Hong Kong: Stop The "Rolling Bad Apples": Mandatory Reference Checking In The Banking Sector

The introduction of mandatory reference checking requirements aims to curb the ability of bank employees holding specified positions who have engaged in misconduct at one bank moving to another bank, known as "rolling bad apples", without disclosing their past wrongdoing.

After a year of preparation, the Hong Kong Monetary Authority (HKMA) launched Phase 1 of the Mandatory Reference Checking (MRC) Scheme on 2 May 2023 to tackle "rolling bad apples". In short, the MRC Scheme establishes a framework requiring Authorised Institutions (AIs) to request and provide references about employees at various seniority levels and areas of responsibility. This article provides an overview of the MRC Scheme, explores potential legal issues the MRC Scheme may give rise to, and offers suggestions to AIs on navigating the new waters.

Background

In May 2020, the HKMA issued a consultation paper to address the "rolling bad apples" phenomenon in the banking sector. In its consultation conclusions paper on the MRC Scheme published on 3 May 2021, the HKMA stated that respondents to the consultation supported the implementation of the MRC Scheme with respect to employment in specified positions. On the practical side, the respondents were in favour of a phased implementation approach.

On 5 May 2022, the HKMA issued a circular on the MRC Scheme. It announced that the MRC Scheme will apply to all AIs and would be implemented by phases. Phase 1 will cover a narrower scope of personnel. After gathering experience and feedback about its implementation, the MRC Scheme will be expanded to Phase 2 to cover more personnel. Following a 12 month preparatory period, AIs were required to implement Phase 1 of the MRC Scheme by 2 May 2023.

MRC Scheme at a glance

The MRC Scheme requires AIs recruiting (Recruiting AI) for certain specified positions that fall within the scope of the MRC Scheme to approach the former and current AI employers of a prospective employee (Reference Providing AI) to request conduct-related information about the prospective employee.

A Reference Providing AI must report the following conduct information about a prospective employee to a Recruiting AI:

1. breach of legal or regulatory requirements;
   
   
2. incidents which cast doubt on an individual's honesty and integrity;
   
   
3. misconduct reports filed with the HKMA;
   
   
4. internal or external disciplinary actions arising from conduct matters; and
   
   
5. ongoing internal investigations.

A Recruiting AI should request this information using a standard template. After receiving the request, the Reference Providing AI has one month to respond. If the Reference Providing AI encounters genuine difficulties and is unlikely to be able to meet the deadline, it should provide an interim reply to the Recruiting AI before the expiry of the one-month period. The interim reply should set out the reasons for the longer time required and an estimated timeframe for providing a response. The Recruiting AI is deemed to have discharged its obligations if it has not heard from the Reference Providing AI after one month or the period of time mutually agreed. Where the Recruiting AI receives negative information about a prospective employee, it should in general, on the ground of fairness, provide that prospective employee an opportunity to be heard in response to the negative information about him/her.

The HKMA emphasised that a Reference Providing AI should report any misconduct information that is deemed serious or material in nature, even where the Reference Providing AI did not terminate the prospective employee for misconduct. While a Recruiting AI retains the discretion in employment and remains responsible for its employment decisions, it should document the reasons for employing a prospective employee if it opts to employ him/her after receiving negative or inconclusive information from the Reference Providing AI.

Phase 1 of the MRC Scheme commenced on 2 May 2023. The HKMA will review the progress of Phase 1 by mid-2025, two years after its implementation. Another round of consultation will likely be conducted in conjunction with the Phase 1 review before the implementation of Phase 2. At this stage, there is no set date for the implementation of Phase 2.

Phase 1 applies to the following categories of individuals:

1. directors approved under section 71 of the Banking Ordinance (BO);
   
   
2. chief executives and alternate chief executives approved under section 71 of the BO;
   
   
3. managers notified to the HKMA under section 72B of the BO;
   
   
4. executive officers approved under section 71C of the BO;
   
   
5. responsible officers (ROs) approved by the Insurance Authority (IA) under section 64ZE of the Insurance Ordinance (IO); and
   
   
6. ROs approved by the Mandatory Provident Fund Schemes Authority (MPFA) under section 34W of the Mandatory Provident Fund Schemes Ordinance (MPFSO).

It is proposed that Phase 2 will expand the MRC Scheme to cover staff licenced or registered to carry out regulated activities under the Securities and Futures Ordinance (SFO), IO and MPFSO.

Legal issues arising out of employment references

Providing references

Under Hong Kong common law, employers have a duty to take reasonable care to ensure the information a reference contains is true, accurate and fair. The author of a reference must take reasonable care to ensure that the reference is not misleading either by reason of what is left out of the reference, or by including facts which, although viewed discretely might be accurate, none the less either through nuance or innuendo generate a misleading picture when considered overall (Bartholomew v London Borough of Hackney [1998] EWCA Civ 1604). In the past, the court has found employers liable when they have failed to prepare references with reasonable care and, employees suffered damage as a result (see Spring v Guardian Assurance [1995] 2 AC 296). If a reference is to include allegation(s) against the employee that has not been investigated, the employer must make this clear (Jackson v Liverpool City Council [2011] EWCA Civ 1068).

Therefore, Reference Providing AIs must take reasonable care in ensuring that the information they provide under the MRC Scheme is true, accurate and fair, in order to avoid a potential claim being brought against them. Given a negative or inconclusive reference will likely reduce an employee's ability to secure a job, there may be heightened risk an affected individual will challenge the reference.

In the more recent case of Hincks v Sense Network Ltd [2018] EWHC 533 (QB) (Hincks) that concerns an employer giving a negative reference in light of an internal investigation against its former employee, an independent financial adviser, the England and Wales High Court summarised the common features of the employer's duties as follows:

1. to conduct an objective and rigorous appraisal of facts and opinion, particularly negative opinion, whether those facts and opinions emerge from earlier investigations or otherwise;
   
   
2. to take reasonable care to be satisfied that the facts set out in the reference are accurate and true and that, where an opinion is expressed, there is a proper and legitimate basis for the opinion;
   
   
3. where an opinion is derived from an earlier investigation, to take reasonable care in considering and reviewing the underlying material so that the reference writer is able to understand the basis for the opinion and be satisfied that there is a proper and legitimate basis for the opinion;
   
   
4. to take reasonable care to ensure that the reference is fair in the sense of not being misleading either by reason of what is not included or by implication, nuance or innuendo.

Nevertheless, the England and Wales High Court held in Hincks that employers are not under a duty to examine the procedural fairness of the underlying investigation unless the relevant documents prompt such inquiry.

Therefore, Reference Providing AIs are reminded that while they need not to examine the procedural fairness of every internal investigation they provide information on, they should take reasonable care that the reference they give contain true and accurate facts, and where an opinion is provided, that opinion is provided with a proper and legitimate basis.

Secrecy

Reference Providing AIs may also need to consider their other duties and obligations when deciding the content of their references. Secrecy obligations in legislation such as the BO and SFO require persons assisting in certain statutory enquiries or investigations to preserve secrecy over such enquiries or investigations. Breaching the secrecy provisions can give rise to criminal liability. Thus, a Reference Providing AI should check that none of the conduct information they are obliged to provide about a prospective employee is subject to the statutory secrecy requirements and, if it is, to seek consent from the regulator concerned to the disclosure it intends to make in compliance with the terms of the MRC Scheme.

Data privacy

While the Privacy Commissioner for Personal Data acknowledges the need for the MRC Scheme, she has raised concerns and suggested AIs handle personal data with care when implementing the MRC Scheme. AIs should pay attention to, among others, the following areas.

Data Protection Principle (DPP) 1(3) requires data users to take all practicable steps to ensure that data subjects are informed as to the purpose their data will be used for, and to whom they may be transferred to. Thus, Reference Providing AIs should inform their employees, perhaps in a personal information collection statement, what type of personal data would be collected and how would they be used, including the transfer of data to Recruiting AIs for compliance with the MRC Scheme.

Data accuracy is essential from the perspective of personal data privacy. Therefore, Reference Providing AIs should take all practicable steps to maintain the accuracy of the data about their former and current employees.

In line with the DPPs and Personal Data (Privacy) Ordinance, which provide data subjects a right to request correction of inaccurate personal data, both Recruiting and Reference Providing AIs should implement measures and have policies and procedures in place to ensure that they can comply with a data correction request. In other words, they should allow the individual concerned to respond to a negative reference about him/her.

Both Recruiting and Reference Providing AIs should put in place adequate security measures to ensure that the relevant data is securely kept and transmitted.

Looking ahead

HKMA has stated that, although it did not introduce the MRC Scheme as a supervisory requirement, it attaches "great importance" to the MRC Scheme's implementation. In particular, it considers that repeated failures of an AI to comply with the MRC Scheme may indicate "potential weaknesses" with its governance. The regulator stated that it would "monitor AIs' observance of the MRC Scheme during its ongoing supervisory efforts and may initiate follow-up actions" as appropriate. Therefore, it is anticipated that AIs will receive enquiries from the HKMA in the coming months to check on compliance with the terms of the MRC Scheme. To prepare adequately for the HKMA's focus on this scheme, AIs are encouraged to familiarise themselves with the relevant guidelines issued by the Hong Kong Association of Banks and DTC Association and seek legal advice where necessary.

Originally published by Banking Today.

Visit us at mayerbrown.com

Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the "Mayer Brown Practices"). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC ("PKWN") is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. "Mayer Brown" and the Mayer Brown logo are the trademarks of Mayer Brown.

© Copyright 2023. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.