HKMA Banking Code of Conduct: Fair Customer Treatment and Product Sales Standards

The Hong Kong Monetary Authority (HKMA) has sharpened its supervisory focus on retail banking conduct. In December 2024, the HKMA issued a revised Banking Code of Conduct (the Code), which took full effect on 1 January 2025. This update is the most significant revision to the Code in a decade, directly responding to a series of enforcement actions and customer complaints involving mis-selling of complex investment products and inadequate handling of vulnerable customers. For any institution holding a banking licence under the Banking Ordinance (Cap. 155), compliance with this Code is no longer a matter of best practice—it is a supervisory expectation with direct implications for licence renewal and capital treatment. The HKMA’s 2024 Annual Report confirmed that conduct-related supervisory examinations increased by 40% compared to 2022, with a specific focus on product sales processes and fair treatment outcomes. This article sets out the key structural changes to the Code, the new standards for product sales, and the practical steps institutions must take to align their operations with the HKMA’s current expectations.

The Revised Code: Structural Shifts and Enforcement Mechanics

The revised Banking Code of Conduct operates as a set of supervisory principles, not a statute. The HKMA enforces it through its supervisory review process, which includes on-site examinations, thematic reviews, and the power to impose remedial actions under section 59 of the Banking Ordinance. The key structural shift in the 2025 version is the codification of the “Fair Treatment of Customers” principle as a standalone chapter.

The Fair Treatment of Customers Principle

The Code’s new Chapter 4, titled “Fair Treatment of Customers,” replaces the previous general reference to “fair dealing.” The HKMA circular of 23 December 2024 (Ref: B10/1C) explicitly states that this principle applies across the entire customer lifecycle: product design, marketing, sales, post-sale servicing, and complaint handling. An institution must demonstrate that its product design process considers the target customer’s financial sophistication, risk tolerance, and vulnerability. The HKMA’s 2023 Thematic Review on Retail Banking Sales Practices found that 15 out of 20 surveyed institutions had inadequate documentation to prove that product design had considered customer vulnerability factors. Under the new Code, this documentation gap is a direct compliance deficiency.

Enforcement and Remedial Powers

The HKMA does not impose fines directly under the Code. Instead, it uses the Code as a benchmark during its supervisory examinations. A finding of non-compliance can trigger a range of actions: a formal written warning, a direction to cease a specific sales practice, or a referral to the Securities and Futures Commission (SFC) if the product is a listed security or a collective investment scheme. The HKMA and SFC signed a revised Memorandum of Understanding in March 2024, which streamlines the referral process for cross-boundary conduct issues. For a licensed bank, a sustained pattern of Code violations can affect the HKMA’s assessment of the institution’s fitness and propriety under the Banking Ordinance, potentially leading to conditions on the licence.

Product Sales Standards: From Suitability to Outcome-Based Assessment

The most operationally demanding change in the 2025 Code is the shift from a “suitability” standard to an “outcome-based” assessment for product sales. The previous Code required that a product be “suitable” for the customer at the point of sale. The new Code requires the institution to demonstrate that the customer is likely to achieve a “fair outcome” from the product over its intended holding period.

The Outcome-Based Assessment Framework

The Code now mandates a documented assessment of the product’s likely performance under different market scenarios. An institution must produce a “Fair Outcome Statement” for each retail product sold to a non-professional customer. This statement must include: the product’s target return range under normal market conditions, the maximum realistic loss scenario, and the product’s liquidity profile—specifically, the conditions under which the customer cannot redeem the product before maturity. The HKMA’s 2024 Consultation Paper on the Code revision cited a case study involving a structured deposit product linked to a single stock index. The institution had sold the product to elderly customers without disclosing that the product’s capital protection was conditional on the index not falling more than 30% during the term. Under the new Code, that conditional capital protection must be explicitly stated in the Fair Outcome Statement, and the sales process must include a verbal confirmation from the customer that they understand the condition.

Sales Process Documentation and Verification

The Code requires that every retail product sale to a non-professional customer be recorded in a standardised format. The record must include: the customer’s financial needs analysis, the Fair Outcome Statement, the customer’s verbal or written acknowledgement of the product’s key risks, and the specific reason why this product, rather than an alternative product, was recommended. The HKMA’s 2023 Thematic Review found that 40% of sampled sales records did not contain a sufficient explanation of why the recommended product was more suitable than a comparable alternative. Under the revised Code, this omission is a red-flag finding during an examination. Institutions must now train their sales staff to document this comparative analysis as a standard step in the sales process.

Vulnerable Customer Identification and Support

The 2025 Code introduces a mandatory framework for identifying and supporting vulnerable customers. The HKMA defines a vulnerable customer as any individual who, due to age, mental capacity, language barrier, or financial literacy, is at a higher risk of suffering harm from a financial product or service. This definition is broader than the previous reference to “elderly customers” in the 2019 version of the Code.

Identification Triggers and Enhanced Safeguards

An institution must implement a documented process to identify vulnerable customers at the point of account opening and before any product sale. The Code provides a non-exhaustive list of identification triggers: a customer aged 70 or above, a customer who requests a product in a language that is not their primary language, a customer who demonstrates difficulty understanding the product’s key terms during an explanation, or a customer who is accompanied by a third party who appears to be exerting influence. When a vulnerable customer is identified, the institution must apply enhanced safeguards: a mandatory cooling-off period of at least seven calendar days for all investment products, a requirement for a second staff member to witness the sales conversation, and a prohibition on selling any product with a lock-up period exceeding 12 months unless a senior manager approved the sale in writing.

Third-Party Intermediary Responsibility

The Code extends these obligations to sales conducted through third-party intermediaries, such as insurance brokers or referral agents. An institution that uses a third-party intermediary to sell its products must ensure that the intermediary’s staff are trained on the vulnerable customer identification process. The HKMA’s 2024 circular on third-party risk management (Ref: B10/2C) requires that the institution conduct an annual audit of its intermediaries’ compliance with the Code. If an intermediary is found to have sold a product to a vulnerable customer without applying the enhanced safeguards, the institution must report the incident to the HKMA within five business days.

Complaint Handling and Remediation

The Code’s complaint handling requirements have been strengthened to align with the HKMA’s expectation of proactive remediation. The previous Code required that complaints be handled within 30 business days. The 2025 Code reduces this timeline to 20 business days for all complaints involving potential financial loss or mis-selling.

Root Cause Analysis and Systemic Remediation

An institution must conduct a root cause analysis for any complaint that results in a financial remedy to the customer. The analysis must identify whether the complaint is an isolated incident or indicative of a systemic issue in a product, a sales channel, or a specific branch. If the analysis identifies a systemic issue, the institution must submit a remediation plan to the HKMA within 10 business days. The plan must include: the number of potentially affected customers, the method for identifying them, the proposed remedy, and a timeline for implementation. The HKMA’s 2024 Annual Report noted that it had directed six institutions to conduct retrospective reviews of product sales after receiving a pattern of similar complaints. Under the new Code, this direction is now a standard supervisory response.

Customer Compensation and Goodwill Payments

The Code does not prescribe a specific formula for compensation. Instead, it requires that the institution calculate the customer’s loss based on the difference between the product’s actual performance and the outcome that would have been reasonably expected based on the Fair Outcome Statement. If the Fair Outcome Statement was not provided to the customer, the institution must assume that the customer expected the product to perform in line with the institution’s own internal projections. This presumption creates a strong incentive for institutions to ensure that Fair Outcome Statements are accurate and provided to every customer.

Actionable Takeaways

• Review your institution’s product design process to ensure it includes a documented assessment of the target customer’s vulnerability factors, as required by the HKMA’s 2025 Banking Code of Conduct Chapter 4.
• Implement a standardised Fair Outcome Statement for every retail product sold to a non-professional customer, including the product’s target return range, maximum realistic loss scenario, and liquidity conditions.
• Train all sales staff on the new vulnerable customer identification triggers and enhanced safeguards, including the mandatory seven-day cooling-off period for investment products sold to vulnerable customers.
• Reduce your complaint handling timeline to 20 business days for all complaints involving potential financial loss or mis-selling, and establish a root cause analysis process for any complaint that results in a financial remedy.
• Conduct an annual audit of any third-party intermediary used to sell your products, ensuring their staff are trained on the vulnerable customer identification process and that all sales records meet the Code’s documentation standards.

This does not constitute legal advice. Consult a solicitor for your specific case.