Recent years see a rapid development of innovative “stored value facilities” (SVFs) using the Internet or smartphone technologies to provide convenient payment services to the public. The SVFs issued by some of the major service providers may involve a great number of users and transactions. The associated risks posed to the stability of the payment systems and the security of users’ float will be more pronounced as these SVFs are becoming more ubiquitous. They have to be addressed properly.
In view of this, the HKMA introduced a legislative proposal in 2013 to establish a licensing mechanism for SVFs, putting them under the supervision of the HKMA. Thanks to the concerted efforts of various stakeholders, the Clearing and Settlement Systems (Amendment) Ordinance 2015 was passed by the Legislative Council on 4 November 2015 and commences operation on gazettal today (13 November 2015). Reflecting the importance of SVFs, the ordinance is re-titled the Payment Systems and Stored Value Facilities Ordinance.
The enactment of the Ordinance will enhance the regulatory regime for SVFs, covering device-based and non-device based SVFs (such as those stored on mobile phones or Internet accounts). On commencement of the Ordinance, there will be a one-year application period for SVF issuers to obtain licences from the HKMA. Immediate questions are whether these SVFs would be subject to any regulation during this one-year transition period and what the public should watch out for. Let me try to address these questions.
1. Purpose of the one-year application period
The new regulatory regime for SVFs under the Ordinance will be implemented in two phases:
(i) The first phase will take effect immediately with the gazettal of the Ordinance today. It mainly concerns the application for licences and the processing of applications. Existing SVF issuers can continue their operations. Moreover, in order not to stifle innovation and development of payment services, prospective SVFs issuers may also launch their services during this period.
(ii) The second phase will be implemented one year from now when the Ordinance comes into full operation. This includes provisions on sanctions for violation of the licensing regime.
The purpose of implementing the new regulatory regime in two phases is to allow sufficient time for the applicants to prepare the required documentations and complete their independent assessment reports, and for the HKMA to process the applications. (The independent assessment report will cover several important areas such as corporate governance, risk management policies and procedures, safeguard of the float and deposits, technology risk management policies and procedures, security measures and contingency plans. Depending on the size and complexity of the applicant’s operations, it usually takes several months to complete the report.) Since some service providers, such as the Octopus Card Limited, have been offering services to their users, this arrangement can avoid disrupting their normal operations and services to the public. When the second phase kicks in, applicants must obtain a licence in accordance with the requirements of the Ordinance in order to launch or continue their SVF operations. Otherwise, it will constitute a breach of the Ordinance.
2. Points to note for applicants
Whilst existing and prospective SVF issuers can provide services to the public without a licence during the first phase, they must abide by the prevailing laws in Hong Kong, including the Banking Ordinance, the Anti-Money Laundering and Counter-Terrorist Financing (Financial Institutions) Ordinance, the Personal Data (Privacy) Ordinance, the Trade Descriptions Ordinance, etc. For example, they must ensure that their operations do not contravene the provisions concerning deposit-taking and related requirements under the Banking Ordinance. They must comply with the data protection principles set out in the Personal Data (Privacy) Ordinance such that users’ personal information is adequately protected. Furthermore, they must not use any false trade descriptions when conducting their business.
The new regulatory regime has laid down various licensing criteria and regulatory requirements. Applicants must demonstrate that their operations and risk management arrangements are consistent with these criteria and requirements. Some of the key ones include:
(i) users’ float should be segregated from the licensee’s operating funds. The licensee also needs to put in place adequate safeguards (such as opening a trust account) for the float so as to ensure sufficient funds are available for redemption by users;
(ii) the licensee should have in place appropriate risk management policies and procedures to manage the risks arising from its SVF schemes, including adequate security and internal controls to ensure the safety and integrity of information and records;
(iii) the licensee should establish robust and appropriate controls to prevent and combat possible money laundering or terrorist financing activities; and
(iv) the chief executive, directors or controllers of the licensee should be fit and proper.
During the application period, the HKMA expects the applicants to implement appropriate measures to align their existing operations and risk management arrangements with these criteria.
I would like to emphasise that any circumstances arising during this transition period, which may call into question the ability of any individual applicants to meet the licensing criteria, will have a bearing on the HKMA’s decision on whether to grant a licence. If the HKMA refuses to issue a licence to any existing SVF issuers, it will be an offence under the Ordinance if they do not cease their operations and exit the Hong Kong market before the second phase commences.
To facilitate existing and prospective SVF issuers to prepare for the licence application, the HKMA has been communicating to them the regulatory requirements and related details of the Ordinance. The HKMA also issued a letter today to interested applicants reminding them of the regulatory requirements under the new licensing regime.
3. Issues to note for the public
Like using any other payment facilities or services, customers should be careful of what you sign up for when using the SVFs. That means you should understand clearly the nature, services, fees and preferential terms of the payment facilities. And don’t skip the small prints - read thoroughly how the service providers will handle the users’ float, whether the float will be segregated from other funds of the company, whether there is adequate protection of the float, how the users can get back the remaining stored value, and how complaints relating to transactions are handled. You should also know the security features of these facilities, for example, whether the payment apps will snatch the personal information on your mobile phones (like contact lists) so as to avoid any leakage of sensitive security information to third parties. Besides, you should regularly check your transaction record to see if there is any irregularity.
You are advised to exercise extra caution when choosing SVFs during this period. Some services currently available in the market may not meet the licensing conditions and regulatory requirements of the HKMA. If an existing operator’s licence application is declined, it must cease to operate by November 2016 and users would be much affected.
The HKMA plans to launch a series of promotional and educational activities to raise public awareness of the new legislation including the transitional arrangements for licence applications, and risks involved in the use of SVFs.
Deputy Chief Executive
Hong Kong Monetary Authority
13 November 2015