The correct answer is that the analyst must be removed from any involvement in the credit rating process for that specific entity. The Code of Conduct for Persons Providing Credit Rating Services (CRA Code) places a strong emphasis on the independence and objectivity of credit rating agencies. A situation where an analyst, or their close family member (such as a spouse), has a direct financial interest in a rated entity constitutes a significant actual or potential conflict of interest. The CRA Code requires firms to have procedures to identify and either eliminate, or manage and disclose, such conflicts. In this case, the most appropriate and effective measure to uphold the integrity and objectivity of the rating process is to eliminate the conflict by removing the compromised individual from the assignment. Merely disclosing the conflict in the final report is insufficient as it does not address the potential for bias in the analysis itself. While a secondary review adds a layer of oversight, it does not remove the initial conflict of interest that could taint the primary analysis. Instructing the analyst to have their spouse sell the shares is not the CRA’s primary responsibility; the firm’s duty is to manage its own internal controls and personnel assignments to prevent such conflicts from impacting its work.

This question tests the understanding of a licensed corporation’s obligations under the Personal Data (Privacy) Ordinance (PDPO) regarding transparency and data access, particularly when data is collected for multiple purposes including compliance with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO).

Statement I is correct. Under the PDPO, a data subject has the right to be informed of the kind of personal data held by a data user. This is a fundamental aspect of data transparency.

Statement II is correct. A data user must inform the data subject of the main purposes for which the data is or is to be used. In this scenario, this would include account operation and fulfilling statutory CDD obligations under AMLO. This is typically done via a Personal Information Collection Statement (PICS) at the time of data collection.

Statement III is incorrect. While the PDPO contains exemptions to data access rights, for example, if granting access would likely prejudice the prevention or detection of crime, a firm cannot issue a blanket refusal to provide access to all data collected for CDD purposes. The right of access is a core principle, and any refusal must be justified under specific exemption provisions of the PDPO, not a general claim of ‘regulatory confidentiality’. The client retains the right to request access.

Statement IV is incorrect. The primary obligation to provide information and handle data access requests lies with the data user (the firm). A data subject should approach the firm directly. The Privacy Commissioner for Personal Data (PCPD) serves as a regulator and a channel for complaints if the data user fails to comply with its obligations, not as a mandatory first point of contact for the data subject to exercise their rights. Therefore, statements I and II are correct.

According to the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission, a licensed corporation has a duty to report certain events to the SFC. Senior management, under General Principle 9, is primarily responsible for ensuring the firm adheres to these procedures.

Statement I describes a breach of an investment restriction specified in a fund’s offering documents. This constitutes a material breach of rules applicable to the licensed corporation and must be reported to the SFC, even if it was rectified quickly.

Statement II describes a situation where there is a reasonable suspicion that a client has engaged in market misconduct (insider dealing) under the Securities and Futures Ordinance (SFO). Licensed corporations are required to report any suspected material breach of the market misconduct provisions by their clients.

Statement III describes a minor, temporary IT issue that did not materially impact the business, its clients, or the market. The reporting requirement is for material problems with business systems or equipment. A brief internal server outage with no client impact would generally not meet this materiality threshold.

Statement IV describes a disciplinary action taken against a part of the licensed corporation’s group by another recognised regulator (the UK’s FCA). Such disciplinary actions must be reported to the SFC. Therefore, statements I, II and IV are correct.

Under the Interpretation and General Clauses Ordinance (Cap. 1), specifically Section 113C and Schedule 8, a mechanism exists to ensure that statutory fines maintain their deterrent value over time. Statement I is correct because the Chief Executive in Council is explicitly granted the power to amend the monetary amounts of fines to reflect his opinion on the effect of inflation. Statement II is also correct as this power is exercised by making a regulation to amend the amounts set out in the relevant schedule (Schedule 8), which categorises fines into different levels. Statement III is incorrect; this adjustment is made through subsidiary legislation (a regulation by the Chief Executive in Council), not by passing a new primary ordinance in the Legislative Council, which would be a much more cumbersome process for routine inflation adjustments. Statement IV is incorrect because the power to adjust fines explicitly excludes certain types, known as ‘excluded fines’. These include daily fines, daily penalties, and certain fixed penalties under other specific ordinances, meaning the power is not universally applicable to all penalties. Therefore, statements I and II are correct.

The correct answer is that the SFC is empowered to appoint an independent auditor to examine the licensed corporation’s records. Under section 159 of the Securities and Futures Ordinance (SFO), the SFC has the authority to appoint an auditor if it has reasonable cause to believe that a licensed corporation has failed to comply with the Financial Resources Rules (FRR). This is a direct supervisory power that allows the SFC to independently verify the financial standing and compliance of a firm without needing to rely on the firm’s existing auditor or wait for a court order. While suspending a license is a possible regulatory action, it is a more severe step and not the specific power related to auditing in this context. The SFC’s power is not limited to instructing the firm’s current auditor; it can appoint its own choice of auditor to ensure impartiality. Filing a complaint with a professional body against the auditor is a separate process related to professional misconduct and does not represent the SFC’s direct power to investigate the licensed corporation itself.

The Securities and Futures Ordinance (SFO) has extraterritorial effect concerning market misconduct. Specifically, Part XIII and Part XIV of the SFO apply to any market misconduct that takes place in Hong Kong, as well as conduct outside Hong Kong that affects securities or futures traded on Hong Kong’s markets. Therefore, the MMT has jurisdiction over an individual in Singapore manipulating a Hong Kong-listed stock. Statement I is correct. The MMT is a civil tribunal and applies the civil standard of proof, which is the ‘balance of probabilities’, not the criminal standard of ‘beyond a reasonable doubt’. Therefore, statement II is incorrect. Under section 257 of the SFO, one of the orders the MMT can make against a person identified as having engaged in market misconduct is a ‘cold shoulder order’, which prohibits the person from dealing in any securities, futures contracts, or leveraged foreign exchange contracts in Hong Kong for a period of up to five years. Therefore, statement III is correct. While the MMT can order the disgorgement of any profit gained or loss avoided to the Government, it does not have the power to order direct compensation to be paid to investors who suffered losses. Aggrieved investors must pursue compensation through separate civil proceedings under section 281 of the SFO. Therefore, statements I and III are correct.

The correct answer is that the CRA must place all affected ratings under observation and review them as soon as possible, but no later than six months after the change. According to the SFC’s Code of Conduct for Persons Providing Credit Rating Services, when a CRA introduces changes to its rating methodologies, models, or key assumptions, these changes must be applied to both new and existing ratings. The Code specifies that all ratings affected by such changes should be reviewed as soon as possible and, in any case, within six months. During the interim period before the review is completed, the CRA is required to place the affected ratings under observation. Simply withdrawing all ratings is an overly drastic measure not mandated by the code. Applying the new methodology only to future ratings and grandfathering existing ones is explicitly incorrect, as the code requires consistent application to all ratings. Announcing the change and waiting for the next scheduled annual review is also insufficient, as it ignores the specific six-month deadline and the requirement to place the rating under observation.

Statement I is incorrect. According to the Code of Conduct for Persons Providing Credit Rating Services, a Credit Rating Agency (CRA) must keep its records for at least seven years, not five. Statement II is correct. A CRA is required to submit its financial statements and auditor’s report to the SFC not later than four months after the end of its financial year, unless a reasonable excuse exists. Statement III is correct. The Securities and Futures Ordinance grants the SFC the power to appoint an auditor to examine a CRA if it has reasonable cause to believe the CRA has not complied with the Financial Resources Rules (FRR) or has failed to submit its required annual reports. Statement IV is incorrect. The appointment of an auditor is a mandatory requirement for a licensed CRA, not merely a recommended best practice. Therefore, statements II and III are correct.

The correct answer is that the corporation must notify the SFC in writing of the situation within one business day. According to the Securities and Futures (Financial Resources) Rules, a licensed corporation is required to notify the Securities and Futures Commission (SFC) in writing within one business day if its liquid capital falls below 120% of its required liquid capital. This is an early warning mechanism that allows the SFC to monitor the financial stability of the firm. Ceasing all regulated activities is a more drastic measure required only if the liquid capital falls below 100% of the required amount. While a remediation plan might be requested by the SFC later, the immediate obligation is notification, not the submission of a plan within a specific timeframe. Taking no action is a direct breach of the rules, as the 120% threshold is a specific trigger for regulatory reporting, even though the firm is not yet in a state of liquid capital deficit (i.e., below 100%).

The Code of Conduct for Persons Providing Credit Rating Services (the ‘CRA Code’) requires Credit Rating Agencies (CRAs) and their representatives to maintain independence and objectivity in substance and appearance. Statement I describes a direct business relationship between the CRA and an affiliate of the rated entity, which creates a potential conflict of interest that could compromise the CRA’s objectivity. Statement II highlights a close personal relationship between a key analyst and an employee of the rated entity. Even if the employee is in a junior role, this situation can create a perception of a conflict of interest, which the CRA Code explicitly requires firms to manage to maintain the appearance of independence. Statement III illustrates a clear breach of objectivity where commercial interests (securing future business) are suggested as a factor in determining a rating, which is strictly prohibited. Statement IV, concerning a past internship at a competitor, does not create a direct conflict of interest with respect to the rated entity, Dynamic Holdings. The potential conflict would relate to the competitor, not a bias in favour of Dynamic Holdings. Therefore, statements I, II and III are correct.

This question assesses understanding of a licensed corporation’s obligations regarding ongoing monitoring, record-keeping, and suspicious transaction reporting under Hong Kong’s AML/CFT regime. Statement I is correct because the obligation to report a suspicion rests with the individual who forms it; they must report it internally to the Money Laundering Reporting Officer (MLRO). Statement IV is correct as a fundamental principle of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (GAML) is that ongoing monitoring should detect activities inconsistent with a customer’s known profile. Statement II is incorrect because, while customer identification records are kept for six years after the business relationship ends, transaction records must be kept for six years from the completion of the transaction itself, irrespective of the relationship’s status. Statement III is incorrect because contacting the client directly about a suspicion before an internal review and decision to report is made could constitute ‘tipping off’, which is a serious offence. The first step is internal escalation. Therefore, statements I and IV are correct.

According to the Securities and Futures (Accounts and Audit) Rules, an auditor’s report for a licensed corporation must contain specific opinions. These include a statement on whether the financial statements provide a true and fair view, whether they align with the records kept under the Keeping of Records Rules, whether there appear to have been any contraventions of the Financial Resources Rules (FRR), and critically, whether the FRR returns have been compiled correctly from the corporation’s records. The correct answer is an opinion on the correct compilation of the FRR returns, as this is one of the explicit requirements. An opinion on the effectiveness of internal controls, while related to a general audit, is not one of the specific opinions mandated by the Accounts and Audit Rules for this report. Similarly, while an auditor obtains management representations, this is an audit procedure, not a formal opinion expressed in the final report. An assessment of the firm’s compliance with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance is outside the specific scope of the four opinions required by the Accounts and Audit Rules, even though auditors have broader responsibilities regarding illegal acts.

The Code of Conduct for Persons Providing Credit Rating Services (the ‘CRA Code’) establishes strict rules to manage conflicts of interest and ensure the objectivity of the rating process. Statement I is a violation because the CRA Code explicitly prohibits compensating or evaluating a representative based on the amount of revenue the CRA derives from the entities that the representative rates. This is to prevent financial incentives from compromising analytical independence. Statement II is a conflict of interest because the prohibition on owning securities of a rated entity or its related entities extends to the representative’s immediate relations, which includes a spouse. This is to avoid any perception that personal financial interests could influence the rating. Statement III is a breach because representatives directly involved in the rating process are not permitted to initiate or participate in discussions about fees or payments with any entity they rate, to maintain a clear separation between analytical and commercial activities. Statement IV is a violation because representatives are prohibited from accepting gifts exceeding a minimal monetary value from any entity with which the CRA does business. Accepting a luxury watch clearly falls outside this de minimis exception. Therefore, all of the above statements are correct.

Statement I is correct. The Securities and Futures Commission (SFC) is an independent statutory body established under the Securities and Futures Ordinance (SFO), not a government department. Statement II is incorrect. The initial licensing of intermediaries, including credit rating agencies (Type 10 regulated activity), is handled by the SFC’s Licensing Department, not the Enforcement Division. The ongoing supervision is correctly identified as being under the Intermediaries Supervision Department. Statement III is correct. The Hong Kong Monetary Authority (HKMA) is involved in the regulatory regime for credit rating services because Authorized Financial Institutions (AFIs), which are regulated by the HKMA, may conduct Type 10 regulated activity. Statement IV is correct. An intermediary, such as an investment adviser licensed for Type 4 regulated activity, who uses a credit rating to assist a client is considered a user of the rating. They are not expressing the credit rating opinion themselves and therefore do not need to be licensed for Type 10 regulated activity. Therefore, statements I, III and IV are correct.

This question assesses understanding of the auditor’s obligations upon resignation and the SFC’s subsequent powers under the Securities and Futures Ordinance (SFO). Statement I is correct as per s. 157 of the SFO, which mandates that an auditor who resigns or does not seek reappointment must notify the SFC in writing within one business day, providing reasons. Statement II is correct based on s. 158 of the SFO, which grants immunity to an auditor who communicates with the SFC in good faith, protecting them from liability for any breach of duty. Statement III is also correct. Under s. 159 of the SFO, the SFC is empowered to appoint an auditor if it has reasonable cause to believe a licensed corporation has failed to comply with any prescribed requirement, which includes the Keeping of Records Rules. Statement IV is incorrect because s. 162 of the SFO grants extensive powers to an SFC-appointed auditor, including the authority to examine officers, employees, and agents of the licensed corporation on oath. Therefore, statements I, II and III are correct.

The correct answer is that the firm must obtain a license from the Securities and Futures Commission (SFC) for engaging in the regulated activity of ‘providing credit rating services’ as stipulated under the Securities and Futures Ordinance (SFO). In Hong Kong, providing credit rating services is defined as a specific regulated activity (Type 10) under the SFO. Consequently, any corporation carrying on this activity must be licensed by the SFC, which is the primary regulator for the securities and futures markets, including the activities of Credit Rating Agencies (CRAs). While the Hong Kong Monetary Authority (HKMA) is a key financial regulator, its primary role is the supervision of authorized institutions (i.e., banks), not CRAs. Although the SFC’s CRA Code is based on the IOSCO Code of Conduct Fundamentals, simple self-certification of compliance with the international standard is not sufficient; a formal license from the SFC is a mandatory legal requirement. A general business registration is necessary for any business in Hong Kong but does not grant the authority to conduct a regulated activity, which requires specific approval and ongoing supervision by the SFC.

The correct answer is that the AFI must be registered with the SFC to conduct Type 10 regulated activity. Under the Securities and Futures Ordinance (SFO), there is a specific regulatory pathway for Authorised Financial Institutions (AFIs), such as banks, that are primarily supervised by the Hong Kong Monetary Authority (HKMA). When an AFI wishes to engage in an activity regulated by the SFO, such as providing credit rating services (Type 10), it does not obtain a license in the same way a standalone corporation would. Instead, it must become a ‘registered institution’ with the Securities and Futures Commission (SFC). This creates a system of joint regulation where the HKMA remains the front-line supervisor of the institution, while the SFC oversees its SFO-regulated activities. Obtaining a Type 10 license is the requirement for a corporation that is not an AFI. Relying solely on HKMA approval is incorrect because the SFO explicitly grants the SFC authority over regulated activities, necessitating registration. While establishing a separate subsidiary is a possible business structure, it is not a mandatory regulatory requirement; the AFI itself can conduct the activity once it is duly registered with the SFC.

This question assesses the understanding of the core objectives of operational controls and risk management for a licensed corporation under the SFC’s regulatory framework. Statement I is correct as it directly addresses the objective of maintaining proper, reliable, and accurate records, as well as ensuring adequate information exchange with clients. Statement II is correct because establishing a risk committee is a fundamental component of a risk management framework, designed to identify, manage, and report on risks to senior management. Statement III is correct as it describes a crucial control to manage conflicts of interest and prevent the misuse of confidential, price-sensitive information, which is a key guideline for operational controls. Statement IV, however, describes a business performance target, not a regulatory control objective. While performance is important, setting mandatory outperformance targets is a commercial goal and can potentially conflict with the objective of proper risk management by encouraging excessive risk-taking. Therefore, statements I, II and III are correct.

The correct answer is that the firm must establish its own code of conduct containing written policies to ensure compliance with the CRA Code and disclose this code publicly on its website. Part 4 of the Code of Conduct for Persons Providing Credit Rating Services (CRA Code) explicitly requires a licensed corporation or registered institution carrying on a Type 10 regulated activity (a CRA) to establish its own internal code of conduct. This ‘House Code’ must contain written policies and procedures designed to ensure the firm and its staff comply with the detailed provisions of the CRA Code. A key element of this requirement is transparency; the CRA must make this House Code publicly accessible by posting it on its home website. The idea that the internal code is a confidential document for internal and regulatory use only is incorrect, as public disclosure is a specific mandate aimed at promoting transparency and accountability. The assertion that the code requires pre-approval from the SFC before implementation is also incorrect; the responsibility lies with the CRA to ensure its code is compliant, and the SFC will assess this through its ongoing supervision, not a pre-approval process. Finally, suggesting the code should primarily focus on commercial aspects like fee structures and business development is wrong because the CRA Code mandates a comprehensive scope covering the integrity of the rating process, independence, conflicts of interest, and confidentiality, which are central to the firm’s regulatory obligations.

Under the Securities and Futures Ordinance (SFO), specific procedures and powers are in place regarding the auditors of licensed corporations. Statement I is correct as per section 157 of the SFO, which mandates that an auditor who ceases to act for a licensed corporation must notify the SFC in writing within one business day, providing reasons for the cessation. Statement II is correct based on section 159 of the SFO, which allows the SFC to appoint an auditor if it has reasonable cause to believe a licensed corporation has not complied with the Financial Resources Rules (FRR). Statement III is correct; section 162 of the SFO grants extensive powers to an SFC-appointed auditor, including the authority to examine officers of the corporation under oath. Statement IV is correct according to section 158 of the SFO, which provides statutory immunity to an auditor who communicates information to the SFC in good faith, protecting them from being held liable for any breach of duty. Therefore, all of the above statements are correct.

The correct answer is that the CRA must consider whether applying historical default rates to current products is appropriate or statistically valid. The Code of Conduct for Persons Providing Credit Rating Services (CRA Code) places a strong emphasis on ensuring that information provided by CRAs is not misleading. When publishing historical performance data, such as default rates, a CRA must be cautious. If the nature of the financial products being rated has changed, or if the underlying data has evolved in a way that makes past performance an unreliable indicator, simply presenting the historical figures without context or qualification could be misleading to investors. The core obligation is to assess the appropriateness and statistical validity of applying historical data to the present context. The other options are incorrect. While providing sufficient information about loss and cash-flow analysis is a requirement for ratings of structured finance products, it is a separate disclosure obligation from the principle of not publishing misleading historical performance data. The primary concern here is the validity of the historical data itself. The idea of only publishing data that shows a consistent or improving trend is a direct violation of the principles of objectivity and transparency; CRAs must present a fair and balanced view of their ratings’ performance. Finally, differentiating rating symbols for structured finance products is a key requirement to avoid investor confusion, but it addresses the clarity of the rating itself, not the separate issue of ensuring that historical performance statistics are presented in a non-misleading manner.

The correct answer is that the firm must have and employ effectively the resources and procedures needed for the proper performance of its business activities. This is a core tenet of General Principle 3 (Capabilities) of the SFC Code of Conduct. The scenario describes a clear discrepancy between the services advertised in the client agreement (a sophisticated, algorithm-based system) and the firm’s actual operational capabilities (manual spreadsheet analysis). This misrepresentation is a direct failure to employ the necessary resources and procedures for the business it claims to be conducting. The firm is misdescribing its services, which is inconsistent with its obligations. The other options are incorrect because the primary issue is not about the segregation of client assets, which deals with safeguarding funds and securities. Nor is it about avoiding conflicts of interest, as the scenario does not describe a situation where the firm’s interests are competing with a client’s. Finally, while this situation could lead to a failure to act in the best interests of clients, the root cause of the breach is the fundamental lack of capability to deliver the promised service.

The correct answer is that the primary regulatory objective of publicizing disciplinary actions is to enhance market transparency and accountability, allowing the investing public to make informed decisions about intermediaries. The Securities and Futures Ordinance (SFO) and associated rules, such as the Information Rules, empower the SFC to maintain a public register of disciplinary actions. This practice aligns with core corporate governance principles like transparency and accountability, as highlighted by the OECD. By making this information accessible, the SFC helps investors assess the compliance history and integrity of a licensed firm before engaging their services, which in turn fosters public confidence and market discipline. The other options are incorrect. While public disclosure does act as a deterrent and has a punitive effect, its main regulatory purpose is not solely to penalize senior management but to protect the investing public and uphold market standards. The register is explicitly public, not a confidential record for other regulators, so describing it as such is inaccurate. Finally, the SFC’s mandate is regulatory enforcement and market protection, not revenue generation; fines collected are a consequence of breaches, not the reason for publicizing them.

The correct answer is that the model introduces a direct conflict of interest, potentially impairing the analyst’s objectivity and the independence of the rating. The Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission, specifically the provisions applicable to Credit Rating Agencies (CRAs), strictly prohibits remuneration and evaluation practices that could compromise the independence and objectivity of the credit rating process. Linking an analyst’s compensation directly to the fees generated by a specific entity they rate creates a clear financial incentive for the analyst to provide a more favourable rating than might be warranted. This is done to ensure the client remains satisfied, continues the business relationship, and pays the fees, which in turn boosts the analyst’s bonus. This practice fundamentally undermines the integrity and reliability of the credit rating, which is the primary regulatory concern. While the structure could lead to inconsistent application of rating methodologies, this is a symptom of the underlying conflict of interest, not the root problem itself. The issue of creating an unfair compensation system between staff is an internal human resources matter and not the principal regulatory concern for the SFC, whose focus is on market integrity. Finally, while client confidentiality is important, it is a separate issue; the core flaw of this compensation model is its inherent threat to objectivity, even if confidentiality were perfectly maintained.

Under Section 129 of the Securities and Futures Ordinance (SFO), the Securities and Futures Commission (SFC) must be satisfied that a licence applicant is fit and proper. This assessment covers the applicant corporation and its key personnel. Statement I is correct because the SFC requires disclosure of any involvement by proposed management (like a Responsible Officer) in a business that has been subject to investigation for misconduct, as this is relevant to their integrity and competence. Statement II is correct as the applicant’s business plan, financial position, and capital structure are fundamental for the SFC to assess the firm’s viability and ability to conduct regulated activities competently and without undue risk. Statement IV is correct because appointing and identifying a Complaints Officer is a mandatory requirement, ensuring a proper channel for dispute resolution is in place from the outset. Statement III is incorrect; while a business plan should describe the target client base, providing a specific list of prospective clients is not a standard requirement for the initial licence application and is considered commercially sensitive operational data rather than a core fitness and properness criterion. Therefore, statements I, II and IV are correct.

Under the Securities and Futures (Accounts and Audit) Rules, a licensed corporation is required to submit its audited financial statements and the auditor’s report to the SFC. Statement I is correct as Section 156(1) of the Securities and Futures Ordinance (SFO) mandates that these documents must be lodged with the SFC within four months after the end of the corporation’s financial year. Statement II is also correct; the submission must include both the audited accounts (such as the balance sheet and profit and loss account) and the auditor’s report on those accounts. Statement III is correct because failure to comply with this submission requirement without a reasonable excuse constitutes an offence under Section 156(6) of the SFO, for which the licensed corporation and its responsible officers or directors may be held liable. Statement IV is incorrect; while a licensed corporation can apply to the SFC for an extension of the submission deadline, such extensions are not granted automatically. The SFC assesses each application on its merits and requires a valid justification for the delay. There is no provision for an automatic extension. Therefore, statements I, II and III are correct.

Statement I is correct. A primary objective of Hong Kong’s regulatory regime for Credit Rating Agencies (CRAs), introduced in 2011, was to align with international best practices, particularly the principles set out by the International Organization of Securities Commissions (IOSCO). This harmonisation helps ensure that credit ratings issued by SFC-licensed CRAs in Hong Kong are recognised and can be used in other major financial markets, such as the European Union, which has its own stringent regulatory requirements. Statement II is correct. Under the Securities and Futures Ordinance (SFO), ‘providing credit rating services’ is defined as a specific type of regulated activity, namely Type 10. Any entity carrying on a business of this activity in Hong Kong must be licensed by the Securities and Futures Commission (SFC) for Type 10 regulated activity. Statement III is correct. The SFC’s regulatory oversight for licensed corporations, including CRAs, is comprehensive. It is not limited to their core business function (i.e., the rating process) but extends to the overall operational and corporate governance framework. This is enforced through the Code of Conduct for Persons Licensed by or Registered with the SFC and the Internal Control Guidelines, which mandate robust systems for management and supervision, information management (including data privacy under the PDPO), and overall compliance. Statement IV is incorrect. While the concept of civil liability for CRAs is a significant international development, the specific provision for a statutory right for investors to claim damages for grossly negligent ratings was introduced in the European Union. The Hong Kong Securities and Futures Ordinance does not contain an equivalent explicit statutory civil liability regime for CRAs. Any liability in Hong Kong would more likely be determined under common law principles of negligence. Therefore, statements I, II and III are correct.

The correct answer is that the CRA must immediately remove the analyst from any participation in the credit rating process and reassign the duties. The Code of Conduct for Persons Providing Credit Rating Services, issued by the Securities and Futures Commission (SFC), places a high priority on the independence and objectivity of the rating process. A direct financial interest, such as a substantial equity holding by a lead analyst in the entity being rated, constitutes a significant conflict of interest. The primary regulatory expectation is to eliminate this conflict from the rating process to maintain its integrity. Simply disclosing the conflict in the final report is insufficient, as the potential bias could have already compromised the analysis and the resulting rating. Requiring the analyst to sell their shares, while a good practice for resolving the conflict for the future, does not address the immediate need to ensure the current rating process is untainted; removal is the most direct and appropriate action. Reporting the matter to the SFC is a separate compliance obligation and does not replace the CRA’s immediate responsibility to manage the conflict internally to protect the integrity of its ratings.

The correct answer is that the Market Misconduct Tribunal (MMT) has jurisdiction because the misconduct affected securities listed in Hong Kong, and it can impose orders such as a ‘cold shoulder order’. The Securities and Futures Ordinance (SFO) has extra-territorial effect. Specifically, for market misconduct provisions, the SFO applies if the misconduct occurs in Hong Kong OR if it occurs outside Hong Kong but affects securities or futures traded on a recognized market in Hong Kong. In this scenario, the ‘pump and dump’ scheme directly impacted a stock listed on the Stock Exchange of Hong Kong, granting the SFC and MMT jurisdiction regardless of the perpetrator’s physical location in London. The MMT has a range of orders it can impose, including the ‘cold shoulder order’ which prohibits a person from trading on Hong Kong’s markets for up to five years. One incorrect option suggests the MMT lacks jurisdiction because the individual was outside Hong Kong; this is false due to the SFO’s extra-territorial reach. Another incorrect option incorrectly limits the MMT’s role to recommending prosecution in the UK; the MMT conducts its own civil proceedings and imposes its own sanctions, separate from criminal matters or foreign jurisdictions. The final incorrect option wrongly claims the MMT cannot issue trading prohibitions on foreign nationals; the MMT’s orders, such as the ‘cold shoulder order’, apply to any person identified as having engaged in market misconduct, irrespective of their nationality or location.

According to the SFC’s Code of Conduct for Persons Providing Credit Rating Services, a Credit Rating Agency (CRA) must establish and maintain written internal procedures and mechanisms. The purpose of these is to identify, and subsequently eliminate, or manage and disclose, any actual or potential conflicts of interest. This applies to conflicts that could influence the ratings themselves or the judgment of the analysts involved. When a CRA operates an ancillary business, such as advisory services, that serves a client also seeking a rating, a clear potential conflict of interest arises. The primary regulatory obligation is to have a system that first identifies this conflict and then ensures a proper disclosure is made. The disclosure must be timely, complete, clear, concise, specific, and prominent, allowing users of the rating to understand the context and potential for bias. While assigning a separate analytical team is a good internal practice for managing the conflict, it is a component of the overall process and does not replace the fundamental requirement of identification and public disclosure. An absolute requirement to cease the ancillary business relationship is not mandated; the code allows for management and disclosure as an alternative to elimination. Relying on the separation of business units is insufficient, as the conflict of interest is assessed at the level of the licensed CRA as a whole.