Management Summary
- Purpose / Background: The HKMA and Insurance Authority (IA) are jointly launching a cross-sector reference checking arrangement to curb the "rolling bad apples" phenomenon, where individuals with misconduct histories move between the banking and insurance sectors without disclosure. This initiative integrates existing sector-specific schemes (Banking MRC Scheme and Insurance RC Scheme) to ensure more informed hiring decisions across the financial services industry.
- One-line conclusion: Effective 1 July 2026, relevant AIs and insurance entities must perform cross-sector conduct-related reference checks for individuals engaged in long-term insurance business.
- Key Changes:
- Extension of reference checking to facilitate information exchange between banking and insurance entities.
- Mandatory compliance for "relevant AIs" (AIs licensed as insurance agencies) and insurance entities regarding long-term business staff.
- Standardized templates and protocols adopted from both the Banking and Insurance schemes to ensure compatibility.
- Requirement to cover conduct-related information for the seven years prior to the application.
- Implementation of a phased approach, starting with Phase 3A, with Phase 3B planned for future expansion.
- Key Dates / Deadlines:
- 1 July 2026: Phase 3A implementation date.
- End of 2026: Target for post-implementation review to inform Phase 3B.
- Applicability / Impact scope: All Authorized Institutions (AIs) acting as insurance agencies (relevant AIs) and all insurance entities (insurers, agencies, and broker companies) carrying on long-term insurance business.
- Recommended management actions:
- Update internal HR, recruitment, and compliance policies to incorporate the new cross-sector checking requirements.
- Review and update current reference-checking operational procedures and templates to ensure alignment with both Banking and Insurance scheme protocols.
- Brief hiring managers and HR personnel on the new scope and mandatory documentation requirements.
- Establish clear audit trails for all reference checks conducted to demonstrate compliance during regulatory reviews.
- Monitor internal systems to ensure they can manage information requests within the stipulated timelines (typically 15-30 days depending on the scheme).
Detailed Summary
1) Document overview
This circular announces the joint HKMA-IA "Cross-sector Reference Checking Arrangement," aimed at addressing misconduct portability between the banking and insurance sectors by formalizing information sharing. It builds upon existing sector-specific schemes (Banking MRC Phase 2 and Insurance RC Phase 2).
2) Main requirements
- Entities must verify the conduct history of prospective individuals who have been appointed by an entity in the *other* sector within the past seven years.
- "Relevant AIs" and insurance entities must act as both "requesting" and "providing" entities.
- Depending on the nature of the entity, references must be requested and provided using the protocols/templates specific to the regulatory scheme of the counterparty.
- Entities must maintain robust internal controls; systematic failure to perform these checks may be treated as a governance weakness by the regulators.
3) Key changes
- Inter-operability: Transition from siloed sector-checking to a cross-sector framework.
- Documentation: Hiring entities must use appropriate cross-sector templates to ensure the information provided is legally and procedurally compliant under the host sector’s rules.
4) Important dates & transition
- 1 July 2026: Phase 3A begins.
- Q4 2026: Post-implementation review.
- Post-2026: Phase 3B to expand coverage to all prospective individuals under the respective sector schemes.
5) Impact and risks
- Operational: Increased administrative burden on HR departments to coordinate across different regulatory templates.
- Compliance: Risk of regulatory scrutiny if reference checks are not performed or if responses are not provided within the specified timeframes.
- Data Privacy: Entities must ensure that the sharing of conduct-related information complies with relevant data protection laws (e.g., PDPO).
6) Compliance action checklist
- [ ] Identify all staff/candidates subject to Phase 3A (Technical Representatives).
- [ ] Align current HR systems with the cross-sector template requirements.
- [ ] Define internal escalation paths for negative reference findings.
- [ ] Update documentation archives for all incoming and outgoing staff candidates.
- [ ] Prepare for the end-of-year regulatory review by documenting implementation challenges.
7) Appendices/attachments summary
- Annex (Scope and High-Level Summary): Specifies that Phase 3A applies to "Relevant AIs" (AIs acting as insurance agencies) and insurance entities for long-term insurance business staff. It outlines a matrix for template usage, requiring entities to utilize the specific protocol of the reference-providing party to ensure valid conduct-related information exchange.