Here, we would have to look at the circumstances of each case – whether, for example, the offshore internet bank advertised its services in the local Hong Kong press or accepted Hong Kong dollar deposits or refused to take deposits from a number of specified jurisdictions, but did not include Hong Kong among these. If we come across such cases of illegal advertisements targeted at Hong Kong, how would we deal with them? The easiest case would be where the bank itself is respectable and is based in an overseas location which is properly supervised. We could then write to the bank itself and to its supervisors to notify them of the advertising rules in Hong Kong, and request the bank either to comply with these rules or to add Hong Kong to the list of the jurisdictions from which it was not prepared to take deposits. If necessary, we would seek the cooperation of the home supervisor to enforce this request. It might also be necessary to supplement this with a reminder to local Internet Service Providers about the advertising rules in the Banking Ordinance and to seek their cooperation to block offending websites. The problem with this, however, is that the website in question may not actually be posted on the local ISP’s server – in which case, there may be little that the ISP can do. If the bank concerned is not respectable and it is based in an uncooperative jurisdiction, the situation would be more difficult to handle.
As you know, the second line establishes the control standards and monitors adherence to them, encompassing risk and compliance functions. Nevertheless, other areas, such as legal, human resources or tax, may also be included, in order to ensure that their expertise in these areas is considered by management. There is no one-size-fits-all approach for the division of tasks between both lines; but the identification, assessment, validation and reporting of risks and controls should certainly be clearly assigned in every organisation. As I mentioned before, it is very hard to measure these kind of risks precisely; nevertheless, banks should include qualitative and quantitative key risk indicators in their integrated management information system. To achieve this integration, all parties must speak the same language, which implies applying common taxonomies with clear definitions and indicators per type of risk. Last, but certainly not least, I wanted to emphasise the importance of having an adequate internal audit as the third line of defense. The role of internal audit is key to challenging the adequacy of the first two lines, underpinning the whole framework. Let me conclude. The losses experienced during the crisis and its aftermath should act as a powerful reminder that we cannot relax or lower the bar. There is no room for complacency if we want to avoid repeating past mistakes. In this regard, I wanted to convey a few messages today.