirements or low balance fees on customers. You can contact your bank for details.

It is banks’ commercial decision on whether or not to open a branch in a district. Nonetheless, the HKMA always encourages banks to consider the public need for banking services while operating on commercial principles.

The HKMA does not accept banks to make the purchase of wealth management investment or insurance products or having a large amount of initial deposits as a condition for opening a bank account, or link these activities with the chance of success or processing time of opening of bank accounts.

If your application for an account is rejected by a bank, you are entitled to directly requesting the bank to re-examine your application under the bank’s review mechanism. For contact details of banks’ review mechanisms, you may refer to the “What if the application is rejected?” page in the HKMA webpage. You can assist the bank’s review by providing more information. You may also wish to consider approaching other banks for account opening. The contact details of a list of retail banks in Hong Kong and the general information and documentation requirements for opening accounts with them can be found on the HKMA’s webpage.

Under the AML Guideline which was revised in October 2018, banks are only required to collect the address information of the customers. For the avoidance of doubt, a bank may, under certain circumstances, require verification (on top of collection) of residential address from a customer for other purposes (e.g. group requirements, other local or overseas legal and regulatory requirements). In such circumstances, the bank should communicate clearly to the customer the reasons of requiring verification of address.

AEOI stands for Automatic Exchange of Financial Account Information. It refers to the automatic exchange of financial account information in tax matters, aiming at improving transparency in the fight against tax evasion and in so doing protecting the integrity of the tax systems of the participating jurisdictions. In Hong Kong, the relevant legislative framework for implementation of AEOI is laid down in the Inland Revenue Ordinance.

In view of the implementation of the AEOI arrangement in Hong Kong, which also affects bank customers, the HKMA has worked with and guided the banking industry in developing an AEOI Fact Sheet which aims at addressing likely questions that bank customers may raise. The Hong Kong Association of Banks (HKAB) and the Private Wealth Management Association (PWMA) have published on their respective websites the AEOI Fact Sheet developed by the banking industry. The contents of the Fact Sheet are for general reference purposes. Relevant hyperlinks to HKAB’s and PWMA’s websites are as follows.

• HKAB's website
• PWMA's website

If you wish to learn more about AEOI, you may also refer to the following webpages providing general information on the subject:

• Inland Revenue Department’s AEOI webpage
• Organisation for Economic Cooperation and Development’s AEOI portal

FATCA is a United States (US) legislation that aims at combatting tax evasion by US persons holding accounts and other financial assets outside the US. In view of this new development which also affects bank customers, the Hong Kong Monetary Authority has worked with the Hong Kong Association of Banks (HKAB) to enhance the industry association’s previous efforts in developing a FATCA fact sheet. You may visit the following webpage to view the updated FATCA fact sheet developed by HKAB. The contents of the FATCA fact sheet are for general reference purposes.

If you wish to learn more about FATCA, you may also refer to the following webpages providing general information on the subject:

• A press release issued by the Financial Services and the Treasury Bureau (FSTB) on 13 November 2014 titled “HK and US sign agreement to facilitate compliance with FATCA by financial institutions in HK”
  http://www.fstb.gov.hk/fsb/ppr/press/doc/pr131114_e.pdf
• “US FATCA Intergovernmental Agreement - Frequently Asked Questions” issued by the FSTB
  http://www.fstb.gov.hk/fsb/topical/doc/fatca-faq2_e.pdf
• FATCA webpages of US Department of the Treasury
  https://www.treasury.gov/resource-center/tax-policy/treaties/Pages/FATCA.aspx
• US Internal Revenue Service FATCA page
  https://www.irs.gov/businesses/corporations/foreign-account-tax-compliance-act-fatca

As an international financial centre, Hong Kong attaches great importance to safeguarding the integrity of its financial systems by implementing Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) regime which meets international standards.

The banking sector, as a gatekeeper of the financial system, plays an important role in that regime.  The HKMA has developed relevant policies and provided guidance to banks in establishing AML/CFT Systems, which includes preventive measures such as customer due diligence (CDD), transaction monitoring and record keeping, for identifying and appropriately mitigating ML/TF risks. When conducting CDD, banks collect information/documents from customers and reliable sources at account opening and on periodic basis thereafter to identify and verify their customers and develop an understanding of normal and expected banking activities of individual customers for ongoing monitoring of any abuse of banking services or illicit fund flows.

Customers can contribute to the efforts in the fight against crime by providing accurate and up-to-date information upon request by banks. Such cooperation will not only help banks in meeting their legal and regulatory obligations and safeguarding the integrity of the financial system in Hong Kong, but also help protect bank customers from becoming the victims of fraud and other criminal activities.

Banks adopt a risk-based approach in conducting AML/CFT work, which recognises that risks of different customers and different banking services are different, and thus CDD and risk mitigating measures adopted by banks should be proportionate to the risk level and not to bring undue burden on the customers. More information can be found on the FAQs Section about Account Opening and Operation.

The HKMA is the government authority responsible for promoting the general stability and effective working of the banking system.  The HKMA supervises licensed banks, restricted licence banks and deposit-taking companies (collectively referred to as banks).  The HKMA expects banks to take reasonable steps to handle complaints fairly, consistently and promptly.

Legitimate public complaints assist the HKMA in identifying issues of supervisory or enforcement concern that require follow-up action, including initiating an investigation and taking supervisory and enforcement actions.

Please note, however, that the HKMA cannot interfere with a bank’s commercial decisions, adjudicate or intervene in service quality issues or a dispute between a bank and its customer, or order a bank to pay compensation.

You are encouraged to make a formal complaint to the bank first in order to give it a chance to resolve the issues at an early stage.  Many complaints arise from a misunderstanding or a mismatch of expectations and they can often be resolved after proper communication with the bank.

Each bank has designated an officer to handle complaints.  You can find the contact details of these officers on the “List of banks’ contact persons for handling customer complaints” on the HKMA website.  Simply contacting a customer service representative of the bank may not be sufficient for the purpose of complaint lodging and handling.

The HKMA’s focus is on whether the bank has handled your complaint properly and addressed your concerns, while in parallel, monitoring any potential breach of relevant regulatory requirements.

You may consider filing a complaint with the HKMA when:

• you suspect misconduct on the part of the bank and/or its staff;
• the bank refuses to handle your complaint;
• the bank does not handle your complaint in a fair manner or its reply does not fully address your complaint; or
• you have not received a final reply from the bank within 30 calendar days (up to 60 calendar days for complicated cases).

The HKMA does not have the power to order banks to pay compensation.

If your complaint is about a monetary dispute, you may consider using the mediation and arbitration services provided by the Financial Dispute Resolution Centre (FDRC). The FDRC provides financial consumers with an independent and affordable avenue, as an alternative to litigation, for resolving some monetary disputes with financial institutions.

You can visit the FDRC website at www.fdrc.org.hk or call its hotline at 3199 5199 to find out more.

You can also consult a lawyer about your dispute.

You have to complete the online complaint form or download and complete the form in PDF format.  Please fill out the complaint form as thoroughly and accurately as possible and return it to the HKMA, together with relevant information (including the responses of the bank to your complaint lodged with it) if any, through online submission, or by email, fax or post.  This is necessary to enable the HKMA to handle your complaint promptly by informing us of what your complaint is about and giving us the necessary consent to handle your complaint.  Please note that the HKMA may need to disclose the information you have given to us (including your personal data when necessary) to the bank and other third parties for purposes related to the handling of your complaint.

To avoid any misunderstanding, the HKMA requires that you fill out our complaint form and provide it to the HKMA.

The HKMA will not complete a complaint form for complainants.

Under special circumstances where persons with disability are not able to fill out the complaint form without assistance, the HKMA will provide special assistance.  Please call 2878 1378 for an appointment at our office.  An HKMA staff member will meet with the person with disability and provide assistance to complete the complaint form.

When a duly completed complaint form is submitted online, an acknowledgement email, which provides a case reference number, will be generated by the system.  The HKMA will then send a preliminary response within 10 working days, advising whether the HKMA will take up your complaint.

If the complaint form is incomplete, the HKMA may contact you to obtain the missing information.  An incomplete complaint form may affect our handling of your complaint.

After the HKMA takes up a complaint, we will review all relevant information available.  Generally, as part of the HKMA’s complaint handling, if the case involves business relationship and/or contractual agreements between you and the bank concerned, we may refer your complaint to the bank for its further review, including where you may have already made a formal complaint to the bank earlier.  The HKMA will ask the bank to provide you with a detailed reply within 30 calendar days* in response to your allegations.  The bank is also required to send to the HKMA a copy of its reply to your complaint for the HKMA’s review.

We may also obtain further information from the bank in relation to your complaint.

The flowchart at the “Complaints about Banks” section on the HKMA’s website may help you understand how the HKMA handles complaints.

* Up to 60 calendar days is allowed for more complicated cases.  However, the bank should provide you with an interim reply within 30 calendar days explaining why a longer period is required.

If you are not satisfied with the bank’s reply to you, you may contact the HKMA in writing, setting out the reasons why you think the bank’s reply has not adequately addressed your complaint.  Depending on any new or additional information, we may ask the bank to review the case and/or give you a further reply.

The HKMA will review the bank’s reply, and if the HKMA considers that the bank has not adequately addressed your concerns in its final reply, the HKMA may require the bank to give you a further reply.

Not all complaints will lead to supervisory or enforcement actions.  If in the course of complaint handling, the HKMA identifies supervisory or enforcement concerns, we will follow up with the bank concerned or initiate an investigation.  The HKMA may take enforcement action where there are sufficient grounds for doing so.  Where appropriate, the HKMA may also refer the complaint to the relevant regulators or enforcement agencies to consider appropriate action.

In any event, we will let you know in writing in due course the outcome of HKMA’s handling of your complaint.  If the complaint handling process cannot for any reason be completed within a short period of time, we will give you a brief update on the progress every six months.  We will endeavour to explain relevant considerations in relation to the outcome of the HKMA’s handling of your complaint case.  However, please note that the HKMA and its staff are subject to secrecy obligations under the Banking Ordinance with respect to information obtained in the course of exercising the HKMA’s functions.  For this reason, the HKMA cannot provide you with private information about banks (e.g. supervisory actions, investigations) obtained in the course of handling a complaint.

If you wish to provide supplementary information for your complaint, you may write to the HKMA by email or post, since written communication can help avoid misunderstanding and provide a proper and clear record for the parties involved.  We will carefully consider any additional information, and once we have completed handling of your complaint, we will provide a written reply on the outcome.

Not all complaints will result in the HKMA taking supervisory or enforcement actions (e.g. if the complaint relates to a purely commercial matter or the bank has handled the complaint properly or the complaint is not substantiated in our view). The HKMA’s assessment is made on the basis of all information on hand and its outcome is final. The HKMA will only consider a request for review of a case made with valid grounds (e.g. new substantial supporting information), and in such a case, you may set out such information to the HKMA in writing. The HKMA will review all relevant information provided by you and the bank concerned. We will advise you the outcome of our handling of your complaint in writing.

In any event, the HKMA’s assessment will not affect your legal rights and you can, if you wish, further pursue your complaint through other avenues, such as civil proceedings.

If a complainant persists in pursuing his/her complaint after being notified of the HKMA’s assessment outcome but without providing any new and relevant supporting information/evidence, the HKMA may not respond to further correspondence from the complainant on the matter. The HKMA will give advance notification to the complainant on such arrangement and the reasons behind in writing.

The HKMA assigns staff for handling complaint cases based on operational arrangements, and each complaint will be handled in accordance with the established procedures. All relevant information available will be reviewed by the relevant staff of the HKMA in a professional manner with oversight. The HKMA’s assessment and outcome are not the personal view of any of its complaint handling staff.

If you are not satisfied with the way in which the HKMA or its staff has handled your banking complaint, you may write to the Enforcement and AML Department of the HKMA (at 55/F, Two International Finance Centre, 8 Finance Street, Central, Hong Kong) specifying the reasons why you are not satisfied (e.g. delay in response, failure to observe professional standards of competence and behaviour). The HKMA will handle the matter in accordance with our established procedures and will inform you of the result. However, this review does not cover disagreement with the HKMA’s assessment outcome, or the staff who recommended the outcome, in respect of your complaint. The HKMA’s assessment outcome is final.

If you suspect maladministration on the part of the HKMA, you may consider making a complaint to the Office of the Ombudsman, Hong Kong. Information about the role of the Ombudsman is available at www.ombudsman.hk .

Please refer to the HKMA’s Privacy Policy Statement.  Information provided in relation to a complaint will be used for the purposes stated in the complaint form.  It is recommended that you read it before making a banking complaint to the HKMA.

You may have to bear the loss if your credit card has been used for an unauthorised transaction before you reported to the card issuing bank that your card or personal identification number (PIN) has been lost or stolen or that someone else knows the PIN. You may also be held liable for the losses if you have acted fraudulently, with gross negligence or have failed to inform the card issuing bank as soon as reasonably practicable after having found that your card has been lost or stolen. This may apply to losses caused by your failure to follow the measures which you should take to safeguard your card or PIN as advised by the card issuing bank.

Provided that you have not acted fraudulently, with gross negligence or have not otherwise failed to inform the card issuing bank as soon as reasonably practicable after having found that your card or PIN has been lost or stolen, according to the Code of Banking Practice, the maximum liability for such credit card loss should be confined to a limit specified by the card issuing bank, which should not exceed HK$500. The application of this limit is confined to loss specifically related to your credit card account and does not cover cash advances.

You should report the unauthorised transaction to the card issuing bank no later than 60 days from the statement date. According to the Code of Banking Practice, if you fail to report the unauthorised transaction within that period, the card issuing bank can reserve the right to regard the statement as conclusive and you may have to be held responsible for the unauthorised transaction.

Cardholders are responsible for examining their statements of credit card accounts and report any unauthorised or irregular transactions to the card issuing banks. Please also refer to the answer to Question C2 above.

Although banks are exempt from the interest rate restriction under the Money Lenders Ordinance (Chapter 163) according to the Code of Banking Practice, banks should not charge customers extortionate interest rates. If the annualised percentage rates (APRs) charged by them and calculated in accordance with the method set out in the relevant guidelines issued by the industry associations exceed the level which is presumed to be extortionate under the Money Lenders Ordinance (currently 36%), they should be able to justify why such high interest rate is not unreasonable or unfair. Unless justified by exceptional monetary conditions, the APRs thus calculated should not exceed the legal limit (currently 48%) as stated in the Money Lenders Ordinance.

There may be a term in your credit card contract that allows the credit card issuing bank to increase the interest rate applicable to your credit card account even if you have not missed a payment. However, your credit card issuing bank must give at least 60 days’ notice for you to tell them that you want to reject the increase in interest rate by closing your credit card account. If you opt to close your credit card account, you should be given a reasonable period to repay your balance at the existing interest rate, with a repayment method not less beneficial to you than your current repayment method.

The term “credit limit” generally refers to the maximum amount set by a card issuing bank for a card-holder within which the card-holder may use the credit card to purchase goods and services on credit or obtain cash advances. Regarding credit limit assignment, please refer to Section 4.6 of the Supervisory Policy Manual module CR-S-5 "Credit card business" for details.

Card issuing banks should not grant credit card limit exceeding HK$10,000 (applicable to new cards only) to students in an institution of higher education, unless the student has submitted a written application with financial information demonstrating his/her independent ability to repay the proposed extension of credit.

The credit card DDAs in connection with contracts entered into with merchants are given directly to the merchants (and not to the credit card issuing bank). Accordingly, a request for cancellation of a DDA should be made to the merchant. You can give the merchant a written instruction to cancel the authorization. If the DDA is still not cancelled, you can provide a copy of the cancellation instruction to your credit card issuing bank, and seek its help to contact the merchant to seek reimbursement of the disputed charge and / or cancellation of the authorisation in dispute (as the case may be).

Generally speaking, where consumers use credit cards to make lump-sum payments for goods and services and have disputes over the transactions later on (e.g. the service purchased is not available as the merchant has gone out of business, the goods purchased do not match the description, etc.), consumers can request for refunds of their payment through the credit card chargeback mechanisms of the respective credit card associations.

Consumers may apply to their card issuing banks to raise chargeback (i.e. refund) requests against the disputed transactions. After obtaining the details of the disputed transactions from consumers, the card issuing banks will, through the credit card associations and in accordance with their rules and criteria, raise disputes and chargeback requests for the consumers against the relevant transactions to the merchant acquirers. Consumers may check with the card issuers about application procedures for raising chargeback requests and the chargeback processes of respective credit card associations. The general (simplified) process flow of the chargeback mechanism is shown in the attached diagram.

Diagram: General (simplified) process flow of the chargeback mechanism

Notes (5-8): A merchant acquirer or a merchant may, in accordance with the rules of the respective credit card association, accept or reject a chargeback request. Where the merchant acquirer or the merchant rejects the chargeback request but the card issuing bank or consumer does not agree with the decision, the card issuing bank may in accordance with the rules of the respective credit card association submit the disputed transaction to the credit card association for arbitration.

Consumers should note that, chargeback requests raised by card issuing banks on customers’ behalf are subject to the rules of the respective card associations (including the chargeback time limits within which consumers must file the requests, information showing a dispute is valid, etc.). Chargeback requests which do not fulfil the relevant requirements may be rejected. Consumers can visit the webpages of card issuing banks for relevant information or directly contact the card issuing banks to understand the details of chargeback protection and the relevant rules that may apply to a specific credit card transaction.

Under the Code of Banking Practice, card issuing banks are required to disclose terms and conditions in a reasonable layout and font size that is readily readable. Annualised percentage rates for purchases and cash advances and fees and charges should be disclosed prominently and conspicuously and in a font size that is sufficiently larger than that for the other terms and conditions.

In general, if customers do not repay the balance in full on or before the payment due date, they will lose the "interest-free" grace period (note: for some card issuers, the "interest-free" grace period is only applicable to retail purchases but not cash advance). This means that they will be immediately subject to interests on the unpaid portion of the balance as well as any new transactions: interest on the unpaid portion of the balance will be charged from the previous statement date to the current statement date, while interest on any new transactions will be charged from the transaction / posting date of the transaction to the current statement date. Even though the customers subsequently repay the "balance" as stated on the statement in full (including the interests charged for the current billing cycle), some card issuers will still charge the customers interest in the next billing cycle: interest on the full "balance" calculated from the statement date to the date the customers repaid the "balance" in full. Each credit card issuing bank may have a slightly different approach in calculating credit card interest rates. You can call up your credit card issuing bank to understand how the interest on your credit card is calculated and ask them for the exact dollar amount you should repay on the payment due date (or earlier) in order to fully settle your outstanding balance.

According to the Code of Banking Practice (CoBP), banks should require their debt collection agencies not to employ harassment or improper debt collection tactics.

If you find the tactics used by the debt collection agency not in line with requirements as specified in the CoBP, you can make a complaint to the bank (see list of banks’ contact persons for handling customer complaints). If you are not satisfied with the manner in which the bank handles your complaint, you may seek help from our Complaint Processing Centre (see FAQs - Complaints About Banks).

According to the Code of Banking Practice, banks should require their debt collection agencies to act within the law and observe a strict duty of confidentiality in respect of customer information.

According to the Code of Banking Practice, banks and their debt collection agencies should not try to recover debts, directly or indirectly, from third parties including referees, family members or friends of the debtors if these persons have not entered into a formal contractual agreement with the banks to guarantee the liabilities of the debtors.

Yes. According to the Code of Banking Practice, banks should give the customer advance written notice (sent to the last known address of the customer) of their intention to commission a debt collection agency to collect an overdue amount owed to the bank. The written notice should include the following information: -

• the overdue amount repayable by the customer;
• the length of time the customer has been in default;
• the contact telephone number of the bank’s debt recovery unit which is responsible for overseeing the collection of the customer’s debt to the bank;
• the extent to which the customer will be liable to reimburse the bank the costs and expenses incurred in the debt recovery process (if the bank requires the customer to indemnify it for such costs and expenses); and
• that the customer should in the first instance report improper debt recovery actions taken by the debt collection agency to the bank.

Banks intending to use debt collection agencies should specify in the terms and conditions of credit or credit card facilities that they may employ third party agencies to collect overdue amounts owed by the customers. Banks which reserve the right to require customers to indemnify them, in whole or in part, for the costs and expenses they incur in the debt recovery process should include a warning clause to that effect in the terms and conditions.

According to the Code of Banking Practice, banks should not engage more than one debt collection agency to pursue the same debt in one jurisdiction at the same time.

Generally speaking, the right of banks to take recovery measures depends on their contractual agreements with borrowers. 

Please note that the above information shall not constitute a legal advice from the HKMA. You are suggested to consult your legal advisor as deemed appropriate.

The DPS protection limit is HK$500,000 per depositor per Scheme member. A depositor’s deposits in separate accounts with a Scheme member will be aggregated for calculating the protected deposit amount.

All licensed banks (unless exempted) are members of the DPS and must display the membership sign prominently at their places of business.

Conventional deposits with Scheme members denominated in any currency (e.g. deposits in savings and current accounts, and time deposits with a term not more than five years) are protected by the DPS, whether they are held by an individual or a company. Secured deposits are also covered. However, structured deposits, time deposits with an original maturity exceeding five years, bearer instruments, offshore deposits and non-deposit products are not protected by the DPS.

To find out more about the DPS, please visit the website of the Hong Kong Deposit Protection Board (the Board) (http://www.dps.org.hk) or contact the Board (Tel: (852) 1831 831; E-mail: dps_enquiry@dps.org.hk).

Banks in Hong Kong are required to have in place adequate security controls over their Internet banking services. According to SPM TM-E-1 on “Risk Management of E-banking” issued by the HKMA in 2015, one of the important security measures is that banks are required to notify their customers immediately via an effective alternative channel such as SMS message after completing an online high-risk transaction, and the notification message should contain the transaction details.

This notification mechanism is aimed at facilitating the customers in detecting any suspected unauthorised transactions so that they could report them to their bank immediately for prompt actions e.g. suspending the funds from being transferred to overseas account (where possible). Notification through SMS messages is considered to be more timely and effective. As such, banks in general will require their customers to provide their mobile phone numbers to the banks if the customers choose to enroll in Internet banking services for conducting high-risk transactions.

Alternatively, if customers choose not to provide mobile phone numbers to the banks, the customers could still conduct the high-risk transactions through other channels such as at branches or by post (where appropriate).

Further information and advice on Internet banking safety may be found on the “Smart Consumers” webpage.

According to the Supervisory Policy Manual on General Principles for Technology Risk Management and related circulars issued by the HKMA, banks are required to implement adequate IT controls to ensure confidentiality and integrity of information, and to protect the information in accordance with the level of risk present and envisaged. In particular, banks are required to protect confidentiality of customer data. Some of the banks may require their customers to log in their Internet banking accounts to access the monthly e-statements. The customer login process at Internet banking can be used as a way to authenticate the identity of the customer, and therefore protecting the customer information (including e-statements) stored at the bank’s systems.

The HKMA adheres great importance to data security particularly customer data protection and will continue to work with the banking industry to monitor the developments and trend of technology and information security, and strengthen the security measures, where appropriate, to protect the integrity and confidentiality of customer information.

Further information and advice on Internet banking safety may be found on the “Smart Consumers” webpage.

The HKMA's supervisory objective is to establish and maintain a safe and sound environment for the development of e-banking in Hong Kong without standing in the way of progress. The HKMA believes that maintaining technology neutrality is crucial for allowing banks to have the flexibility to choose and implement technologies that are appropriate to their e-banking services. Nevertheless, banks are required to adhere to the "fit for purpose" principle when implementing the system i.e. the technical implementation of the security measures and other controls adopted by banks for their electronic banking systems is required to be commensurate with the risks associated with the types and amounts of transactions allowed, the electronic delivery channels adopted and the risk management systems of individual banks.

As such, in respect of two-factor authentication, banks are required to select reliable and effective authentication techniques to authenticate the identity and authority of their e-banking customers. In general, banks are required to employ stronger customer authentication for authenticating their customers' transactions with higher risk. Banks need to evaluate carefully other aspects, including whether a particular authentication method is sufficiently mature.

Banks are expected to continue to review their security measures in place and to enhance the controls where appropriate on an ongoing basis, taking into account the trend and development of e-banking and information security.

Further information and advice on Internet banking safety may be found on the “Smart Consumers” webpage.

Internet banking services in Hong Kong are safe to use so long as both the banks and the customers have taken appropriate precautionary measures. Bank customers should stay vigilant to potential security issues e.g. computer virus, Trojan Horse attacks on their personal computers and mobile devices. Customers should install security software in their personal computers and mobile devices and keep them up-to-date. They should also avoid visiting or downloading software from suspicious websites, and be wary of opening attachments in e-mails from unfamiliar sources. Bank customers who discover any suspicious webpage or any unauthorised transactions in their bank accounts should contact their banks immediately. Further information and advice on Internet banking safety may be found on the “Smart Consumers” webpage and on the websites of banks.

According to Article 112 of the Basic Law, "No foreign exchange control policies shall be applied in the Hong Kong Special Administrative Region. The Hong Kong dollar shall be freely convertible. Markets for foreign exchange, gold, securities, futures and the like shall continue. The Government of the Hong Kong Special Administrative Region shall safeguard the free flow of capital within, into and out of the Region." It means that there is no restriction on money transfer in Hong Kong and the HKMA does not impose charges of any kind on money transfer.

We suspect that you have encountered a fraud case. The HKMA is the banking regulator in Hong Kong and we have no relationship with any kind of lottery activity.

In addition, according to Article 112 of the Basic Law, "No foreign exchange control policies shall be applied in the Hong Kong Special Administrative Region. The Hong Kong dollar shall be freely convertible. Markets for foreign exchange, gold, securities, futures and the like shall continue. The Government of the Hong Kong Special Administrative Region shall safeguard the free flow of capital within, into and out of the Region." It means that there is no restriction on transfer of money in Hong Kong and the government does not demand for any kind of charges on money transfer.

If you suspect that fraudulent activities are involved, you may wish to report the case to the local police station or the Commercial Crime Bureau of the Hong Kong Police Force direct.

If you receive any suspicious messages or identify any suspicious websites that purport to be related to banks, please contact the bank concerned and the police (either a local police station or the Commercial Crime Bureau) to report your case.

When making a fund transfer, a bank customer or SVF user should take great care and verify the accuracy of the inputted transferee’s account number and amount of funds to avoid mis-transfer of funds.

The guideline is applicable to cases where bank customers or SVF users have mis-transferred funds to unintended parties via any fund transfer channels, including ATMs, phone banking, online banking, mobile banking and bank branches, whether within the same bank, between different banks, across a bank and an SVF operator, within the same SVF operator and between different SVF operators in Hong Kong.

If a bank customer or SVF user has made a mis-transfer of funds, he/she should seek assistance promptly from his/her bank or SVF operator. The bank or SVF operator will request him/her to provide details about the mis-transfer to facilitate its communication with the transferee institution, which will in turn contact the transferee. Upon receiving the report of a mis-transfer, the bank or SVF operator concerned will follow the aforementioned handling procedures, including providing a written response to the transferor, detailing the date(s) of communication between the transferee institution and the transferee, actions taken and the outcomes. In case the transferee does not return the mis-transferred funds, the written response will be helpful to the transferor in reporting to the Police or considering taking further action as needed. Such handling procedures also require the transferee institution to remind the transferee that he/she may be held criminally liable if the mis-transferred funds are not returned.

If one receives some funds that have been mis-transferred to his/her own bank account or SVF account, he/she should report it promptly to his/her bank or SVF operator and arrange to return the funds via his/her bank or SVF operator. Otherwise, he/she may be held criminally liable.

If you suspect that a bank/SVF operator is not handling your data properly, generally, you should raise your concern with the bank/SVF operator first. If you are dissatisfied with their response, you can lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD). You can visit PCPD’s website to learn more about their complaint handling policy and procedures.

Yes, according to the Code of Banking Practice, banks are required to treat their customers’ (and former customers’) banking affairs as private and confidential. Banks should at all times comply with the Personal Data (Privacy) Ordinance (Chapter 486) (PDPO) in the collection, use, holding and erasure of customer information. They should also comply with any relevant codes of practice issued or approved by the Privacy Commissioner for Personal Data giving practical guidance on compliance with the PDPO. As for SVF operators, according to Practice Note on Supervision of SVF Licensees they should set out clearly their personal data policies and practices in a manner that can fulfil the requirement under the PDPO as well as any relevant codes of practice, guidelines or best practice issued by the Office of the Privacy Commissioner for Personal Data from time to time.

The Office of the Privacy Commissioner for Personal Data is a statutory body entrusted with the task of protecting personal data privacy of individuals and to ensure compliance with the Personal Data (Privacy) Ordinance (Chapter 486) in Hong Kong. You can learn more from its website.

In general terms, an APR is a reference rate which includes the interest rate and other fees and charges (such as handling charges and service charges) of a banking product (such as credit cards and personal loans) expressed as an annualised rate. The Code of Banking Practice requires banks to, where relevant, quote APRs of banking products to facilitate comparison between different charging structures.

APRs are calculated using the “Net Present Value” method specified in the relevant guidelines issued by the industry associations. Banks adopt the same set of rules and assumptions to provide a consistent basis of calculation.

According to the Code of Banking Practice, banks should where relevant quote APRs of banking products. In particular, banks should, where relevant, indicate the APRs in any advertising and promotional materials for banking products which includes references to interest rates. Banks should also be prepared to respond to your inquiries concerning APRs and the methods of calculation.

Although banks are exempt from the interest rate restriction under Money Lenders Ordinance (Chapter 163), according to the Code of Banking Practice, banks should not charge customers extortionate interest rates. If the APRs charged by them and calculated in accordance with the method set out in the relevant guidelines issued by the industry associations exceed the level which is presumed to be extortionate under the Money Lenders Ordinance (currently 48%), they should be able to justify why such high interest is not unreasonable or unfair. Unless justified by exceptional monetary conditions, the APRs thus calculated should not exceed the legal limit (currently 60%) as stated in the Money Lenders Ordinance.

According to the Code of Banking Practice, a bank should be prepared to answer your queries relating to the terms and conditions of banking products. A bank should also provide the basis on which the interest rate of your loan is determined upon your application for the loan or in a subsequent offer.

You may wish to refer to Section 6: Exchange rates and interest rates of the Monthly Statistical Bulletin.

Only those individuals whose names are entered in the Register of Securities Staff of AIs (HKMA Register) on the HKMA's website may engage in the conduct of regulated activity(ies) of a registered institution.  It is the responsibility of a registered institution to ensure that an individual is fit and proper before submitting the specified particulars to the HKMA Register for the individual to conduct regulated activity(ies) as a relevant individual.  It is also the responsibility of a registered institution to remove the particulars from the HKMA Register when a relevant individual is not fit and proper or no longer conducts any regulated activity for the registered institution.

Any person who is directly responsible for supervising the conduct of any regulated activity of a registered institution is expected to be appointed as an executive officer.  Executive officers must obtain written consent of the Monetary Authority.  Application to become an executive officer should be made to the HKMA through the registered institution concerned.

Relevant individuals and executive officers of registered institutions are subject to the same competence requirements set out by the Securities and Futures Commission (SFC) for licensed representatives and responsible officers of licensed corporations respectively.  The competence requirements are detailed in the Guidelines on Competence issued by the SFC.  In addition, a relevant individual or an executive officer must have met the fitness and properness standards laid down in the Fit and Proper Guidelines issued by the SFC. 

To access the Guidelines on Competence and the Fit and Proper Guidelines, please visit the SFC's website.

In general, if you were registered as a relevant individual of a registered institution before and seek to re-register within 3 years from the date of your last registration, you do not have to take any licensing examination if you seek to engage in the same regulated activity (or other regulated activity with the same competence requirements) and in the same role (as a relevant individual or as an executive officer) as you were last registered.

If you have left the industry for between 3 and 8 years and now seek to be engaged by a registered institution as a relevant individual for the same regulated activity (or another regulated activity having the same competence requirements) and in the same role as before, you may be exempted from licensing examinations (including the recognised industry qualifications and the local regulatory framework paper requirements) provided that you have completed five Continuous Professional Training (CPT) hours per regulated activity for each year of absence from the industry (where local regulatory training must make up at least 50% of the CPT activities).

For details about exemptions from licensing examinations for a relevant individual and the criteria for exemption (which are the same as a licensed representative), you may refer to the Guidelines on Competence posted on the Securities and Futures Commission’s website (including paragraph 4.4.4 for re-entrant exemption).

You may refer to paragraph 4.3.1 of the Guidelines on Competence posted on the Securities and Futures Commission’s website for the different options of competence requirements applicable to a relevant individual (which are the same as a licensed representative).  Recognised industry qualification requirement, for example, HKSI LE Papers 7 and 8 for Types 1 or/and 4 regulated activities, is not applicable to a relevant individual under Option A or Option B if you are in possession of the required relevant industry experience.  Please note, however, that local regulatory framework paper, or HKSI LE Paper 1, is required under each option (unless applicable exemption requirements apply).

CPT requirements are only applicable to relevant individuals (including executive officers) of register institutions and persons licensed with the Securities and Futures Commission.  You are not required to complete CPT hours if you no longer carry on regulated activities in any such roles.

The HKMA does not approve or grant exemption from CPT requirements for relevant individuals, nor does the HKMA endorse any CPT course or course provider.  It is the responsibility of a registered institution to ensure that an individual is fit and proper (including meeting the CPT requirements) before submitting the specified particulars to the HKMA Register for the individual to conduct regulated activity(ies) as a relevant individual.  It is also the responsibility of a registered institution to remove the particulars from the HKMA Register when a relevant individual is not fit and proper (including meeting the CPT requirements).

For details about CPT requirements, please refer to the Guidelines on Continuous Professional Training posted on the Securities and Futures Commission’s website.

Inclusion and removal of the specified particulars of relevant individuals in and from the HKMA Register are made by registered institutions through an on-line submission mechanism.  If you have questions about your past or current registration shown on the HKMA Register, you should approach the registered institution concerned.

While we note your dissatisfaction in having your loan application declined by the bank, we hope you would appreciate that the HKMA is not in the position to interfere commercial decisions of individual banks, including judgment on whether or not to lend to a particular customer.

The data retention period of different types of consumer credit data that may be retained by a CRA is specified under the Code of Practice on Consumer Credit Data (the Code) issued by the Office of the Privacy Commissioner for Personal Data (PCPD). For account repayment data, the general rule on data retention is that such data may be retained by a CRA in its database for five years from the date of creation of such data or until the expiry of five years after account termination. However, there are certain exceptions. For example, if you have defaulted in repayment for a period in excess of 60 days, then such account default data may be retained until the expiry of five years after the amount in default is fully settled.

For bankruptcy record, a CRA may collect this type of information from public sources for credit reporting purposes. The Code provides that public record data relating to a declaration or discharge of bankruptcy may be retained by a CRA in its database for a period of eight years from the relevant declaration of bankruptcy.

For more information on data retention of other types of consumer credit data by a CRA, please refer to the Code. For any questions relating to the Code, please contact the PCPD direct. The contact information of the PCPD can be found on its website.

Any person can check his or her own credit record with the CRA concerned. You may wish to contact your bank to find out more information about the CRA they have used, and the contact information of the CRA.

You may make a data correction request with the CRA concerned. The CRA should handle your data correction request in accordance with the Code of Practice on Consumer Credit Data (the Code) issued by the Office of the Privacy Commissioner for Personal Data (PCPD) (clauses 3.19 and 3.20 of the Code refer).

For more information, please refer to the Code. If you have any questions about the Code, you may wish to make an enquiry with the PCPD direct. The contact information of the PCPD can be found on its website.

In accordance with the Code of Practice on Consumer Credit Data (the Code) issued by the Office of the Privacy Commissioner for Personal Data, when you have settled your loan account, you have a right to instruct your lender to make a request to the CRA concerned to delete the closed account data from its database. However, you should note that the right is conditional upon there having been, within 5 years immediately before account termination, no default in repayment for a period in excess of 60 days on the account and you have settled the account by full repayment (Clause 2.15 of the Code refers). For more information about deleting credit record from a CRA, please refer to the Code.

Generally speaking, the earlier a borrower makes loan repayment, the more outstanding interest payments are likely to be saved. Nevertheless, borrowers should consider the early repayment charges involved before deciding whether to pay off their loans early or not. Borrowers need to be aware that individual banks use different ways to apportion interest and principal in the monthly repayment amounts. Even though the monthly repayment amount is the same throughout the loan tenor, more interest will, in general, be included in earlier repayments, and less on principal. In other words, where a borrower has been making repayments as scheduled for some time, the amount of outstanding interest is likely to be small. If the borrower chooses to pay off the loan early at this point of time, the loss may outweigh the gain as the amount of interest saved may not be enough to cover the relevant charges for early repayment. As a smart bank customer, one should first check with the bank about the total amount involved in early repayment (including outstanding loan balance, early repayment charges and other fees, etc.) and the amount of outstanding interest. He/she should then compare different scenarios and consider carefully before making a decision of repaying early or not.

In general, it is the commercial decision of banks on whether and how much they will lend to borrowers. In making the decision, banks will consider a host of factors, such as repayment ability of the borrowers and any risk mitigating arrangements.

However, in the case where the lending activities engaged by banks could pose major prudential concern or significantly impact banking stability in Hong Kong, the HKMA will issue guidelines requiring banks to adopt prudent standards and practices to strengthen their risk management.

With regard to property mortgage loans, the HKMA has introduced several rounds of countercyclical macroprudential measures since October 2009 to enhance the resilience of banks to cope with any possible downturn in the local property market and prevent homebuyers from overstretching themselves. In introducing each round of measures, the HKMA has strived to minimise the impact on genuine end-users, particularly first-time homebuyers.

There are two common approaches adopted by banks in assessing the repayment ability of mortgage applicants:

Debt servicing ratio (DSR)-based lending – DSR is the ratio of the monthly debt obligations of mortgage applicants to their monthly income. It is usually applicable to applicants with regular income. Under this approach, banks will request applicants to provide their proof of income and evidence of indebtedness.

Net worth-based lending – this is usually applicable to applicants who could not provide regular income proof, and have to rely on their net worth to demonstrate their repayment ability. Under this approach, banks will request applicants to provide evidence of their net assets and indebtedness.

The purpose of “positive mortgage data sharing” is to enhance credit assessment of banks to facilitate prudent lending and more effective credit risk management by credit providers, thereby preventing over-borrowing by consumers and over-lending by credit providers. This is conducive to the general stability of the banking system in Hong Kong, which is crucial to the interest of depositors as well as the financial stability of Hong Kong as a whole.

The HKMA expects banks to make full use of the PMDS scheme and to verify the mortgage count declared by mortgage loan applicants with the mortgage count information obtained from the Credit Reference Agency database.

Chip-based ATM technology offers greater security and protection to the data stored within the chip and therefore reduces the risk of unauthorised ATM transactions. As many ATMs outside Hong Kong are still using magnetic stripe technology, the new chip card continues to feature a magnetic stripe to allow cardholders’ use outside Hong Kong. But enhanced security measures are implemented to offer additional protection against unauthorised ATM transactions outside Hong Kong. The overseas ATM cash withdrawal capability for all ATM cards is pre-set as “deactivated”. ATM cardholders are reminded to activate the overseas cash withdrawal capability before traveling, if they may need to withdraw cash from ATMs outside Hong Kong.

Cardholders who have not activated the overseas cash withdrawal capability of their ATM cards before leaving Hong Kong will have to resort to other means for activation before they could withdraw cash from ATMs outside Hong Kong. Cardholders can activate such capability via telephone (phone banking / call centre). A number of banks also offer additional channel(s) (e.g. Internet banking). While banks will communicate with their customers regarding the channels for activating overseas ATM cash withdrawal capability, cardholders are suggested to get in touch with their banks if in doubt.

Regarding the maximum expiry period, practices among the banks may vary, e.g. specific number of years such as one or three years, up to the expiration date of the card, or perpetual. Banks will communicate the details to their customers. Customers are reminded not to set the valid period longer than needed or to “perpetual” to avoid reducing the effectiveness of such security measure.