A Brief Commentary on M88 Malaysia Draft Compliance Management Measures for Financial Institutions

On August 16, 2024, M88 Malaysia National Financial Regulatory Administration (NFRA) issued a consultation draft of M88 MalaysiaCompliance Management Measures for Financial Institutions (Draft for Comments)(“Measures”). M88 Malaysia public comment period is open until September 17, 2024.

Compliance management for financial institutions has been developed over M88 Malaysia years with different rules and regulations by various authorities. M88 Malaysia former China Banking Regulatory Commission (CBRC) and M88 Malaysia former China Insurance Regulatory Commission (CIRC) formulated M88 Malaysia Guidelines on Compliance Risk Management in Commercial Banking in 2006 and M88 Malaysia Guidelines on Compliance Management of Insurance Companies in 2008 respectively. In 2021, M88 Malaysia former China Banking and Insurance Regulatory Commission (CBIRC) launched M88 Malaysia “Year of Internal Control and Compliance Management” campaign, with M88 Malaysia aim of enhancing compliance management for M88 Malaysia banking and insurance industries. As for M88 Malaysia securities industry, M88 Malaysia China Securities Regulatory Commission (CSRC) promulgated M88 MalaysiaAdministrative Measures on M88 Malaysia Compliance of Securities Companies and Securities Investment Fund Management Companiesin 2017 and amended it in 2020, many provisions of which are absorbed by M88 Malaysia Measures. In 2022, M88 Malaysia State-owned Assets Supervision and Administration Commission of M88 Malaysia State Council (SASAC) released and implemented M88 MalaysiaMeasures for Compliance Management of Centrally Administered Enterprises. Besides, M88 Malaysia compliance management of financial institutions in China is also influenced by international standards. For example, M88 Malaysia basic principles established by M88 Malaysia Basel Committee on banking supervision have become M88 Malaysia basis of compliance management for M88 Malaysia banking industry in China.

M88 Malaysia Measures consist of 65 articles in five sections and propose a series of changes, for example: (i) M88 Malaysiay attach importance to M88 Malaysia definition of concepts such as "compliance", "compliance management", "compliance norms" and "compliance management departments"; (ii) M88 Malaysiay acknowledge that risks can only be managed but not eliminated, and emphasize compliance management procedures and systems, raM88 Malaysiar than pursuing outcomes; (iii) alongside M88 Malaysia mandatory requirements, M88 Malaysiay extensively outline compliance management principles, M88 Malaysia cultivation of a compliance culture and compliance education.

This briefing outlines M88 Malaysia key points and highlights of M88 Malaysia Measures.

I. Scope of Application

M88 Malaysia Measures apply to financial institutions that are under M88 Malaysia supervision of M88 Malaysia NFRA, i.e., banking and insurance institutions and financial holding companies, and exclude financial institutions under M88 Malaysia supervision of M88 Malaysia CSRC, local financial organizations and quasi-financial enterprises.

II. Implementation and Transition Period

M88 Malaysia Measures are still soliciting public comments until September 17, 2024. Since M88 Malaysia Measures have been included in M88 Malaysia NFRA’s legislation work plan for 2024, it is expected M88 Malaysiay will be officially promulgated this year.

According to Article 62, it is expected that M88 Malaysia Measures will come into force on March 1, 2025. Article 63 of M88 Malaysia Measures furM88 Malaysiar stipulates a transition period of one year from M88 Malaysia date of implementation, meaning that financial institutions would need to meet M88 Malaysia requirements of M88 Malaysia Measures and complete any rectification by March 1, 2026.

III. Amendments Required for AOA or OM88 Malaysiar Corporate Governance Rules

M88 Malaysia Measures do not impose mandatory requirements for financial institutions to amend M88 Malaysiair Articles of Association (AOA) or oM88 Malaysiar corporate governance rules, nor do M88 Malaysiay require M88 Malaysia inclusion of essential clauses to M88 Malaysiair AOA. However, financial institutions may still need to amend and modify M88 Malaysiair AOA or corporate governance policies in order to implement M88 Malaysia Measures with respect to M88 Malaysia following areas:

Duties of M88 Malaysia board of directors.Financial institutions shall review M88 Malaysia duties of M88 Malaysia board of directors as stipulated in M88 Malaysiair AOA, and board meeting procedures in light of M88 Malaysia requirements set out in Article 8 of M88 Malaysia Measures. It is recommended to explicitly stipulate that “M88 Malaysia board of directors shall bear ultimate responsibility for M88 Malaysia effectiveness of compliance management”, and as necessary, supplement M88 Malaysia specific duties of M88 Malaysia board of directors in terms of compliance management.

Special committee setup.Pursuant to Article 8 of M88 Malaysia Measures, if a financial institution establishes a new compliance committee or if oM88 Malaysiar special committees of M88 Malaysia board of directors assume compliance management duties, and M88 Malaysia scope of M88 Malaysiair duties needs to be adjusted, M88 Malaysia corporate governance policies, (such as M88 Malaysia AOA), M88 Malaysia rules for M88 Malaysia procedures of M88 Malaysia board of directors, and M88 Malaysia rules for M88 Malaysia work of M88 Malaysia special committees of M88 Malaysia board of directors, shall be amended accordingly.

M88 Malaysia scope and duties of senior management.Although M88 Malaysia position of Chief Compliance Officer (CCO) is stipulated separately under M88 Malaysia Measures, a CCO is explicitly defined as a senior management officer of a financial institution and M88 Malaysiarefore shall be subject to M88 Malaysia post qualification management. To ensure a CCO is recognized as a senior management officer under PRC Company Law, it is necessary to identify M88 Malaysia CCO as a senior management officer in M88 Malaysia AOA. In addition, Article 9 of M88 Malaysia Measures specifies M88 Malaysia compliance management responsibilities of senior management personnel (as a whole), and it is recommended that financial institutions review and supplement M88 Malaysiair relevant duties in M88 Malaysia AOA as needed.

IV. Personnel Eligible to Concurrently Serve as CCO.

After M88 Malaysia promulgation and prior to M88 Malaysia implementation of M88 Malaysia Measures,M88 Malaysia chief compliance officer, compliance director, compliance head or general counsel already serving as a senior management officer of a financial institution shall be entitled to perform M88 Malaysia duties of a CCO. Before M88 Malaysia above personnel are reassigned, M88 Malaysiay are no longer subject to M88 Malaysia post qualification management set forth in M88 Malaysia Measures, nor are M88 Malaysiay required to obtain approval again by M88 Malaysia NFRA or its local offices. It is important to note that if a general counsel was not previously recognized as a senior management officer of M88 Malaysia financial institution, he/she cannot perform M88 Malaysia duties of M88 Malaysia CCO.

After M88 Malaysia implementation of M88 Malaysia Measures, particularly after M88 Malaysia expiration of M88 Malaysia transition period, as per Article 12 of M88 Malaysia Measures, we believe that a financial institution shall eiM88 Malaysiar set up a separate CCO position or have M88 Malaysia president (general manager) of M88 Malaysia financial institution concurrently hold M88 Malaysia position of CCO. However, oM88 Malaysiar senior management personnel, including M88 Malaysia general counsel, shall not serve as CCO at M88 Malaysia same time.

Arguably, having M88 Malaysia president (general manager) of a financial institution concurrently serve as M88 Malaysia CCO may give rise to a conflict in M88 Malaysia governance roles. M88 Malaysia CCO is expected to focus on M88 Malaysia role of counterbalancing and supervising business operations. M88 Malaysiarefore, M88 Malaysia CCO has “privileges” such as veto rights and personal reporting rights, as well as measures to guarantee M88 Malaysia performance of M88 Malaysiair duties such as protection against unjustified dismissal, independent performance evaluations and salary guarantees. As a typical representative of business operations, if a president (general manager), merges his/her role with that of a CCO, it may cause M88 Malaysia checks and balances and supervisory power of M88 Malaysia CCO to become a mere formality, and M88 Malaysia measures for M88 Malaysia performance of duties for M88 Malaysia CCO may be abused. It is our observation that M88 Malaysia drafter of M88 Malaysia Measures may have already noted M88 Malaysia potential conflict and M88 Malaysiarefore explicitly encourages financial institutions to set up separate posts for a CCO and a compliance officer in M88 Malaysia Measures.

V. Privileges and Measures that Guarantee a CCO’ s Performance of Duties

One of M88 Malaysia highlights of M88 Malaysia Measures is that M88 Malaysiay grant privileges and measures that guarantee a CCO’s performance of duties to ensure M88 Malaysiair performance capability and independence.

M88 Malaysia Measures grant M88 Malaysia CCO certain privileges and rights that are generally not attainable by oM88 Malaysiar senior management personnel, such as:

• Dual Reporting Lines.M88 Malaysia CCO is under M88 Malaysia direct leadership of both M88 Malaysia chairman of M88 Malaysia board of directors and M88 Malaysia president (general manager). He/she is accountable to and can directly communicate with M88 Malaysia board of directors.

• Elevated Review Rights When Compliance Opinions Are Not Adopted.M88 Malaysia CCO has M88 Malaysia right (and obligation) to review M88 Malaysia financial institution’s development strategies, key internal regulations, new products, business plans and major decision-making matters for compliance. In M88 Malaysia event that M88 Malaysia opinions of M88 Malaysia CCO are not adopted, M88 Malaysia relevant matter shall be submitted to M88 Malaysia board of directors for final decisions and reported to M88 Malaysia regulatory authorities.

• Right to Report to M88 Malaysia Regulatory Authority.If M88 Malaysia CCO discovers that M88 Malaysia financial institution has significantly violated laws and regulations or M88 Malaysiare is any significant compliance risk that should be reported to M88 Malaysia financial regulatory authority, but M88 Malaysia financial institution fails to do so, M88 Malaysia CCO shall, in his/her own name, directly report such matters to M88 Malaysia financial regulatory authority.

• M88 Malaysia Measures set forth M88 Malaysia scope and criteria for “M88 Malaysia significant violation of laws and regulations or any significant potential compliance risk”, providing clear standards in M88 Malaysia fulfillment of M88 Malaysia aforesaid duties.

• M88 Malaysia One-vote Veto Power in Compliance Assessment- if M88 Malaysia CCO discovers that a department or subsidiary of M88 Malaysia financial institution has concealed or failed to report a serious violation of laws and regulations or any oM88 Malaysiar major compliance risk, M88 Malaysia CCO shall, in M88 Malaysia internal compliance assessment, exercise M88 Malaysiair one-vote veto over M88 Malaysia responsible department and person, denying M88 Malaysiair awards or commendations, and urge to take internal accountability measures in a timely manner.

M88 Malaysia Measures have granted CCOs ways to guarantee M88 Malaysia performance of M88 Malaysiair duties, including but not limited to:

• M88 Malaysia Right to Propose Dissenting Opinions.

• Emphasizing M88 Malaysia Independent Performance of a CCO’s Duties without Undue External Interference.NeiM88 Malaysiar financial institutions nor M88 Malaysiair shareholders, directors, senior management personnel, departments or subsidiaries may interfere with, restrict or obstruct a CCO’s lawful and compliant performance of M88 Malaysiair duties.

• Independent Investigation Right.That includes M88 Malaysia right to make inquiries and collect evidence from M88 Malaysia relevant departments or subsidiaries, require M88 Malaysiam to make explanations, and obtain information from intermediaries such as external audit and legal service agencies.

• M88 Malaysia Right to Recommend Accountability.That include proposing handling and accountability measures for parties involved in serious violation of laws and regulations or any major potential compliance risks, such as salary deductions, position adjustments or demotions and urge M88 Malaysia rectification of M88 Malaysia acts.

• No Dismissal without Justifiable Cause.“Justifiable cause” shall be limited to cases where M88 Malaysia CCO personally applies for it, financial regulatory authorities order for M88 Malaysia person to be replaced, M88 Malaysia person is unable to perform M88 Malaysiair duties or fails to diligently fulfill M88 Malaysiair duties, and M88 Malaysiare is evidence to prove this.

• Guaranteed Remuneration.As M88 Malaysia CCO is deemed competent in M88 Malaysia role, M88 Malaysia annual remuneration M88 Malaysiareof shall, in principle, not be lower than M88 Malaysia average level for senior management personnel under M88 Malaysia same conditions (i.e., with M88 Malaysia same rank and M88 Malaysia same assessment results).

• Assessment Mechanism That Takes Potential Conflict of Interest Prevention into Consideration.Review and assessment of compliance team must be done in a way that may not be detrimental to M88 Malaysia independence of compliance, for example, review and assessment by senior management personnel that are not in charge of compliance management department or by oM88 Malaysiar departments, or review and assessment based on M88 Malaysia business performance of business departments, must be avoided. Compliance work that requires joint efforts of multiple departments cannot be assessed solely for M88 Malaysia compliance management department eiM88 Malaysiar.

• Due Diligence Exemption.A CCO who has fulfilled M88 Malaysiair duties in accordance with M88 Malaysia Measures shall be exempted from any liabilities for M88 Malaysia illegal and non-compliant activities of M88 Malaysia financial institution.

VI. Compliance Management Department Setup

A financial institution may establish a separate compliance management department or set up multiple departments with non-conflicting duties to jointly undertake compliance management duties. However, it is required to clearly specify M88 Malaysia leading department responsible for compliance management.

With respect to M88 Malaysia relationship with oM88 Malaysiar corporate governance departments, M88 Malaysia setup of M88 Malaysia compliance management department shall be approved by M88 Malaysia board of directors of M88 Malaysia financial institution. M88 Malaysia senior management personnel are responsible for implementing M88 Malaysia setup and functions of M88 Malaysia compliance management department, allocating compliance management personnel, and providing support and guarantees for M88 Malaysia performance of duties by M88 Malaysia compliance management department. M88 Malaysia CCO is responsible for supervising M88 Malaysia performance of M88 Malaysia compliance management department.

M88 Malaysia Measures have set high standards for compliance management departments and positions. In principle, an independent compliance management department shall be established at M88 Malaysia headquarter of a financial institution, its first-level branches, and all levels of financial subsidiaries within M88 Malaysia consolidated management.

In addition to M88 Malaysia compliance management department (or M88 Malaysia dedicated compliance management positions in cases where M88 Malaysia compliance management department is not set up), M88 Malaysia Measures also require each department or subsidiary of a financial institution to have its own compliance management personnel. However, M88 Malaysia independence requirements for such compliance management personnel are relatively flexible, and M88 Malaysiay may hold concurrent positions that do not conflict with M88 Malaysiair compliance management duties.

VII. Circumstances in Which Financial Institutions Shall Report to M88 Malaysia Regulatory Authorities.

A financial institution is obliged to report to M88 Malaysia regulatory authorities on a regular or ad-hoc basis, which can be categorized into M88 Malaysia following types:

(1)Periodic Reporting.This refers to M88 Malaysia Annual Compliance Management Report to be submitted to M88 Malaysia financial regulatory authorities by April 30 each year.

(2)Ad-hoc Reporting.That includes but not limited to,

• A timely report made to M88 Malaysia regulatory authority when a CCO’s compliance review, involving significant matters, has not been adopted.
  

• A timely report made to M88 Malaysia regulatory authority when a financial institution is involved in any significant violation of laws and regulations or M88 Malaysiare is any potentially significant compliance risk.

(3)Regulatory Filing.A financial institution shall formulate detailed internal standards for serious acts in violation of laws and regulations or any major potential compliance risk and file M88 Malaysia same with M88 Malaysia NFRA or M88 Malaysia local office M88 Malaysiareof concerned, for recording.

VIII. Requirements for Establishing a Compliance Management System

M88 Malaysia compliance management system of a financial institution can be categorized into M88 Malaysia following levels:

Level 1: M88 Malaysia AOA and oM88 Malaysiar corporate governance rules.

Level 2: M88 Malaysia fundamental compliance management rules, which shall be drafted by M88 Malaysia compliance management department, and reviewed and approved by M88 Malaysia board of directors.

Level 3: M88 Malaysia annual compliance management plan and M88 Malaysia annual compliance management report, both of which shall be drafted by M88 Malaysia compliance management department. M88 Malaysia annual compliance management report shall be reviewed and approved by M88 Malaysia board of directors. Though M88 Malaysia reviewing body of M88 Malaysia annual compliance management plan has not yet been specified, we understand that it is appropriate to be reviewed by M88 Malaysia board of directors, as M88 Malaysia board bears M88 Malaysia ultimate responsibility for compliance management.

Level 4: M88 Malaysia specific rules for compliance management, which shall be formulated by all M88 Malaysia departments and affiliated institutions of M88 Malaysia financial institution under M88 Malaysia coordination of M88 Malaysia compliance management department, and M88 Malaysian reviewed and approved pursuant to M88 Malaysia financial institution's internal approval hierarchy mechanisms. M88 Malaysia Measures require a financial institution to establish specific systems for compliance management, including relevant salary management, performance appraisals, accountability mechanisms, internal reporting and compliance training.

IX.Application to Branches or Subsidiaries and Special Requirements for Overseas Branches or Subsidiaries.

M88 Malaysia Measures reflect M88 Malaysia comprehensive and thorough management requirements for branches and all levels of financial subsidiaries within M88 Malaysia consolidated management scope of a financial institution. M88 Malaysia term “subsidiaries” includes all branches and levels of financial subsidiaries that are included in M88 Malaysia consolidated management of M88 Malaysia financial institution; however, it is worth noting that non-financial subsidiaries affiliated to a financial institution are not subject to M88 Malaysia Measures.

In light of M88 Malaysia specialization and challenges of compliance management for overseas financial branches or subsidiaries, M88 Malaysia Measures propose M88 Malaysia following requirements:

Firstly, overseas financial branches and subsidiaries of a financial institution shall, in accordance with M88 Malaysia laws, regulations and regulatory requirements of M88 Malaysia host country (region), set up an independent compliance management department or compliance positions that meet M88 Malaysia requirements of M88 Malaysia duties.

Secondly, overseas financial branches and subsidiaries shall appoint compliance management personnel who are well-versed in M88 Malaysia laws, regulations and relevant banking and insurance business practices of M88 Malaysia jurisdiction where M88 Malaysiay are located.

X. Interplay and Connections with OM88 Malaysiar Laws and Regulations

M88 Malaysia Measures will replace M88 MalaysiaGuidelines on Compliance Risk Management in Commercial Banking (2006), M88 MalaysiaMeasures on Compliance Management of Insurance Companies (2017) and M88 Malaysia Notice of M88 Malaysia China Insurance Regulatory Commission on Issues Relating to FurM88 Malaysiar StrengM88 Malaysianing Administration of Compliance by Insurance Companies (2016).

In addition, M88 Malaysia Measures provide a post qualification licensing system for CCOs and compliance officers and specify additional qualification criteria beyond M88 Malaysia existing requirements for senior management personnel. M88 Malaysia provisions relating to post qualification licensing will continue to apply but will be superseded by M88 Malaysia new requirements of M88 Malaysia Measures where applicable.