THE DATA

GAME
2019 GLOBAL BANK REVIEW
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

Contents

05 Welcome

06 Big data: where are we now?

10 Regulatory data: arrows for the quiver?

12 Global regulatory update

22 Are you prepared? The board’s role in crisis management

28 Virtual banks: the case for clearer regulatory guidance on outsourcing

34 Data vs “gut instinct”: analytics in dispute resolution

38 Regulatory creep or convergence? Competition law authorities as financial services

regulators

42 Data and cyber perils: personal exposure and inadequate insurance

46 Away from prying eyes: data security in international dispute resolution

50 IBOR transition: a data challenge

54 The emergence of the “super-regulator”: the lasting legacy of the Australian Banking
Royal Commission

//03
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

Welcome
Welcome to The Data Game, the third edition of our Global Bank Review.
This is a publication by our Global Banks Sector Group, which brings
together people at Herbert Smith Freehills from around the major financial
centres of the world who live and breathe banks.

The rapid growth of data is Boards are not the only ones dealing Hannah Cassidy
unquestionably one of the most with the brave new world of big data. Partner, Hong Kong
significant developments in the banking Regulators have also had to respond T +852 2101 4133
sector. Data has, quite literally, the ability and adapt to the new data environment. [email protected]
to change lives. The exponential growth Banks have felt the effects of that
in data and its uses are already making adaptation in a number of ways. The
their mark. The possibilities opened up data requests made by bank regulators Simon Clarke
by big data analytics, artificial intelligence have increased significantly and show no Partner, London
and other related issues are reshaping signs of abating. This is putting increased T +44 20 7466 2508
the industry. That being the case, we operational and compliance burdens [email protected]
are still only at the beginning of the data on banks which are already feeling the
journey and its impact in the next decade effects of more severe regulation in other
or two will be even more profound. areas. Regulators are also becoming Tony Damian
more thoughtful about their use of the Partner, Sydney
The changes that data and technology data supplied by banks, in analysing T +61 2 9225 5784
are driving include the emergence of bank and employee behaviour, again [email protected]
virtual banks. We examine banks in presenting fresh challenges.
the cloud and the regulatory issues
associated with the protection of The increased volume of requests and
customer data. different uses to which data is put are
the only ways in which regulators are
Within this world of new possibilities responding. What is also emerging is a
also exists a world of new challenges. revised regulatory landscape addressing
The Data Game also explores the role of the new big data environment. Our global
the board and the new operational risks regulatory update covers these changes
associated with data and cyber incidents. across the United States, the UK, Greater
Approaches vary in this area, and the China, Australia, France, Germany and
work of regulators, as well as what has the UAE.
happened in practice, suggest that in
many cases more needs to be done by In this time of unparalleled change, and
boards to meet these challenges. The on behalf of the Global Banks Sector
increased risks also raise interesting Group, we hope you enjoy reading
questions in relation to corporate and The Data Game.
personal insurance, another important
topic which we have covered.

//05
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Big data: where are we now?

With the rapid growth of big data now unstoppable, financial institutions face an inherent
tension between maximising the value of data as an asset and ensuring they remain
compliant with growing legal and regulatory obligations.

Over 18 million texts, 188 million emails What is big data?

and 500,000 tweets are currently being
In simple terms, big data refers to large
sent every minute in 2019.1 By 2020, it is
and complex datasets. Gartner, a leading
estimated that 1.7MB of data will be created
IT research and advisory company, defines
every second for every person on earth2
big data further as data that contains:
and many industry sectors have begun
capitalising on the opportunities that this ••greater variety (eg text, image, 2019 EVERY MINUTE
will bring. The banking sector has long been video, sound); OF EVERY DAY
at the forefront of investing in financial
••arriving in increasing volumes; and with
technologies (fintech), and will account for
nearly 14% of worldwide big data analytics ••ever-higher velocity (the fast rate at
(BDA) revenue this year.3 The International which the data is received and potentially
Data Corporation (IDC) forecasts worldwide analysed in real time).
revenue for BDA solutions to reach US$189 AMERICANS USE
Big data also encompasses the technology
4.4M GB
billion this year which will continue to grow
to an estimated US$274 billion by 2022.4 by which these aggregated datasets are
analysed by software such as machine
OF INTERNET DATA
Big data can also present operational learning, algorithmic computation and
challenges, with financial institutions often artificial intelligence.
reliant upon legacy IT systems and struggling
to implement capabilities to capture and Banks and other financial institutions have
utilise big data effectively. Despite these
issues, big data has the potential to enable
access to extensive amounts of data
through the use of digital trading platforms. 188M
EMAILS SENT
banks to streamline their businesses, and These platforms process millions of trades
provide more customer-centric services. and transactions daily, and capture
Gaining a clearer understanding of the risks customer data through each interaction
and legal framework surrounding big data with the bank (eg products sold, online and
will aid financial institutions in implementing
the appropriate governance structures and
mobile transactions and processes used to
deliver those products). 18.1M
TEXTS SENT
strategies to maximise the value of the data
they hold. Moving in the right direction
Today, banks employ BDA solutions for
a range of business needs, including the

390,030
detection and prevention of fraud; customer
and call centre efficiencies; customer
profiling, targeting and optimisation of APPS DOWNLOADED
cross-selling, and risk assessments. In a
report carried out in 2016, Central Banking
revealed that work in big data could be
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

//07
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

considered a mainstream activity for However, whilst there are no ownership

central banks, with over half of their survey rights in data, there are extensive rights and
respondents working on a big data project.5 obligations that arise in relation to data.
These rights and obligations, which mainly
In 2017, JPMorgan Chase introduced the arise through regulation are constantly
LOXM equity trading algorithm, an AI developing. One interesting development
program that analyses data from billions relates to the interaction between data and
2019 EVERY MINUTE
of historic trades in order to execute future competition law. The competition OF EVERY DAY
trades with increased speed and optimal authorities are taking an increasing interest
prices. In his annual letter to shareholders in data and its potential to be collected
this year, Jamie Dimon, the chairman and and/or used to anti-competitive effect. NETFLIX STREAMS

694,444
CEO, also introduced a new AI project, For example, regulators are looking at one
DeepX, which “leverages machine learning
potential type of abuse of dominance where
to assist [with] equities algorithms globally
access to a particular data set is essential to HRS OF VIDEO
to execute transactions across 1,300 stocks
enable competition in a downstream or
a day”6.
adjacent market. In addition, data sharing INSTAGRAM USERS POST

277,777
Citibank has also announced that it is arrangements which foreclose competitors
investing in big data technologies. Citi’s who are not permitted similar access are
Treasury and Trade Solutions entered into also at risk of regulatory scrutiny. STORIES
a strategic partnership with Feedzai, a
data science company that uses real-time
Ongoing regulatory scrutiny
YOUTUBE STREAMS

4.5M
machine learning and predictive modelling At the forefront of regulatory scrutiny is
to analyse big data to pinpoint fraudulent the Australian Competition and Consumer
behaviour. Citibank will integrate Feedzai’s Commission (ACCC) which is leading in VIDEOS
transaction monitoring platform into its the development and oversight of a new
own proprietary services and platform to “consumer data right” (CDR) scheme and TWITTER USERS SEND
increase its risk management for payment has recently published a report into
transactions7. digital platforms. Both of these projects
have involved collaboration with the
511,200 TWEETS
The legal framework Office of the Australian Information
Despite the myriad of potential benefits that Commissioner (OAIC).
SKYPE USERS MAKE
harnessing big data can bring, banks and
financial institutions must consider the legal
framework for big data to ensure they remain
The CDR scheme is being launched in the
banking sector (where it is also known as 231,840
compliant with their obligations. Not only are “open banking”) and is designed to facilitate CALLS

fines for non-compliance potentially huge competition and product innovation by

(under the General Data Protection allowing consumers to access their data AIRBNB BOOKS

1,389
Regulation (GDPR), organisations can be held by banks for potential sharing with
fined up to €20 million, or 4% annual global competitors. The regulatory framework will
turnover, whichever is greater), reputational include legislation, ACCC rules, OAIC RESERVATIONS
damage stemming from a misuse of guidelines, data standards and an
customer data can be severe. accreditation scheme for fintechs and others
UBER USERS TAKE
wishing to have access to CDR data. An
Ownership of data, from a legal standpoint,
is a difficult subject matter. The current
ACCC open banking survey found that of
60 respondents, 56 were interested in
9,772
RIDES
legal position in the UK is that there are no becoming accredited.
ownership rights (ie property rights) in raw
data. From an intellectual property (IP) The ACCC’s digital platforms inquiry TINDER USERS SWIPE

1.4M
perspective, it is also difficult to ensure proposed various reforms relating to
comprehensive protection. This perhaps competition and consumer law, alongside
results from the philosophy which significant reforms to take Australian TIMES
underpins IP rights (IPR), which is to create privacy law further in the direction of the
monopolies to reward and incentivise EU’s General Data Protection Regulation
GOOGLE CONDUCTS
creative effort, and protect against unfair EU’s GDPR (2016/679/EU), including in
advantage being taken of someone else’s
creation. Therefore, as data are simply
relation to consent and penalties. Most of
those reforms – if implemented – would not
4.5M
SEARCHES
pieces of information, there is no moral be limited to digital platforms and so the
incentive to restrict access or use. banking sector would also be affected.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

Another key focus of regulatory scrutiny for Another challenge currently facing Looking forward
the past couple of years has been privacy, organisations looking to use BDA to exploit
As well as focusing on complying with legal
and in particular, the GDPR. By now, their data commercially is the potential
obligations, banks should continue to invest
financial institutions will be familiar with the impact on the organisation’s brand and
in upgrading legacy IT frameworks and
GDPR in the EU (and beyond). The UK’s reputation. There is a groundswell of
internal governance systems to ensure data is
Information Commissioner’s Office has movement looking at the ethics behind data
being stored and employed coherently across
stressed that big data is one of its key processing and organisations should not be
the business. Not only will this help banks in
strategic focus areas,8 and to the extent afraid to consider whether or not they
assessing security risks and complying with
that the data being processed contains the should do something, just because they can.
legal obligations, but also in identifying what
personal data of an EU individual, banks will The recent Federal Trade Commission
data a bank holds to help drive decision
have to ensure that their activities comply (FTC) settlement with Facebook included an
making at the appropriate levels.
with their obligations under the GDPR. obligation to create an independent privacy
committee, and the concept of having a data Big data and technological advancements
Given the recent proliferation of privacy ethics committee within organisations is such as machine learning and AI, will only
laws around the world, including ever closer gaining traction. Technology is making the increase the ways in which banks can
steps towards a US federal privacy law, it is job of BDA easier but the focus is now capitalise on their data, and could create
clear that privacy is not just a European turning towards the use of technology and competitive advantage against the influx of
issue, creating global compliance BDA as a force for good. new financial services providers. However,
challenges for multinational organisations.
with the focus of regulators and legislators
Organisational challenges With the potential to across the world being trained on data, and
privacy in particular, banks also need to
Of key importance under both privacy and
cybersecurity laws are the obligations for
be one of the most ensure that they have the appropriate
controls and legal protections in place to
organisations to implement appropriate valuable assets within ensure that they can mitigate the risks that
technical and organisational measures to
ensure the security of data, which could
an organisation, it is the use of big data can bring.

involve a mix of administrative controls (eg important to have

employee training and internal policies),
technical controls (eg firewalls and appropriate security Miriam Everett
Partner, London
encryption methods) and physical controls
(eg appropriate authorisation for access to
in place to protect that T +44 20 7466 2378
[email protected]
the data). However, whilst securing data can asset from a commercial
present a challenge, it is important to note
that, for most organisations, there is a real perspective, aside Kaman Tsoi
commercial incentive to secure their data. from the regulatory Special Counsel, Melbourne
T +61 3 9288 1336
requirements. [email protected]

Erin Hwang
Associate, London
T +44 20 7466 6404
[email protected]

1. DOMO, Data Never Sleeps 7.0, www.domo.com/learn/data-never-sleeps-7

2. DOMO, Data Never Sleeps 6.0, www.domo.com/solution/data-never-sleeps-6
3. IDC, Worldwide Semiannual Big Data and Analytics Spending Guide 2018H1
4. IDC, Worldwide Semiannual Big Data and Analytics Spending Guide 2019
5. Central Banking, Big data in central banking: 2016 survey, November 2016, www.centralbanking.com/central-banking-journal/feature/2474825/
big-data-in-central-banking-2016-survey
6. Security Week, With $600 million cybersecurity budget, JPMorgan Chief Endorses AI and Cloud, www.securityweek.com/600-million-cybersecurity-
budget-jpmorgan-chief-endorses-ai-and-cloud
7. Citi Press Room, Citi Partners with Feedzai to Provide Machine Learning Payment Solutions, www.citibank.com/tts/about/press/2018/2018-1219.html
8. Information Commissioner’s Office, Technology Strategy 2018-2021, www.ico.org.uk/media/2258299/ico-technology-strategy-2018-2021.pdf //09
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Regulatory data:
arrows for the quiver?
It is clear that banking regulators globally are becoming increasingly more
demanding in relation to the volume and type of data provided to them, more
sophisticated in their use of that data and more willing to share that data with
other regulators, both inside and outside their national borders.

With over 200 regulators in the global banking sector, the powers, months prior to, or at any time after, an individual’s departure from a
approach and priorities of these regulators vary significantly from firm. The SFC has also recently announced the launch of a key risk
country to country. However, one common theme which permeates indicator (KRI) platform to collect and analyse data from 22 global
is their hunger for data about the firms and individuals they financial institutions which are considered as systemically important.
regulate. This focus on data has already had a significant impact on The surveys cover areas such as conduct risk (for example, the
certain types of enforcement actions, and is likely to significantly number of instances of certain types of non-compliance, client
affect regulatory reporting mechanisms in the future. Given this, it complaints, internal whistleblowing incidents, internal alerts,
is crucial that banks and their employees are cognisant of the ways disciplinary actions and regulatory involvement need to be disclosed).
in which regulators are using their data. The first submission of data is required by 31 January 2020 for the
reporting period ending 31 December 2019.
Demand for data
Regulators’ use of their compulsory information gathering powers
Unsurprisingly given our era of big data, regulators have in recent
in the context of possible enforcement action is often shrouded in
years started asking for ever increasing volumes of data. In
secrecy, which can complicate efforts to monitor trends in the use
particular, regulators’ demand for data has been steadily increasing
of such powers. However, the information which is publicly reported
not only in the context of potential or ongoing enforcement action,
suggests not only that there has been a general increase in the use
but as part of their ongoing “business as usual” supervisory
of such powers, but also the volume of data being produced in
activities. For example, the UK Financial Conduct Authority (FCA)
response to their use. The SFC, for example, has in 2019 reported a
has recently estimated that it receives over 500,000 regulatory
nearly 20% increase year on year in the number of compulsory
submissions annually through its data collection platform, across
requests for information issued to intermediaries regarding their
120,000 users and 52,000 firms,1 while both the Dodd-Frank Act in
clients’ transactions2. Further, ASIC Commissioner Cathie Armour
the US and MiFID II across the EU have significantly increased
has commented publicly that one ASIC investigation of market
reporting obligations for firms.
misconduct involved the review of over 75 million documents and
Importantly, this “business as usual” data increasingly includes data 2.7 million hours of voice recordings.
about the actions of individuals, as banks globally have seen regulators
Use of data
demand the disclosure of an increasing volume of information
regarding individual employees who might be potential “rolling bad Banking regulators’ increasing demands for reams of data regarding
apples”. The Australian Government, for example, appears set to the activities of regulated firms raises two key questions. First, is
implement by mid-2020 the Banking Royal Commission’s this data actually useful to regulators? And if so – how do they
recommendation that licensed firms be required to report “serious actually make use of it? The answers to these questions vary
compliance concerns” regarding individual financial advisers to the significantly across jurisdictions and the contexts in which
Australian Securities and Investments Commission (ASIC) on a regulators are seeking to put data to use.
quarterly basis. This follows the US example, where broker dealers
must upload to the US Financial Industry Regulatory Authority’s In the context of enforcement, for example, it is clear that taking a
BrokerCheck database (amongst other things) all customer data-driven approach has transformed the prosecution of insider
complaints and firm disciplinary events. dealing offences. Historically, it has been easy to predict the
catalysts for insider trading investigations – namely, unusual spikes
Similarly, in Hong Kong, (as discussed further in our Greater China in the prices of securities shortly prior to the disclosure of material
Global Regulatory Outlook), the Securities and Futures Commission non-public information. However, these sorts of “security based”
(SFC) now requires the disclosure of all internal investigations of investigations are generally reactive, in that they rely on (for
licensed individuals where those investigations take place within six example) large movements in a market being observed.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

In recent years, the US Securities and Exchange Commission’s these requests have come from more than 60 countries3. Similarly,
Market Abuse Unit has pioneered a “trader based” approach, under in 2017/2018 ASIC made 393 requests to international regulators,
which regulators instead start by analysing market data gathered and received 495 requests, which represented a 19% increase in
through surveillance to identify potentially suspicious traders, and outgoing requests and 22% increase in incoming requests
patterns of similar trades between groups of traders over a period compared to just two years earlier4.
of time. Once relationships between groups of traders have been
identified, regulators will then seek to identify potentially shared As such, firms should be conscious that the information disclosed
sources of inside information which may link the traders. This to one regulator may well be disclosed to other regulators around
change in approach, which has been emulated by the SFC and the globe, and ensure that a consistent approach to disclosure is
ASIC, has allowed for the identification of insider trading cases taken where appropriate, particularly in the context of self-reports
which may otherwise have gone undetected due to their of misconduct.
comparatively small size.
Hannah Cassidy
The jury is still out in relation to the use of data in a number of other Partner, Hong Kong
areas, with regulators such as the European Securities and Markets T +852 2101 4133
Authority (ESMA) noting that efforts to grapple efficiently with [email protected]
data through the use of data analytics is often thwarted by poorly
designed report formats and non-machine-readable data. Given
this, a number of regulators globally have begun to explore Tania Gray
“regtech” and “suptech” solutions, including machine learning and Partner, Sydney
natural language processing, to improve data analysis, while others T +61 2 9322 4733
such as the FCA and Bank of England are exploring ways to [email protected]
automate regulatory reporting processes and streamline the
accessibility of data. Ruth Overington
Partner, Melbourne
Data sharing T +61 3 9288 1946
Finally, it is worth noting that while demands for, and the use of, [email protected]
data by regulators is often conceptualised within national borders,
regulators are increasingly interconnected through memoranda of Emily Rumble
understanding and cooperation arrangements which allow for Associate, Hong Kong
information sharing. During 2018/19, for example, the FCA received T +852 2101 4225
approximately 1000 requests for information from overseas [email protected]
counterparts in relation to active investigations. In recent years,

1. FCA Press Release, New platform to replace Gabriel and improve the way we collect data from firms, 16 July 2019, www.fca.org.uk/news/news-stories/
new-platform-replace-gabriel-improve-collect-data
2. SFC, Quarterly Report April-June 2019, www.sfc.hk/web/EN/files/ER/Reports/QR/201904-06/EN/2e.%20Enforcement.pdf
3. FCA, Enforcement annual performance report 2017/18, www.fca.org.uk/publication/corporate/annual-report-2017-18-enforcement-performance.pdf
4. ASIC, Annual Report 2017-18, https://download.asic.gov.au/media/4922570/annual-report-2017-18-published-31-october-2018-full.pdf and ASIC,
Annual Report 2015-2016, https://download.asic.gov.au/media/4058626/asic-annual-report-2015-2016-complete.pdf //11
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Global regulatory update

The collection of data is not new—banks have been collecting data for
hundreds of years and it is one of the main tasks of governments.
While there has always been data, the future of the financial services
industry and the way in which data is perceived and used, has become
increasingly multifaceted, facilitated by technology.

In our tour of regulatory developments over the following pages, there are a
number of recurring themes: digital disruption and cybersecurity; tackling
“If cybersecurity and AML
money laundering; a focus on consumer protection; and culture, conduct can be seen as elements of
and individual accountability, all in relation to data.
the “defensive” position,
Firms and regulators are preoccupied with protecting data as a key digital
asset—whether customer data, financial data, data stores—and the use of then on the flip side is
data. Evidence of this preoccupation is the focus on cybersecurity and
anti-money laundering (AML) systems and controls. Under the broader
digital disruption”
mantle of operational resilience, cybersecurity sits at the top of firms’ and
regulators’ agendas, so it is unsurprising to see this feature significantly in
our updates. As the concept of “operational resilience” gains traction in
global regulatory forums and as technological development continues, it’s
likely to continue to feature predominantly over the coming decade.

If cybersecurity and AML can be seen as elements of the “defensive”

position, then on the flip side is digital disruption—how the players and
products in the market will change and develop through the use of
technology. Some traditional market participants may be feeling that they
face an existential threat if they don’t embrace technology advancements,
although BigTech faces its own challenges—not least from public opinion
and legislators—in advancing innovations into the marketplace.

Finally, it is easy to feel like big data and technology are moving us further
away from the individual, but, if anything, the risks we perceive are seeing
some response in the regulators’ continued focus on individual
accountability, conduct, culture, and consumer protection. For example,
with Artificial Intelligence (AI) being more realisable across industries, the
ethics of the technology and the individual, human responsibility for the
outcomes of AI decision making are a main feature of discussion. Open
Banking is opening up a new era of data-driven decision making, but also
poses challenges for the industry and regulators from the potential for
misuse of data to exploit customers to the temptation which large
concentrations of data present to malicious actors.

Looking ahead, we expect to see that balance in the regulatory

developments space of the quantitative elements of data and technology on
one side, and the qualitative elements of culture and individual
accountability on the other, continue.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

Spotlight on

Australia

The Royal Commission into Misconduct in the Banking, Beyond the changes to the law, there will also be substantial
Superannuation and Financial Services Industry has had changes in the way that banks are regulated. ASIC and APRA
significant effects on the regulation of banking in Australia and are building their data capability and will increasingly
these effects will continue into the foreseeable future. The incorporate the use of granular data to inform their supervision
Commissioner’s recommendations, and the government’s work. Banks and their executives should assume that there will
legislative agenda, will mean that depending on their business be a greater level of information flow between ASIC and APRA,
model, banks will face changes in areas including the regulation and this may change the dynamic in how banks have
of credit and its distribution, financial advice, and traditionally seen themselves as being regulated for prudential
superannuation. Additionally, the financial services regulators in supervision purposes.
Australia — the Australian Securities and Investments
Commission (ASIC) and the Australian Prudential Regulation The Royal Commission has seen the start of a series of law
Authority (APRA) — will have additional powers and mandates reforms which will have profound effects on the banking sector
to act as strong enforcers, as well as themselves undergoing for many years to come.
cultural change to reflect their new, toughened, roles.

There will be a number of key changes to the law which will be

made in the short-to-medium term, and these will impact the
business models of various banks. The Consumer Data Right
(CDR) will require the four major banks to start sharing
customer, account and transaction data from 1 February 2020,
Michael Vrisakis
which will create competitive challenges but also opportunities
Partner, Sydney
to streamline loan application processes. Credit distribution will
T +61 2 9322 4411
see the introduction of a “best interests” duty to require
[email protected]
mortgage brokers to act in the best interests of borrowers,
and over time the regulatory frameworks for mortgage brokers
will be aligned to those of financial advisers, and those advisers Steven Rice
will be subject to a new disciplinary body. Grandfathered Special Counsel, Sydney
conflicted remuneration will no longer be available to financial T +61 2 9225 5584
advisers. Industry codes will be able to enforced using [email protected]
court-based remedies.

Spotlight on

Greater China
Hong Kong’s multifaceted governance structures and senior management, likely leading to
enforcement actions against managers-in-charge (MICs) in the
approach in mitigating near future. Also on the horizon, we can expect to see the
misconduct risk outcomes of the Securities and Futures Commission (SFC)’s
thematic reviews on board governance and responsibilities of
In the coming year, we expect that Hong Kong regulators will
MICs, as well as specifically on risk governance and risk
continue their efforts to tackle the causes and consequences of
management MICs.
misconduct, as guided by the Financial Stability Board’s toolkit
published in April 2018.
Tackling “rolling bad apples”
Senior management accountability Enforcement actions are likely to increase as a result of the
implementation of strategic licensing reform by the SFC this
Since the implementation of senior management accountability
year, which aims to tackle the “rolling bad apples” phenomenon,
regimes over the past two years, Hong Kong regulators have
ie, the movement of individuals with a history of misconduct
collected considerably more detailed information about firms’
between firms with little or no consequences. Among other

//13
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Spotlight on Greater China, continued

things, the reform requires firms to provide the SFC with Hong Kong
significantly more detailed information about any internal
Hong Kong’s report card, received in September 2019, noted that
investigations conducted against departing licensed employees
Hong Kong has a sound legal regime to fight money laundering
within six months prior to, or at any time after, their departure.
(ML) and terrorist financing (TF) which is delivering good results.
This has prompted firms to update their internal processes to It understands its risks, has effective measures to combat TF and
broaden the scope of reporting and to clarify what should be to confiscate the proceeds of crime, and actively cooperates with
considered as an “internal investigation” for reporting purposes. international partners.
Individuals who have committed misconduct will likely find it more
The report, however, highlights that Hong Kong should (among
difficult to become relicensed with other firms, including those
other things) prioritise efforts to prosecute ML involving crimes
based overseas, given that regulators across jurisdictions are
committed abroad (particularly non-fraud related crimes such as
increasingly connected and are sharing information.
drugs, tax crimes and corruption), and increase risk
It is possible that Hong Kong regulators may introduce further understanding and AML/CTF implementation by smaller
measures to tackle the rolling bad apples financial institutions (particularly in the
phenomenon, such as reference check money service operators and money
related requirements which have already “The SFC has confirmed that it lender sectors).
been implemented in the UK and are expects firms to comply with In the coming year, Hong Kong is likely to
proposed in Singapore and Australia. They the “spirit” of the requirement see further policy changes and
may also consider incorporating the
human resources function into the senior when assessing whether an enhancements in light of the priority
actions identified in the FATF report. We
management accountability regimes, investigation is disclosable. anticipate that financial services
which have been implemented in Australia Notifications will therefore be regulators will continue to place AML/
and proposed in Singapore.
focused on behaviour which CTF enforcement high on their agenda
and, in particular, include senior
Culture reform calls into question an
management and MICs responsible for
The Hong Kong Monetary Authority individual’s fitness and AML/CTF in their investigations. The
(HKMA) has begun supervisory activities properness, thereby helping regulators are also boosting their
on its bank culture reform which we
expect to continue as a key focus in the
to drive misconduct out of the surveillance systems, as seen by the
engagement of a consultant by the
coming year. Individual banks are required industry – individuals beware.” HKMA in June this year to study the
to conduct a self-assessment of progress SAYS PATRICK PANG, MANAGING enhancement of the HKMA’s AML/CTF
against the HKMA’s March 2017 DIRECTOR – COMPLIANCE AND TAX surveillance capabilities.
guidance, which focuses on governance, AT ASIFMA.
incentive systems and assessment and Additionally, the SFC is exploring whether
feedback mechanisms. This will be followed by on-site and/or and how it should regulate virtual asset trading platforms to
off-site reviews of banks, as well as culture dialogues with senior protect investors against the risks of fraud and ML.
management, and we are likely to see further guidance issued by
the HKMA. Mainland China
Mainland China’s FATF report card, received in April 2019,
The HKMA will also finalise the revisions to its Supervisory Policy
noted that there is a good legal framework with regards to areas
Manual module CG-5, Guideline on a Sound Remuneration
such as the criminalisation of ML and TF and the powers and
System, in the near future. The proposed revisions include a new
responsibilities of law enforcement authorities, but identified that
section on how banks’ remuneration systems should address
there was scope for strengthening the framework with respect to
misconduct risk.
a number of preventative measures. There was also an incomplete
understanding of risk, and significant weaknesses relating to the
Enhancement of AML/CTF transparency of legal persons and legal arrangements and
measures in Hong Kong and practices related to targeted financial sanctions.
Mainland China
Some of the other areas identified for improvement include
This year, both Hong Kong and Mainland China received their increasing the upper limit of financial penalties and addressing
report cards from the Financial Action Task Force (FATF) on their gaps in the regulators’ supervision of ML/TF risks.
anti-money laundering (AML) and counter-terrorist financing
(CTF) measures and compliance with the FATF’s Going forward, Mainland China is expected to amend its
40 recommendations. Anti-Money Laundering Law (AML Law) to increase financial
penalties, which have a current ceiling of RMB 5 million for
financial institutions and RMB 500,000 for individuals. There are
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

Spotlight on Greater China, continued

also indications that Mainland China will expand the categories of areas for foreign investment in the future, such as interbank
ML predicate offences covered under the AML Law (which are bond underwriting and pension fund management.
currently limited to seven) in line with the FATF’s
recommendation to apply ML to all serious crimes. The AML Law One challenge for foreign investors and financial institutions
covers predicate offences such as drug-related crimes, organised taking advantage of this opportunity is the need to reconcile
crimes and financial fraud, but does not cover tax evasion. their global AML/CTF framework with the regulatory regime of
Mainland China. As Mainland China continues to enhance its
To address gaps in regulators’ supervision, we can expect to see measures to meet international standards, the regulatory gap
increased inter-ministerial cooperation involving the sharing of with foreign jurisdictions will be reduced.
financial intelligence (including information regarding beneficial
ownership) between the financial, public security, tax, customs
Hannah Cassidy
and supervisory ministries. It is also anticipated that Mainland
Partner, Hong Kong
China will increase AML supervision over the rapidly developing
T +852 2101 4133
internet finance sector, which is ripe for AML risk.
[email protected]
Foreign investment in Mainland China’s
financial services market Natalie Curtis
Partner, Singapore
The enhancement of AML/CTF measures by Mainland China is
T +65 6868 9805
important in light of the gradual opening of its financial services
[email protected]
market, with the granting of national treatment to foreign
investors and encouragement of foreign investment. A number
of market entry restrictions and ownership caps have been or Will Hallatt
will be removed. In particular, by 2020, foreign investors will be Partner, Hong Kong
permitted to own 100% shareholding in securities firms, fund T +852 2101 4036
managers, futures companies and certain insurance companies [email protected]
in Mainland China. The government also plans to open up more

Spotlight on

UAE

The “passporting regime” Tightening of Anti-Money Laundering regime

On 27 November 2018, the UAE Securities and Commodities The UAE’s new Anti-Money Laundering Law (AML Law)
Authority (SCA), Dubai Financial Services Authority (DFSA) (Federal Law No. 20 of 2018) was issued on 30 October 2018
and Abu Dhabi Global Markets Financial Services Regulatory and aims to enhance processes to combat money laundering
Authority (FSRA) agreed on a common legislative framework, crimes taking place onshore. The changes include enhanced
the “passporting regime”, allowing domestic funds to be investigation procedures (including allowing a transaction to
promoted anywhere in the UAE, pursuant to agreed provisions proceed in order to trace the funds), increased fines and
and licensing regulations. penalties, and an ability to freeze funds associated with
financial crime.
Each regulator is required to establish a notification and
registration facility to enable the marketing of domestic funds The DFSA and the FSRA have initiated changes to their AML
set up in the UAE, Dubai International Financial Centre (DIFC) or regimes as a result of the upcoming Financial Action Task Force
Abu Dhabi Global Market (ADGM) to potential investors. (FATF) Mutual Evaluation of the UAE due to take place in the
second half of 2019 to ensure compliance with the 2012 FATF
The Fund Protocol Rules of the DFSA Rulebook came into effect Recommendations.
on 25 February 2019 and set out the DFSA’s requirements for
registration of domestic funds for passporting. In the ADGM, In October 2018 the DFSA implemented amendments to the
the recently issued Fund Passporting Rules set out the FSRA’s Anti-Money Laundering, Counter Terrorist Financing and
requirements and the SCA has also recently circulated Sanctions Module of the DFSA Rulebook (AML Rules) and the
passporting rules. DIFC Regulatory Law 2004 including, but not limited to,

//15
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Spotlight on UAE, continued

customer due diligence, record keeping, wire transactions, ••The Central Bank’s power to undertake examinations of the
reliance on third parties, internal controls and rules relating to activities of Licenced Financial Institutions with branches or
foreign branches and subsidiaries. The DFSA also clarified its entities in the financial free zones (the DIFC and the ADGM)
AML remit and supervision of Designated Non-Financial in collaboration and conjunction with relevant regulators.
Business Professionals. In addition, the DIFC Ultimate Beneficial
••Establishing a Higher Shari’ah Authority which will oversee
Ownership Regulations (UBO Regulations) were enacted on
and drive Shari’ah compliance in the UAE. This will support
12 November 2018, which require all entities operating in the
the UAE’s goal of becoming a global leader in Islamic finance.
DIFC to establish a register of ultimate beneficial owners.
Failure to comply with the UBO Regulations may result in a fine
Netting Law: regulated for the first time
of up to US$25,000.
A netting law (Federal Decree Law No. 10 of 2018) came into
On 11 February 2019, the FSRA issued a consultation paper on force on 30 October 2018 (Netting Law) and regulates netting
its proposed revisions to the AML regime in the ADGM and on for the first time onshore in the UAE, following the guidelines of
15 April 2019 implemented regulations and rules relating to the International Swaps and Derivatives Association (ISDA)
AML. The amendments enhance the FSRA’s powers to prevent Model Netting Act 2006.
money laundering.
Previously, netting and set-off were available in accordance with
DIFC Companies Law and DFSA’s funds regime the UAE Civil Code provided no party was insolvent but
The DIFC issued a new Companies Law (DIFC Law No. 5 of restricted by the UAE Bankruptcy Law where a party was
2018) which came into effect on 12 November 2018. The new insolvent. The Netting Law provides certainty by addressing and
Companies Law distinguishes between private and public dealing with the potential conflicts between the UAE Bankruptcy
companies, where private companies are subject to less Law and the UAE Civil Code where one party to the transaction
stringent requirements. Other amendments include enhanced is subject to insolvency.
directors’ duties. Following implementation, the DFSA also
The new Netting Law covers both pre- and post-insolvency
introduced enhancements to their funds regime. Some changes
situations and applies to transactions entered into by corporate
include a new distinction between a public and private company
entities or individuals in the UAE (other than the DIFC and the
as introduced by the Companies Law, introduction of
ADGM which are self-legislating jurisdictions).
Exchange-Traded Funds as a new specialist class of fund and a
new model for internal management of an Investment Company Its greatest impact is likely to be the benefit it brings for UAE
where such company can be internally managed by its licenced entities contracting with international counterparties.
sole corporate director, subject to certain requirements.

Enhancing the role of the Central Bank

A new banking law (Federal Law No. 14 of 28) regarding the
Central Bank and Organisation of Financial Institutions and
Activities (Banking Law) was introduced in 2018. The Banking
Law strengthens the Central Bank’s ability to exercise effective
regulatory control over the financial sector and aims to ensure
consistency with international best practices and standards.

Key developments contained in the Banking Law include:

••Empowering the Central Bank to issue rules and specify
exemptions in relation to financial promotions, including
cross-border activities.
••Establishing a Financial Activities Committee which will Stuart Paterson
include representatives of the Central Bank, Securities and Partner, Dubai
Commodities Authority and Insurance Authority. This will T +971 4 428 6308
allow more consistent cooperation and coordination between [email protected]
the main regulators in the UAE, which should strengthen the
financial sector as a whole. Chris Skordas
••Publishing regulations on the protection of customers. The Partner, Dubai
Banking Law codifies rules on confidentiality of customer T +971 4 428 6377
information including requiring customer consent before [email protected]
information can be passed to third parties.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

Spotlight on

US

Regulators in the United States have been active in a number of breaches which could be expected to have a “Business Material
areas that demonstrate the ongoing impact of the big data Adverse Effect.”10 Yahoo! only disclosed the breach to the public
revolution on the law. Recent developments at a number of in September 2016.11
different agencies are illustrative of this trend, perhaps most
prominently the enforcement actions initiated by the US As a result of the SEC’s determination that Yahoo! violated
Securities and Exchange Commission (“SEC” or the numerous statutory and regulatory provisions, the company
“Commission”). The number of actions is roughly in line with agreed to cooperate fully with the SEC, cease and desist from
prior years, with continued focus on securities offerings, any future violations of the securities laws, and pay a $35 million
investment advisory issues and issuer reporting, and civil penalty.
constituting nearly two-thirds of stand-alone cases brought by
Although simply being the subject of a cybersecurity breach is
the Commission.1
not per se grounds for finding that an entity has violated the law,
A new emphasis on cyber as the SEC noted was the case here, “a company’s response to [a
cyber incident] could be so lacking that an enforcement action
Among the core principles on which the SEC is currently focused would be warranted.”12 The SEC also advised that “[p]ublic
is “keep[ing] pace with technological change”2 To that end, the companies should have controls and procedures in place to
SEC is striving to adapt to the myriad ways in which technology properly evaluate cyber incidents and disclose material
interacts with the securities laws. information to investors.”13
The SEC’s Cyber Unit became fully operational in FY18. It Protecting your customers’ data
brought twenty stand-alone cyber-related cases in FY18 and
had over 200 ongoing cyber-related investigations at the end of In September 2018, the SEC announced the results of an
the fiscal year.3 Notably, the SEC had a number of “firsts” in the investigation into Voya Financial Advisors Inc. (VFA) concerning
cyber sphere during this time, including its first action against a a cyber attack that compromised the personal information of
public company for failing to properly inform investors of a data thousands of customers, the first enforcement action charging a
breach, and its first action charging violations of the Identity violation of the Identity Theft Red Flags Rule.14
Theft Flags Rule,4 which is designed to protect customers
In April 2016, VFA was subjected to an intrusion by persons
against the risks of identity theft.5
impersonating VFA contractor representatives telephoning to
These actions exemplify the renewed focus of US regulators on obtain false resets of passwords.15 This enabled the intruders to
cyber-related misconduct and the protection of individuals’ access the personal information of thousands of VFA’s
confidential personal data. customers, including address, date of birth, email address, last
four digits of the Social Security number, and in a smaller but
Handling a cyber breach still significant number of cases, full Social Security number.16
The company’s security staff failed to adequately respond to
In April 2018, the SEC announced the results of an investigation
these intrusions.17
into Altiba Inc. (formerly part of Yahoo! Inc.) concerning the
circumstances surrounding the 2014 data breach of Yahoo!, The SEC found that VFA violated both the Safeguards and
which resulted in the theft, unauthorised access, and acquisition Identity Theft Red Flags Rules because: (i) its cybersecurity
of hundreds of millions of its users’ data, including usernames, policies and procedures were not reasonably designed to
birthdates, and telephone numbers, at the time the largest protect customer information and respond to cybersecurity
known theft of individual user data.6 incidents; and (ii) despite having implemented a written identity
theft policy in 2009, VFA failed to review and update its policy in
According to the SEC Order, Yahoo! failed to disclose the breach
response to changes in risks to its customers or provide
for nearly two years, publicly noting only a risk of future breaches
adequate training to its employees, and the policy was not
and accompanying litigation and reputational damage, despite
reasonably designed to respond to red flags.18
the fact that it had internally investigated and determined the
extent of the breach by December 2014 at the latest.7 The SEC VFA agreed to retain a compliance consultant to conduct a
also determined that Yahoo! senior management failed to inform comprehensive review of its policies, provide written
its auditors or outside counsel of the breach and ongoing cyber certification with documentary evidence to the SEC of its
intrusion efforts into 2015 and 2016.8 cooperation with the consultant and implementation of his or
her recommendations, cease and desist any violations of the
In 2016, Yahoo! was also in talks to sell its operating business to
securities laws, and pay a US$1 million civil penalty.19
Verizon Communications Inc.9 Despite being aware of ongoing
intrusions and of the likely theft of its entire user database, The SEC noted that the “case is a reminder to brokers and
Yahoo! informed Verizon that it was unaware of any security investment advisers that cybersecurity procedures must be

//17
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Spotlight on US, continued

reasonably designed to fit their specific business models. Scott Balber

They also must review and update the procedures regularly to Partner, New York
respond to changes in the risks they face.”20 T +1 917 542 7810
[email protected]
Conclusion
For entities that handle sensitive personal information, data Jonathan Cross
security is of ever-increasing importance, and with increasing Counsel, New York
regulatory focus, companies should ensure that they take all T +1 917 542 7824
appropriate measures to maintain the confidentiality of the [email protected]
information they are entrusted to hold.

1 – 3, 5. US Securities and Exchange Commission, Division of Enforcement Annual 6 – 11. SEC Order No. 33-10485, www.sec.gov/litigation/admin/2018/33-10485.pdf
Report 2018, www.sec.gov/files/enforcement-annual-report-2018.pdf 14, 20. SEC Press Release 2018-213, SEC charges firm with deficient cybersecurity
4. Regulation S-ID: Identify Theft Red Flags (248.201 and 248.202), www.law.cornell. procedures, www.sec.gov/news/press-release/2018-213
edu/cfr/text/17/part-248/subpart-C 14 – 19. SEC Order No. 34-84288, https://www.sec.gov/litigation/
6, 12, 13. SEC Press Release 2018-71, Altaba, formerly known as Yahoo!, charged with admin/2018/34-84288.pdf
failing to disclose massive cybersecurity breach; agrees to pay $35 million, www.sec.
gov/news/press-release/2018-71

Spotlight on

Germany

Adapting to a rapidly ••Guidance on Disruptive Technologies: In February 2018,

BaFin issued guidance in connection with Initial Coin Offerings
changing landscape and the classification of Crypto tokens as a regulated financial
Similar to other European countries, Germany’s banking sector instrument. In November 2018, BaFin released guidance for
is in the course of adapting and transforming. The search for a outsourcing services to cloud providers, focusing on
“national champion”, as reflected in the recent merger contractual templates in compliance with applicable
discussions of two large German banks, illustrates how the supervisory requirements.
sector aims to stay competitive. A new German champion ••Identifying future supervisory implications: In January 2019,
would not only compete with other global banks, but also with the initial results of BaFin’s consultation of its report on
less traditional competitors who are significantly shaping the disruptive technology and its implications for supervision
future of the financial services industry. were released. The report “Big Data meets Artificial
Intelligence – Challenges and Implications for Supervision and
The challenge for Germany’s banking sector is to achieve the
Regulation” aimed to identify strategic trends and
required balance between innovation and regulation, ie to keep
developments requiring supervision and consulted with key
up with the vast variety of competitors and rapid development
stakeholders between July and September 2018.
of disruptive technology, while complying with the equally rapid
changing regulatory and legal landscape. The changes in the ••Minimum standards IT-Security extended to Asset
regulatory regime are fast-paced and are driven by the need to Managers (KAIT): In April 2019, BaFin released the minimum
adapt the legal framework to a transforming banking sector. standards for IT-Security for asset managers
Germany’s regulator, The Federal Financial Supervisory (Kapitalverwaltungsaufsichtliche Anforderungen an die IT)
Authority (BaFin), has identified major challenges and areas of This is the latest development in BaFin’s effort to ensure
focus for their regulatory efforts. adequate IT security systems in supervised sectors. Similar
standards had already been released for the banking sector
Digital transformation (BAIT) and for the insurance sector (VAIT).
In light of the ongoing digital transformation, BaFin’s focus is on Further developments are expected and the German banking
identifying the impact and risks of disruptive technologies to sector will need to adapt to increased duties in this area. There
anticipate any need for supervision; and addressing the potential may also be an increased focus on individual accountability as
risks arising from digital transformation and the abuse of the IT-security minimum standards unanimously stipulate that
disruptive technologies: compliance is management’s responsibility. Furthermore,
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

Spotlight on Germany, continued

BaFin has announced it wants to extend its IT-security ••MiFID II and EU Prospectus Regulation: In 2018, BaFin
framework to include sections on crisis management and conducted an extensive market analysis to determine the
conduct cyber stress testing. status quo of MiFID II’s implementation. The overall result
was positive but showed that supervised entities still face
Anti-money laundering challenges in implementing the requirements into their
Another focus is the prevention of Money Laundering and processes or lack necessary resources. BaFin plans to
Terrorist Financing and BaFin’s supervisory measures appear to enhance EU-wide collaboration in order to find globally
have intensified: consistent and practical solutions. In July 2019, the EU
Prospectus Regulation came into force and compliance with it
••Appointment of external monitor: In September 2018 and for may be a focus of BaFin.
the first time in its supervisory practice, BaFin appointed an ••Minimum requirements bail-in: In February 2019, BaFin
external monitor for a German bank. This shows that BaFin is submitted draft guidance on the minimum requirements for
dedicated to ensuring German banks have implemented the feasibility of a bail-in for consultation. The draft contains
adequate internal safeguards, and comply with their Customer requirements with respect to provision of necessary
Due Diligence duties. information and technical standards.
••Issuance of further guidance: In October 2018, BaFin The recent and future developments show that there it is not
released its consultation paper containing guidance on which only an ongoing transformation of the German banking sector
factors should be considered for the risk assessment itself but also a transforming supervisory regime which aims to
regarding Cryptocurrencies. In December 2018, BaFin adapt to the rapid technological developments. The German
released binding guidelines on the interpretation of the banking sector will need to tackle both aspects to remain
German Money Laundering Act. competitive and innovative.
Further developments are imminent and will require the German
banking sector to adapt. For example, the requirements of the
5th Anti-Money-Laundering Act will have to be transposed into
German law by 10 January 2020. BaFin has also announced that Kai Liebrich
it will focus on correspondent banking and examine risk Partner, Germany
management processes and compliance with applicable laws in T +49 69 2222 82541
this area. This new focus will likely bring about further [email protected]
challenges for the German banking sector.
Quenie Hubert
Consumer protection Associate, Germany
Consumer protection remains an area of focus for BaFin’s T +49 69 2222 82519
regulatory efforts and BaFin currently examines the German [email protected]
banking sector’s compliance with applicable rules.

//19
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Spotlight on

France

ACPR’s 2019 priorities: Clarified civil penalties in the event of

inaccuracy in the overall effective rate
cyber resilience
The “taux effectif global” (TEG) is a rate which expresses the
On 28 May 2019, the French banking regulator, the Autorité de
total cost of the loan, ie the overall amount of the loan as paid by
Contrôle Prudentiel et de Résolution (ACPR), presented its
the borrower.
activity report for 2018, which includes its priorities for the
coming year. Until now, the absence of or inaccuracy in the calculation of the
TEG was most often sanctioned by the substitution of the legal
The first priority relates to cybersecurity in the financial sector,
interest rate to the conventional interest rate, even if the error on
which is a key issue for the French Presidency of the G7. In early
the TEG was negligible.
June 2019, the Banque de France, in partnership with other
banking supervisors in G7 countries, simulated a cyber attack, Ordinance No. 2019-740 dated 17 July 2019 clarifies civil
launched simultaneously in all G7 countries. The objective was penalties in the event of a default or an inaccuracy in the TEG.
to evaluate the exchange protocol between financial and From now on, absence of or mistake in the calculation of the
banking authorities through the simulation of a major financial TEG is sanctioned by the loss of the lender’s right to receive the
system disruption caused by a critical cyber incident. The interests on the loan, in a proportion fixed by the court, “in
chairman of the ACPR, François Villeroy de Galhau, announced particular with regard to the damage suffered by the borrower”.
that he would implement concrete measures once the outcome
of this simulation is established. The judge now has broader discretionary power and, in
particular, has to take into account whether or not the borrower
The ACPR also announced that in 2019, it will focus on the has effectively suffered damages as a result of the absence of or
control of business practices, including the protection of inaccuracy in the calculation of the TEG. The ordinance implies,
vulnerable customers. Since the end of 2018, several inspections by using the terms “in particular”, that criteria other than the
were carried out on the measures implemented by banking damages suffered by the borrower might be taken into
institutions for financially vulnerable populations, and in consideration by French courts. The ordinance applies to loans
particular, on compliance with the right to access basic banking granted to consumers, professionals and companies (legal
services. entities).
The fight against money laundering and The publication of this ordinance takes place in a highly sensitive
terrorist financing (AML-CFT) political context. At the end of 2018, a first draft aimed at setting
AML-CFT remains one of the ACPR’s main areas of focus this a fixed upper limit in the event of an inaccuracy in the calculation
year. In 2018 alone, 23 on-site inspections were carried out in of the TEG. In the midst of the “Yellow Vests” crisis, this
this respect. They revealed, according to the French banking measure was heavily criticised and analysed as a “gift to banks”.
regulator, significant weaknesses in the compliance of regulated This fixed upper limit has, therefore, not been passed by
organisations in terms of their AML–CFT and asset freeze French authorities.
obligations. In 2018, the ACPR Enforcement Committee issued
nine financial penalties, one of which amounted to €50 million.

The ACPR announced that it will continue to monitor asset

freezing obligations and will deepen its analysis of the risks
raised by new technology and fintechs, including the use of
crypto-assets. The ACPR’s focus on AML-CFT matters over the
past years is all the more a key priority given that FATF (the
inter-governmental Financial Action Task Force) will carry out its
evaluation of the French AML-FT system in 2020. Antoine Juaristi
Partner, Paris
Asset freeze obligations T +33 1 53 57 74 04
[email protected]
The joint ACPR/French Treasury guidelines on the
implementation of asset freeze obligations were updated in June
2019. In particular, this update clarified the obligations imposed Géraldine Marteau
on French banking institutions’ branches operating abroad. Of Counsel, Paris
French banks must ensure that their branches in third-party T +33 1 53 57 78 37
countries implement the French and EU restrictive measures. [email protected]
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

Spotlight on

UK

Change: risks and opportunities delivered solely by rules changes. Those who work in financial
services must embrace the principles of responsibility and
Whilst it is unsurprising that changes related to the United accountability as well as the process.”
Kingdom’s departure from the European Union have continued
to occupy firms and regulators in this past year, and inevitable Some of this accountability is mandated by the Regulators. For
that they will continue to do so, they are by no means the only instance, in the context of LIBOR discontinuance, the PRA and
significant changes facing the financial services industry in the FCA required large banks and insurers to identify the Senior
United Kingdom and those who regulate it. Manager(s) within their firms who will oversee the
implementation of the firm’s LIBOR transition plans.
As acknowledged by Charles Randall,
Chair of the FCA in its Business Plan for But the wider issue of cultural change remains at
2019/20, change brings risks and also “Change is here to stay the forefront of the regulatory agenda and a
opportunities. By way of example, for all of us: for financial priority for the UK Regulators. The FCA in
technological change tests firms’ particular is exploring the role of “purpose” in
operational resilience but also offers
markets and firms, creating healthy cultures.
opportunities to engage differently consumers of financial
with customers. services and financial The approach to data

There is heightened awareness of the regulators.” The FCA is also examining whether its current
approach to “Treating Customers Fairly” is
importance for firms to be operationally, CHARLES RANDALL, CHAIR
OF UK FINANCIAL CONDUCT
adequate to cover data ethics in financial
as well as financially, resilient in the face
AUTHORITY, FCA BUSINESS services, or whether there ought to be policy
of threats such as cybercrime. PLAN 2019/20 frameworks for how firms collect and use data.
While it is still early days for Open
The FCA has said how data and technology have
Banking in the UK, there is regulatory appetite to explore
changed and are changing the way it regulates and has set out
Open Finance ie the extension of Open Banking to insurance,
some ways in which it has reacted to and embraced change,
savings and mortgages, using the learnings, both cultural and
including:
technical, from the Open Banking journey.
••increasing its data science resource throughout
Meanwhile, the expectations on regulators to protect consumers,
the organisation
online and offline, continues: the FCA continues to reflect on the
need for a “duty of care” in financial services. It has also ••testing and exploiting new tools such as web crawling and
published a consultation on proposed guidance for firms on the scraping, network analytics and natural language processing
fair treatment of vulnerable customers and has said that it
••investigating how technology can fundamentally change the
“would like to see firms using technology to serve vulnerable
interface between the FCA and regulated firms by making parts
customers’ interests and support them to manage their
of the FCA Handbook machine readable and executable, and
financial wellbeing.”
••in the longer term, bringing data and analytics capabilities
Accountability and cultural change together to deliver near real time monitoring of priority
markets, to allow the FCA to identify harm rapidly and
Of course when things do go wrong, the Regulators take action
deter misconduct.
through enforcement. Both the FCA and the PRA have been
ramping up their enforcement activity. For a number of years It no doubt expects firms similarly to assess, and be able to explain
now, the number of investigations opened by the FCA has how they are responding to, technological and broader changes.
increased year on year. In 2015/16, 109 new cases were opened;
this has increased to 343 in 2018/2019. Meanwhile, the
Prudential Regulation Authority (PRA) has also continued to Chris Ninan
invest in its enforcement capability. Recent statistics indicate Partner, London
that, as well as 8 ongoing investigations into firms, the PRA has T +44 20 7466 2490
19 open investigations into individuals, all of whom are senior . [email protected]

By the end of 2019, the Senior Managers and Certification Jenny Stainsby
Regime will be extended to all FCA-authorised firms. Partner, London
T +44 20 7466 2995
However, as Andrew Bailey, Chief Executive of the FCA has
[email protected]
made clear: “…fundamental change in conduct cannot be

//21
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Are you prepared? The board’s

role in crisis management
With the ever-increasing growth in the number and potential magnitude of cyber,
technological and operational risks to financial services entities, boards need to
be prepared to respond to these types of crisis and ensure that the entity’s critical
information assets are appropriately secured.

The role of a board, in particular the non-executive members, changes dramatically in

a time of crisis. Customers, the public, regulators, and policymakers expect the board
“The Regulations “require the
to steer the firm confidently and competently back to safety. establishment of governance
While it is fair to say that a board should consider and plan in advance for how to processes to ensure senior
respond to a crisis, there is a balance to be struck. A board should not be structured
solely with crisis management in mind given that crises are likely to be quite rare. attention to these important
However, the prominence that a board is likely to have during a crisis means that it is
sensible to consider the collective crisis management skillset. The Chair (and/or in the
protections”.
case of large firms, the Nominations Committee) should regard this aspect of the
board’s functions when considering potential new appointments and when
“Senior management must
commissioning a Board Effectiveness Review. take this issue seriously and
Regulatory obligations for board members be responsible for the
Boards of financial services entities need to have clear systems and strategies in place organisation’s cybersecurity
to manage the security of data and information assets and respond to incidents, as
this is fundamental to the stability of both their business as well as the broader program and file an annual
financial markets. The operation and reputation of a financial services entity depends
on the security and resilience of its technology systems and regulators around the
certification confirming
world are sharpening their focus on technology, operational and non-financial risks. compliance with these
For example, in Australia, the Australian Prudential Regulatory Authority (APRA) has regulations” including “a
recently issued Prudential Standard CPS 234 (CPS 234) which makes the board of an
APRA-regulated entity ultimately responsible for ensuring the entity maintains its
written policy or policies that
information security. This means that the information security related roles and are approved by the Board of
responsibilities of the board and senior management need to be clearly defined and
the board must ensure the entity has controls to protect its information assets and Directors or a Senior Officer”.
undertakes systematic testing and assurance around the controls effectiveness. DFS SUPERINTENDENT MARIA T. VULLO,
APRA’s latest Corporate Plan also names improving cyber resilience across the DECEMBER 2018
financial system as one of its top four strategic focus areas.

In the United States similar obligations are placed on the board. One example is the
“Cybersecurity Requirements for Financial Services Companies” issued by the New
York State Department of Financial Services (DFS) in 2017 (Regulations), which has
implementation and compliance deadlines throughout 2019. These Regulations
require each covered entity to assess its specific risk profile and establish and
maintain a cybersecurity program designed to protect the confidentiality, integrity,
and availability of its information systems. These Regulations apply to any individual
or non-governmental entity (unless exempt), operating or required to operate under a
license, registration, charter, certificate, permit, accreditation or similar authorisation
under the New York Banking Law, Insurance Law, or Financial Services Law.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

//23
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

In Europe, we find clear expectations for boards or “Management have frequently stood down from leadership roles following
Bodies” in the EU Capital Requirements Directive IV (CRD IV), in significant data breaches.
addition to the provisions of the Companies Act and the non-binding
Financial Reporting Council’s Corporate Governance Code. The In the UK, some in a non-executive capacity might be uneasy about
legislation sets out the expectation that board members should whether they have met their obligations to the firm under the FCA’s
commit sufficient time to perform their functions and sets Senior Managers and Certification Regime (SMCR) (see Financial
restrictions on the number of additional directorships an individual Conduct Authority Handbook, Code of Conduct, Annex 1/1, Roles
board member may hold. CRD IV and the provisions of the second and Responsibilities of NEDS of SMCR firms), such as the role of
Markets in Financial Instruments Directive (MiFID II) are further satisfying themselves that systems of risk management are robust
bolstered with guidance from the European Banking Authority (EBA) and defensible. However, while there is a temptation to move into a
and the European Securities and Markets Authority (ESMA). more executive mode, the fact they may have a greater degree of
distance from the fray can enable them to take a more measured
The financial crisis of 2007/8 has seen policymakers and regulators
stance representing the firm externally.
become increasingly focused on ensuring that the boards of financial
institutions are robust and fit for purpose—including managing a
Preparing the board for a cyber incident
crisis. The focus on time is important as steering a firm through a
crisis, from inception to the post-crisis tail, will take a significant time In 2018 the UK Government’s Cyber Governance Health Check,
commitment: dealing with a cyber event, such as a large personal which looks at the approach the UK’s FTSE 350 take to cyber,
data breach impacting upon multiple stakeholders or the concluded that many FTSE 350 boards still do not understand the
unavailability of a critical IT system, can become a full time job in the impact of a cyber incident on their business. Similarly, the UK FCA’s
months following the incident. cyber and technology resilience survey (November, 2018)
highlighted that firms reported a lack of board understanding of
Litigation and personal liability cyber risks, an issue which the FCA has also seen during its
Litigation following cyber incidents will often argue that executive supervisory work. In Australia, capabilities across APRA’s regulated
directors should be personally liable on the basis of breach of entities and their key service providers are variable with a range of
fiduciary duty. Irrespective of the law, executive board members cyber exposures and preparedness observed by the regulator.

Reporting requirements – how long have you got?

Within 10
Within 1 hour Within 72 hours
business days

Under the General Data Protection Regulation (GDPR),

an organisation must report a personal data breach,
which is likely to result in a risk to a person’s rights and
freedoms, to the relevant Supervisory Authority.1

If the breach represents a high risk to a person’s rights

UK and freedoms, the organisation will also have to inform
people affected “without undue delay”.

CPS 234 requires an APRA- regulated entity to notify CPS 234 requires an APRA- regulated
APRA as soon as possible and in any event within no entity to notify APRA as soon as
later than 72 hours after becoming aware of an possible and in any event within no
information security incident that affects or could have later than 10 business days after it
materially affected the entity or the interests of becomes aware of a material
Australia customers, or has been notified to other regulators information security control weakness
(either in Australia or other jurisdictions); which the entity expects it will not be
able to remediate in a timely manner.

The Monetary Authority of Singapore (MAS) Singapore’s Personal Data Protection Commission of
imposes stringent technology risk management Singapore (PDPC) requires organisations to report
and reporting requirements on financial personal data breaches “as soon as practicable” and
institutions, such as the requirement to notify in any event no later than 72 hours after establishing
MAS within one hour of discovering a system that the data breach is likely to result in significant harm
malfunction or IT security incident that has to be affected individuals or if the breach
Singapore severe and widespread impact on the financial is of significant scale.
institution’s operations or materially impacts
on its service to its customers.

Under the Cybersecurity Requirements for Financial

Services Companies referenced above, the covered
entity must notify the DFS of any breaches as promptly
as possible but no later than 72 hours from
a determination that any act or attempt, successful or
unsuccessful, to gain unauthorized access to, disrupt, or
misuse an information system or information stored
US thereon, has occurred, if: (1) notice is required to be
provided to any government body, self-regulatory
agency or any other supervisory body; or (2) the event
has a reasonable likelihood of materially harming any
material part of the normal operation(s) of the entity.

1. The clock starts ticking from the time when a controller “becomes aware” of a personal data breach, which means when a controller has a “reasonable degree of
certainty that a security incident has occurred that has led to personal data being compromised.” The rationale for the notification is so that prompt steps can be taken
to mitigate any harm which may be caused.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

“CEOs and other decision makers

should be held accountable
whenever a cybersecurity breach
takes place”.…“Organisations need
to see cyber attacks as a business
risk and leadership at the highest
levels have to take accountability”.
MR DAVID KOH, CHIEF EXECUTIVE OF THE
CYBERSECURITY AGENCY OF SINGAPORE,
SEPTEMBER 2018

In order to counteract the lack of cyber understanding prevalent at Preparing a crisis response plan
board level, we are seeing a number of strategies being implemented
All organisations should have robust, well-tested incident response
such as establishing specialist sub-committees and conducting
plan ready to launch when cybersecurity or technology incidents
simulation or “Wargaming” activities. In particular, when modelling
arise. The key parts of this plan are likely to involve crisis
simulation scenarios for cyber incidents, attention should be given to
organisation, information and reporting, communications, legal
containment and mitigation strategies.
fallout and the aftermath.
Crisis simulations
Crisis organisation
It is common practice for firms to engage in crisis management
There is a balance to be struck between being comprehensive and
simulations—a task which is not to be underestimated given the
being flexible to suit any combination of circumstances. If the plan
need for policies, plans, and procedures to be comprehensive and
is too rigid, then adhering to it becomes impractical and, in the
flexible to cover any combination of circumstances. It is important
worst case scenario, serves to exacerbate the crisis. If the plan is
for boards to be fully engaged with the firm’s crisis management
too high level, it offers little guidance at a time when that is likely to
simulations and to understand the firm’s activities and main risks.
be needed. The best plans include the detail, but indexed and
For example, in the EU, CRD IV requires firms to devote adequate
cross-referenced in a way that is easily navigable for any given type
resources to induction and training of board members to ensure
of incident.
they possess adequate collective knowledge, skills, and experience.
In a board context, it is important that – at time of crisis – the
In the case of a cyber or broader technology incident, adequate
respective roles and responsibilities of the various board members
simulation training may ensure there is appropriate capability
are clear and take into account the relevant skill sets.
within the board to strategically assess and manage the risks upon
briefing from an IT Director or Chief Information Security Officer, Typically, the chair of the board will have a leading role in a crisis.
allowing for a strategic quick response in a time sensitive situation. However, there may be types of crises where a board member’s
Such crisis simulations are also important because they acclimatise profile or skill set is particularly suited for a lead role—for example,
boards to the sorts of decisions they will need to make in a real if a board member has considerable and relevant reputational
incident. capital or technical skills. The plan should allow for the chair to
make delegations where appropriate and beneficial for the firm.
Such “wargaming” is also useful because it can contribute to meeting
the “training” expectations of legislation, in which simulation scenarios The plan should also be clear on the respective roles of the
are carefully constructed to undertake a test of the board’s role and executive versus the non-executive, particularly with regard to
response in a crisis situation. Such exercises are likely to be most representing the firm externally. Given the direct management role
effective when the board sets aside a reasonable amount of time to which the executive plays in the day-to-day running of the firm,
fully engage with the exercise, review the outcomes and identify any there is potential for those in executive roles to become defensive
gaps, for example, at a board away-day or offsite. Without wargaming during a crisis. This is particularly true where external parties—for
it is unlikely that the board will be able to meet the very tight example, politicians, the media, social media commentators—
timetables that are set for reporting by law. allude that there may be a degree of personal culpability attached
to an individual executive.
//25
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Information and reporting messaging, particularly where social media

57%
has the ability to proliferate both real accounts
Many crises require the rapid collation of
and “fake news”. Great care should be taken
information from different teams. Cyber crises,
by board members and it is common practice
for example, require input at speed from many ONLY
to provide media training as part of the
different disciplines, including technical, legal, TESTED INCIDENT PLANS
simulation exercises; such as role playing with
business continuity and communications—and, REGULARLY
specialist media consultants. The challenge is
given the international nature of many cyber
to avoid saying anything that may prove to be
incidents, often across a number of
a hostage to fortune, while also meeting ALTHOUGH MOST COMPANIES
jurisdictions. It is often advisable to appoint a HAD INCIDENT PLANS, ONLY
regulatory expectations to keep stakeholders,
dedicated coordination team to ensure that 57% TESTED THEM ON A
including customers, informed.
information is collated sufficiently quickly. REGULAR BASIS. BUSINESSES
IN FINANCIAL SERVICES
Where possible, the board should consider
In cyber incidents one of the first steps may be WERE AHEAD OF THE PACK,
what steps a firm might take around HOWEVER, AS THEY WERE
to engage alternative means of communication,
communications in the crisis plan, eg SLIGHTLY MORE LIKELY TO
given that there may be lack of clarity regarding TEST THEIR PLAN
which systems have been impacted. For heightened monitoring of media and social
REGULARLY, WITH 61% DOING
example, if corporate e-mail is compromised, it media, the prioritisation of particular channels SO, COMPARED TO 49% IN
may be necessary to resort to alternatives such and/or the general tone/positioning of OTHER SECTORS.
as WhatsApp. It is too late to try to set such external communications, the slightest
THE UK GOVERNMENT’S
alternative communications up after the event; misstep may be seized upon and spun via
CYBER GOVERNANCE
it must be done beforehand and be part of the mainstream or social media. This could lead to HEALTH CHECK
crisis response plan. loss of customer trust, with significant
reputational and financial consequences.
While the management information which a
board will receive to inform its business-as-­ Responsibility for both approval and delivery
usual oversight typically evolves to suit the of external messaging should also be part of
needs of the board over time, during a crisis the role allocation process, with consideration
there is not time to finesse its formatting and given to the audience eg, staff, shareholders,
content. An exercise should help to build the mainstream media, social media,
the board’s awareness of and (potentially) government and politicians, regulators, peer
firms, and the wider industry. Consideration
familiarity with management information in ASIC HAS RECENTLY
formats, structures, and volumes which they should also be given to the timing and rhythm
of communications as the crisis develops, so
PUBLISHED A LIST
would be unlikely to use during business-as- OF KEY QUESTIONS
usual periods. that key stakeholders are notified
simultaneously regarding developments, and FOR BOARDS ON
During the investigation, care should be that there is consistency to the narrative as the CYBER RESILIENCE
taken to log investigative steps and to crisis unfolds. In cyber incidents it can take time
preserve evidence in case civil or criminal to determine what has happened; to identify
proceedings follow. correctly the threat actor and their motivation. Q. HOW OFTEN IS THE CYBER

Legal fallout For instance, when an airline operator suffered plan

RESPONSE

The role of legal in any incident can be

significant. The legal team’s input is often
a large-scale data breach in 2018 with 9.4
million of its passengers impacted, the airline reviewed
AT BOARD LEVEL?
was heavily criticised by the Hong Kong
required to help contain the incident, to manage
Privacy Commissioner for taking seven
regulatory, insurance and other notifications, to Q. HOW CAN WE MOVE
months to disclose its breach and not having FROM REACTING TO
manage third parties that may have had a hand
in the incident (for example, a third party
enough regard for data privacy and
governance. Unlike the GDPR’s requirement to anticipating
the threats?
supplier), to manage any subsequent
disclose data breaches within 72 hours, Hong
investigation and to deal with any follow-on
Kong currently has no statutory requirements
claims. Much preparation can be done in
for data breach notifications. Nevertheless,
advance, and it is common for legal teams to Q. CAN WE BE USING MORE
the privacy watchdog has stated that
have their own, separate legal incident
response plans in order to accelerate their
businesses should adopt “proactive data
data and
intelligence
management “ despite Hong Kong not having
ability to respond in a crisis. As part of this the
“a similar principle of accountability” as the EU.
plan should provide for careful consideration of
DRIVEN SOLUTIONS TO
what documents might attract legal Some of the messages which a firm conveys MONITOR & IDENTIFY RISKS?
professional privilege and how that privilege are subject to regulatory or legal
can be best preserved throughout the incident requirements. For example in the UK, firms

more
Q. DOES THE BOARD NEED
and subsequent investigation – bearing in mind are expected to disclose anything of which the
that there will often be a trade-off between
expertise
regulators would reasonably expect notice and
preserving privilege and stifling efficient and for the firm to keep customers appropriately
important communications during a crisis. informed. While quite a broad-ranging OR SUPPORT TO UNDERSTAND
requirement, a crisis would certainly fall within THE CYBER AND TECHNOLOGY
External communications RISKS AND THE IMPACT TO THE
the disclosure expectations. Similar
ENTITY?
Crises have the potential to throw firms into requirements may emanate from other
disarray and it is critical to manage external authorities, for example, those charged with
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

upholding data protection standards like the Conclusion Joseph Falcone

UK’s Information Commissioner. Partner, New York
While it is not possible to plan for every T +1 917 542 7805
It is crucial to dovetail any external public eventuality, boards have a key leadership role [email protected]
communications with regulatory, insurance in preparing their firms to respond effectively
and other notifications, to avoid regulators to and recover from a crisis.
finding out about incidents via the press Katherine Gregor
As society becomes increasingly digital and Partner, Melbourne
rather than from the firm directly.
data-driven, the harm that can be caused by a T +61 3 9288 1663
Crisis aftermath cyber incident has become greater. [email protected]
Accordingly, the expectations of board
Crisis events can, and usually do, have a very members by regulators, stakeholders and the
long tail – often extending years decades after Julian Lincoln
public are higher than they have ever been.
the event. Plans which are circumscribed to Partner, Melbourne
Increasingly, boards will be expected to
the immediate aftermath of an incident risk T +61 3 9288 1694
understand the technologies better that are
validating a short-sighted approach. While a [email protected]
being widely deployed in business. They will
firm cannot, and should not, run in crisis mode be expected to keep up with the changing
for longer than is reasonably needed, the “exit” threat landscape and oversee the Andrew Moir
or “close out” should include a sensible implementation of security controls which are Partner, London
“lessons learned” exercise, including updating appropriate for the new landscape. The T +44 20 7466 2773
the crisis plan, to meet the expectations of consequences of not meeting those [email protected]
customers, the public, regulators and expectations are severe.
policymakers.
Andrew Procter
Digital transformation and developments in,
The board should consider any impacts on, for Partner, London
for example, blockchain-based technologies,
example, the firm’s risk appetite and T +44 20 7466 7560
machine learning/artificial intelligence and
governance arrangements, customers and [email protected]
quantum computing will bring further rapid,
potential customers, the regulatory substantial change. In the future, board
relationship, and so on. In a recent members will be assisted by security being Mark Robinson
enforcement action against a UK bank which built into new products and services by design Partner, Singapore
related to an IT failure, the UK regulators and default to a greater extent. For now, T +65 6868 9808
highlighted that the firm had previously been however, risk-based planning, including a well [email protected]
subject to enforcement action for a similar thought through and robustly tested incident
incident. Commenting on the case, the CEO of response playbook, that is proportionate to the Kate Macmillan
the Prudential Regulation Authority noted, “… scale and complexity of a firm’s operations will Consultant, London
this was a repeat failing which demonstrates a do much to minimise operational damage, T +44 20 7466 3737
lack of adequate and timely remediation. This reputational harm and legal liability. [email protected]
is a significant aggravating factor in this case, Preparations do not have to be onerous, and
leading to an uplift in the penalty.” While not should, in the best cases, provide the board
known for sure, it may also be reasonably with more insight into the business to improve
conjectured that the regulators’ supervision of how they function during business-as-usual.
the firm will have become more intensive.
//27
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Virtual banks: the case for clearer

regulatory guidance on outsourcing
While virtual banks promise a range of exciting new and improved products, they also present
financial regulators and market participants with new challenges. One of the key challenges
relates to the tension between encouraging virtual banks to engage with innovative fintech
companies, and to move their IT infrastructure into the cloud, on the one hand, while
simultaneously ensuring that customer data is adequately protected, on the other.

This article: (i) examines whether existing retail bank to be granted a banking licence
regulatory guidelines on outsourcing in in Australia since the early 2000s”), Judo
Hong Kong and Singapore provide virtual and 86 400.
banks with sufficient guidance when it
comes to designing, building and procuring It is reported that Malaysia’s central bank,
their IT infrastructure; and (ii) compares the Bank Negara Malaysia, is aiming to join the
Hong Kong and Singapore guidelines with likes of Singapore, Hong Kong, Australia,
the approach that has been taken in other China, India, Japan, South Korea and Taiwan
jurisdictions, such as in the EU by the by releasing new licensing rules for virtual
European Banking Authority, Australia by banks by the end of 2019. Regulators in
the Australian Prudential Regulation other Asian countries will monitor these
Authority, and South Africa by the South developments with keen interest. The
African Reserve Bank. Financial Services Authority in Indonesia,
for example, has not announced any plan to
The article concludes that while existing issue any virtual bank licence but has “Into the cloud”
guidelines are helpful, financial regulators in recently issued a regulation allowing
Asia could help accelerate the growth of traditional banks to become more digital. “A model to enable ubiquitous,
virtual banks by providing more detailed convenient, on-demand network
A key driver behind the new virtual banking access to a shared pool of
guidance on their expectations for the
licences in Hong Kong, Singapore and configurable computing resources
design, build and procurement of virtual
(eg networks, servers, storage,
banking IT infrastructure. beyond is to attract non-traditional
applications and services) that can
players to the banking sector and to
be rapidly provisioned and released
The virtual bank provide a greater array of products and, with minimal management effort or
revolution in Asia ultimately competition, for the benefit of service provider interaction.”
the consumer.
The move towards “virtual” or “digital” NATIONAL INSTITUTE OF
STANDARDS AND TECHNOLOGY
banks continues to gather momentum in As noted by HKMA’s chief executive,
Asia, with the Monetary Authority of Norman Chan Tak-lam, “The launch of virtual “In the simplest terms, cloud
Singapore (MAS) announcing in August banks in Hong Kong, a key component of the computing means storing and
2019 that it will accept applications until 31 smart banking initiatives, will certainly accessing data and programs over
December 2019 for five digital banking facilitate financial innovation, enhance the Internet instead of your
licences (two digital “full bank” licences and customer experience and financial inclusion”. computer’s hard drive. The cloud is
three digital “wholesale” bank licences), Similarly, MAS’ senior minister and chairman, just a metaphor for the Internet. It
with the successful applicants expected to goes back to the days of flowcharts
Tharman Shanmugaratnam has noted, “the
be announced in mid-2020 and to and presentations that would
new digital bank licences mark the next
commence business by mid-2021. Earlier in represent the gigantic server-farm
chapter in Singapore’s banking liberalisation infrastructure of the Internet as
2019, the Hong Kong Monetary Authority journey. They will ensure that Singapore’s nothing but a puffy, white cumulus
(HKMA) granted eight virtual banking banking sector continues to be resilient, cloud, accepting connections and
licences. Similarly, in Australia, a wave of competitive and vibrant”. doling out information as it floats.”
new digital or neobanks have been granted
ARTICLE, “WHAT IS CLOUD COMPUTING”?
full Australian banking licences, for These non-traditional players, some of
example: Volt (stated to be the “first new which are (or are backed by) the world’s
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

largest technology companies, come armed partnerships are essential for ensuring that Data security risks
with: a deep understanding of the they are not left behind in the virtual banking
Barely a week goes by without a story
technological platforms that underpin modern revolution. For others, it can also be a hedge
breaking about a cyber attack or data breach
banking; nimble, agile and solutions-focused against increased competition from new
market entrants. involving a major financial institution.
working cultures; and platforms of millions, if
not hundreds of millions, of loyal and engaged At the time of writing this article, news was
users, many of whom may have had trouble “Into the cloud”
breaking that a hacker had gained access to
opening traditional bank accounts. It is little The move towards “fully virtual” banks is not more than 100 million Capital One customer
wonder that these players are being targeted just about replacing physical branches and accounts and credit card applications, and
to drive innovation and customer experience ATMs with sophisticated smartphone tried to share this information online. In the
in the banking sector. applications. It involves an end-to-end wake of the data breach, AWS was quick to
rethinking of the design and delivery of point out that the breach occurred due to a
Traditional “bricks and mortar” banks in Hong financial products and services and, in “firewall misconfiguration”, which was
Kong and Singapore do not require virtual particular, the underlying IT infrastructure. controlled by Capital One, and that no AWS
banking licences as they have had the right to Rather than relying on the in-branch infrastructure or services were compromised.
provide their customers with digital products processing of customer paperwork, market
and services for some time under their existing participants are now looking to engage Historically, traditional banks have managed
licences. Furthermore, in the case of Singapore, emerging IT and cloud service providers to these sorts of data security risks by
MAS’s existing policy allows provide a range of cloud-based, digital managing their IT infrastructure “in-house”
Singapore-incorporated banking groups to services, including online customer and “on-premises”, with limited or
establish digital banks (referred to in the policy verification and know-your-customer checks, constrained involvement from third party
as internet-only banks) with a joint venture anti-money laundering and fraud screening, vendors. In some jurisdictions, such as
partner where the Singapore-incorporated marketing automation services, automated Indonesia, traditional banks are even
bank has control over the venture. The new customer contact centres and regulatory mandated by regulation to store their data in
virtual bank licences do, however, present reporting services to name a few. The onshore data centres.
traditional banks with an opportunity to enter generation of large, structured data sets based
into strategic partnerships with non-traditional on customer activity is giving rise to a new In contrast, virtual banks are engaging
players where they need not maintain control range of products and services, based on data multiple IT vendors to provide myriad
over the venture. analytics and AI, such as automated and cloud-based solutions. While third party and
interactive customer helpdesks and loan and cloud solutions are not inherently less secure
It is expected that by combining the financing decision making tools. More than “in-house” and “on-premises”
attributes of technology companies with the generally, the IT infrastructure of virtual banks solutions, they reduce the level of control
banking and regulatory know-how and is moving into the cloud. that a financial institution has over its
credibility of a traditional bank, newly systems. As demonstrated by the Capital
formed virtual banks will be able to deliver Figure 1 sets out at a high level how the One and Amazon Web Services (AWS)
new and improved products and services. cloud infrastructure of a virtual bank may case, additional issues can arise in relation to
For some traditional banks, such be designed. the apportionment of responsibility and

Bank proprietary Third party

applications/APIs applications/APIs
(Bank hosted)
Bank’s cloud
(eg provided by
third party)

Banking Platform
(owned by or
licensed to bank)

Third party
applications/APIs
(Third party hosted)

Figure 1: IT infrastructure for Virtual Bank //29

HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

The Australian
National
Blockchain
This century will see the rise of digital infrastructure.
Just as the advent of physical infrastructure – such
as roads, electricity grids and telecommunications
hardware – sparked a new era of economic
productivity, the advent of digital infrastructure will
give rise to entirely new ways of doing business.

The recently released ACOLA report on the

“Effective and ethical development of Artificial
Intelligence” made the following key finding:

“AI is enabled by access to data. To support

successful implementation of AI, there is a need for
effective digital infrastructure, including data centres
and structures for data sharing, that makes AI
secure, trusted and accessible, … If such essential
infrastructure is not carefully and appropriately
developed, the advancement of AI and the immense
benefits it offers will be diminished.”

The Australian National Blockchain (ANB) is the

coordinated vision of Herbert Smith Freehills,
CSIRO’s Data61 (the data science arm of Australia’s
national science agency), King Wood Mallesons and
IBM to support our clients in their digital journeys
and the future use of smart legal contracts.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

liability in the event of a data breach. The obligations owed by a financial institution Regulatory guidelines have been designed
Furthermore, the multiplicity of vendors to a national regulator can vary from to assist regulated financial institutions with
involved can increase the risk of something jurisdiction to jurisdiction. However, many negotiating individual cloud agreements, on
going wrong and create additional problems service agreements are negotiated on a a case-by-case basis, and are underpinned
for allocating risk. regional if not global basis, with multinational by the principle that financial institutions
suppliers that are often unfamiliar with the must be ultimately responsible for their IT
Financial regulators have long since idiosyncratic regulatory requirements of a infrastructure. However, for a virtual bank,
provided financial institutions with detailed particular jurisdiction and that may be whose entire business model is focussed on
guidelines on technology and outsourcing unwilling to comply with the “highest partnerships and outsourcing, compliance
procurement. One of the reasons for such watermark”. This can make agreeing certain with such guidelines can be particularly
guidance is to ensure that customer data is provisions particularly difficult. For example, onerous and time consuming. This is
adequately protected. These guidelines the MAS Notice on Technology Risk particularly the case for fledgling virtual
apply to both traditional banks and virtual Management requires a financial institution banks, looking to negotiate with dozens and
banks, and cover the procurement of to notify MAS as soon as possible, but not dozens of IT suppliers, with tight
cloud-based solutions, which are usually later than 1 hour, upon the discovery of a timeframes, for the purposes of a timely a
seen as constituting a form of outsourcing. system malfunction or material IT security launch. As this model evolves, it will be
incident. While this is a legally binding interesting to see if governments, financial
At a high level, these guidelines require
requirement in Singapore, some multinational regulators or consumer watchdogs seek to
financial institutions to incorporate certain
suppliers will not commit to provide impose obligations on cloud service
provisions into their contractual
notifications within one hour. providers in addition to the obligations that
arrangements with IT vendors in order to
are currently imposed on traditional
mitigate key risks, including provisions such
financial institutions.
as audit and inspection rights, restrictions
on subcontracting, service level agreements
IT and cloud service
Finally, regulatory guidance is not legally
(SLAs), requirements around data providers are reluctant to binding in many cases and its
sovereignty, the processing of customer
data and information security, business take on uncapped liability implementation requires a careful review of
the circumstances, which can lead to
continuity and disaster recovery plans,
obligations to engage with regulators,
for data breaches (or uncertainty. For example, the MAS
Guidelines on Outsourcing (revised 5
incident notification requirements and provide appropriate October 2018) (MAS Outsourcing
monitoring rights. While these controls are
of central importance to the protection of
indemnity protection). Guidelines) provide that, “The extent and
degree to which an institution implements
customer data, traditional views on what the Guidelines should be commensurate
may constitute “adequate”, “reasonable” or While this may make “business sense”, it with the nature of risks in, and materiality
“practicable” contractual protections are places financial institutions in a difficult of, the outsourcing arrangement”. Similarly,
being challenged by the changing IT and position. Failure by IT and cloud service the HKMA’s General Principles for
cloud services landscape. As a result, it is providers to comply with obligations Technology Risk Management (TM-G-1)
becoming more difficult for financial regarding the processing of customer data (HKMA TRM Guidelines) provides that
institutions to implement existing and information security can cause losses financial institutions are “expected to
regulatory guidance strictly. that significantly exceed the “contract implement the relevant technology risk
value”, such as regulatory fines and damage management framework that is “fit for
The challenges to the reputation and brand of a financial purpose”, ie commensurate with the risks
Parts of the IT and cloud services sector are institution, not to mention the financial associated with the types of business and
dominated by a small number of players, losses and distress that may be caused to operations, the technologies adopted and
including some of the largest and most banking customers. the overall risk management systems of
sophisticated tech companies in the world, individual [financial institutions]”. As a
IT and cloud service providers are now result, it can be difficult for financial
such as Microsoft, Oracle, SAP, Google and
seeking broader rights to access and use the institutions to assess which of many
AWS. With thousands if not millions of
data of financial institutions (whether on an aspirational requirements set out in the
customers, these players are often unwilling
anonymised and aggregated basis or not) for regulatory guidelines are required in
to depart from their standard terms or grant
the purposes of developing and improving particular circumstances.
financial institutions the contractual rights
fintech products and services, including the
that they require to satisfy regulatory
development of AI and sophisticated data
guidance. For example, suppliers often resist
analytics tools. While these moves (along
broad-reaching audit and inspection rights
with various open banking initiatives) are
and controls on sub-contracting and
consistent with the aims of the virtual
assignment on the basis that such rights
banking revolution to “facilitate financial
would unduly interfere with their business.
innovation, enhance customer experience
Further, “off-the-shelf” cloud products may
and financial inclusion”, they require financial
not practically enable financial institutions to
institutions to divest further control of their
comply with the regulatory guidance without
data which may, if sufficient governance and
specific customisations or configurations
controls are not employed, increase the risk
made for the financial institution, which may
of data breaches.
come at significant additional cost to the
extent it is possible to do so.
//31
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Cloud-specific guidelines? institutions that fail to remedy “gaps” The accompanying documents to the
between what is being offered by a service Guidelines also set out the EBA’s analysis
These challenges call into question whether
provider, and what is required by the of a range of issues raised by market
financial regulators should be updating their
regulator, will bear the risks of data participants during the consultation
guidelines for use in a virtual banking world.
breaches and misuse. phase. In response to concerns that many
The MAS Outsourcing Guidelines, which cloud services are provided on a
Europe’s approach to multi-tenanted, standard terms basis, by
were last revised on 5 October 2018,
contain a section on cloud computing which outsourcing sector monopolists who are unwilling to
recognises the advantages and growth of comply with all relevant regulatory
Financial regulators in other jurisdictions
cloud based services, and how “different requirements, the EBA notes that financial
have provided more specific guidance on
cloud models provide for distinct operation institutions, “should comply with all
these issues. Earlier this year, the European
and security trade-offs”. MAS notes that regulatory requirements, including with
Banking Authority (EBA) released its
cloud services constitute a form of regard to their outsourced functions,
Guidelines on outsourcing arrangements.
outsourcing, and that financial institutions independent of the fact that they may be
The Guidelines come into force on
will be ultimately responsible and standardised or provided by monopolists”.
30 September 2019, with firms expected to
accountable for maintaining oversight of While this response does not provide
comply with the provisions by no later than
cloud services and managing the attendant financial institutions with the flexibility
31 December 2021. The Guidelines
risks of adopting cloud services as in any they are looking for, it nevertheless
integrate previously issued EBA
other form of outsourcing. However, the provides useful guidance to the EBA’s
Recommendations which aimed at
MAS Outsourcing Guidelines do not go so position on this subject.
“overcoming the high level of uncertainty
far as to address the issues set out above in regarding supervisory expectations on
Australia’s approach
relation to the processing of customer data. outsourcing to cloud service providers”.
to outsourcing
Among other things, the EBA recognises
At the time of writing this article, the “differences in national regulatory and The Australian Prudential Regulation
Association of Banks in Singapore (ABS) supervisory frameworks for cloud Authority (APRA) has published a number
released its “ABS Cloud Computing outsourcing” and encourages financial of prudential standards, including
Implementation Guide 2.0” for the financial institutions to adopt “internationally Prudential Standard CPS 231 Outsourcing,
industry in Singapore. The guide notes the accepted information security standards”. detailing the requirements of financial
rapid advancement of technology and institutions outsourcing a material business
market practice since 2016, the date of the In relation to sub-processing, the background activity, and Prudential Standard CPS 234
first version of ABS’ guide. The guide is notes to the Guidelines explain that, Information Security, which describes key
intended to assist financial institutions with requirements applicable to the protection
implementing cloud outsourcing of a financial institution’s information
arrangements (and cloud service providers “With regard to assets, including where such assets are
with better understanding the requirements
of financial institutions). Echoing MAS sub-outsourcing, cloud managed by a third party. These guidelines
include, amongst other things,
guidance, it notes, “the guiding principle
that controls in the Cloud must be at least
outsourcing is more requirements for outsourcing

as strong as those which the [financial dynamic in nature than arrangements to (i) include an indemnity
from the service provider in respect of its
institutions] would have implemented had
the operation been performed in-house
traditional outsourcing. sub-contracting, (ii) permit APRA to
access documentation, information and
should apply”. There is a need for sites, and (iii) address particular matters in
The HKMA TRM Guidelines, which were greater certainty about the agreement (including review
provisions, service levels and performance
last updated in June 2003, and the HKMA
Guidelines on Outsourcing SA-2, which the conditions under requirements, audit and monitoring
procedures, and offshoring arrangements).
were last updated in December 2001, do
not expressly engage with the issues
which subcontracting
In response to the “growing usage of cloud
presented by cloud services. Helpfully, the can take place, in computing services by APRA-regulated
Hong Kong Privacy Commissioner for
Personal Data (PCPD) released a Cloud particular in the case of entities, an increasing appetite for higher
inherent risk activities, as well as areas of
Computing Information Leaflet in July 2015 cloud outsourcing.” weakness identified as part of supervisory
which highlights some of the key concerns, activities”, in September 2018, APRA
including rapid trans-border data flows, published its ‘Information Paper:
loose outsourcing arrangements, The Guidelines provide that while
Outsourcing involving cloud computing
standardised services and contracts, and pre-approval for sub-processing is not
services’ (Paper). The Paper outlines
less control over IT infrastructure. While required, financial institutions should be
prudential considerations and key
the PCPD leaflet addresses some of the provided with ex ante notification in the
principles for consideration by financial
issues set out above in relation to the case of outsourcing of critical or important
institutions when adopting the use of cloud
processing of customer data, it concludes function, and that financial institutions
computing services.
(like MAS) that financial institutions are should always have the right to terminate
ultimately responsible for ensuring that the contract if planned changes to services Recognising that the risks associated with
their cloud arrangements meet regulatory would have an adverse effect on the risk cloud services will depend on the nature of
requirements, and that any financial assessment of the outsourced services. the usage of the services, APRA classifies
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

risks into three broad categories, with the itself as an enabler of innovation and has Natalie Curtis
expectation that all risks will be managed in been slow to regulate, instead focusing on Partner, Singapore
an appropriately commensurate manner. providing guidance to industry participants. T +65 6868 9805
The Paper provides guidance on APRA’s [email protected]
expectations for financial institutions For now, the new digital banks are subject
engaging in cloud services arrangements, to the same highly regulated banking
environment as traditional banks operate in. Julian Lincoln
identifies potential “observed weaknesses”
Of specific importance to digital banks is Partner, Melbourne
associated with cloud arrangements, has
guidance note G5 of 2014 issued by the T +61 3 9288 1694
regard to considerations such as “balancing
SARB which regulates the outsourcing of [email protected]
the needs of multiple customers with the
practicalities of not overburdening the functions within banks.
service provider”, and considers APRA’s Nick Pantlin
Similar to other jurisdictions, digital banks Partner, London
supervisory approach to these
which outsource large material functions to T +44 20 7466 2570
arrangements (for example, the need for
cloud and other technology providers need [email protected]
early engagement with APRA for
to comply with the guidance note. In
arrangements with “extreme inherent risk”).
addition, when material banking functions
are outsourced, the SARB needs to give its Mark Robinson
While the Paper does not constitute formal
permission. This is only given where the Partner, Singapore
regulation, it does support the need for
relevant bank is able to satisfy the SARB T +65 6868 9808
formalised guidance, and contemplates that
that the risks posed by the outsourcing will [email protected]
the principles identified will be reflected in
future guidance updates. be appropriately managed by the bank.
Rohan Isaacs
This is an area which APRA continues to Conclusion Consultant, Johannesburg
watch closely. For the reasons set out in this article, the case T +27 10 500 2667
is mounting for financial regulators in Asia to [email protected]
South Africa’s approach
revise and update the outsourcing (including
to outsourcing the procurement of cloud services) Harry Evans
2019 has been a big year for digital banks in regulatory guidance for virtual banks. Senior Associate, Singapore
South Africa, with two having already T +65 6868 8079
launched and a third set to commence For now, virtual banks remain fully [email protected]
operations soon. These startups have been responsible for complying with their
encouraged by a friendly regulatory regulatory obligations regarding data
environment designed to spur, rather than privacy and information security. They will
discourage, this form of innovation. need to consider all the circumstances
when engaging any given IT or cloud service
The banking regulator, the South African providers to ensure that, on a risk-adjusted
Reserve Bank (SARB), established a fintech basis, they can continue to comply with the
unit in 2017 which monitors developments existing regulatory obligations.
in the digital banking arena. The unit sees
//33
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Data vs “gut instinct”:

analytics in dispute resolution
The landscape for litigation analytics has never been more fast moving.
Specialist platforms threaten to disrupt what they see as a fossilised industry
with undue power and reward given to senior advisers who do not deign to look
at whether the evidence supports their subjective assessments.

A changing landscape shows that some three-quarters of applications to

the English Commercial Court for a freezing
Litigation has historically been seen as immune to
injunction are successful, at least in part. But it
invasion by data analytics, with sceptics arguing that
would be wrong to infer that English judges give
statistical analyses of past cases can never replace
them out readily: there is a degree of self-selection
the expertise and intuition of seasoned practitioners.
before applications are even made to weed out weak
Litigators have traditionally been reluctant to
and inappropriate applications that the final statistic
undertake a quantified analysis of data in their work,
cannot show. The track record of past cases cannot
preferring instead to rely on the expert judgement
slavishly be applied to a new case.
and years of experience that they (rightly) think
clients are paying for. Nonetheless, a number of Some in the legal sector are also uncomfortable with
players are exploring what data can tell us about the the notion of being measured in this way. Lawyers
uncertainties in litigation and arbitration, and the
who know their win rates will be published will
modern disputes adviser (whether in-house or
hardly be incentivised to accept instructions on
external) needs to be able to use these to the
“risky” cases. A new law in France has made it an
advantage of their commercial client.
offence to publish analytics on judicial decision
In the US, Premonition AI claims to hold the making, punishable by up to five years
“World’s Largest Litigation Database”, and proudly imprisonment. But on the other hand, others find the
states that it gives its clients an “unfair advantage in data analytics approach compelling and the cost
litigation” through its analysis of lawyers’ and judges’ benefits difficult to look past. The Estonian
track records. The North American scene is a busy government appears to be considering a pilot
one, with other vendors such as Dispute Resolution scheme to allow computerised models to adjudicate
Data and Blue J Legal proposing, to a greater or small contract disputes, in an effort to clear court
lesser extent, to forecast the outcome of your case backlogs. Undoubtedly, litigation funders who are
by a computerised analysis of past events. Inevitably keen to identify which investment opportunities
the sheer volume of US litigation and longevity of present the best risk-reward profile, will look at
serving judges yields a tempting pool of data in whatever data may be available.
which to try out analytical tools.
Informing the ‘base rate’
Dangers of eliminating the In England, a prominent contribution to the litigation
human touch analytics space has come from Solomonic, a young
There are of course many dangers to this approach. start-up co-founded by commercial barrister Gideon
The trial process is inherently human, especially in Cohen (and which Herbert Smith Freehills has
the US where jury trials are the norm. In any supported through its development). Solomonic
jurisdiction, in a factually contentious dispute where provides a platform that is both careful and
credibility of witnesses is key, there may be little to ambitious in its use of data. At present, it includes a
be gained from analysing how past cases have wide range of analytics on the judgments of current
unfolded. Indeed, a party that is too reliant on and recently retired Commercial Court judges and
statistical analysis may be misled into taking the allows the user to analyse those judgments in
wrong message from it. For instance, recent data various ways.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

“Litigation has historically been seen

as immune to invasion by data
analytics, with sceptics arguing that
statistical analyses of past cases can
never replace the expertise and
intuition of seasoned practitioners.”

//35
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

For instance, whilst the overall win rate for chances. If this data helps to encourage We have developed a cost prediction tool
claimants across the database is currently advisers and their clients to think about which uses the actual effort required to
about 60% (including partial successes), litigation risk in probability terms, there is execute different phases of past cases, and
that figure drops to about 37% for actions value simply in that, as research has shown cross-references these against other data
founded in negligence (and drops further, to that parties facing significant uncertainty points (value of claim, number of witnesses
about 18%, when one focuses on banking often display judgemental overconfidence, etc) to identify the relationships between
and finance cases). It is also possible to look and fail to price downside risk properly. lawyer hours (and therefore cost) and other
at whether a particular judge is an data points.
outlier—either generally or when faced with Our Decision Analysis team, a group of
particular types of claim. Users can analyse numerically driven disputes lawyers, have Using the cost prediction tool when a new
which textbooks appear to be most been supporting clients in their decision instruction is received, means that costs
frequently cited on a given issue, whether a making by building bespoke decision tree can be more reliably projected using
judge has tended to follow precedent or models to represent the risks inherent in the estimates (or agreed assumptions) about
distinguish prior cases, and which expert options under review. A critical component the key variables that appear to be
witnesses have been referred to in of the task is to attribute probabilities to correlated with effort to execute. This can
judgments (positively or otherwise). each separate point of uncertainty in the be used to support more reliable fixed or
litigation, rather than adopt an unscientific capped fee arrangements, or to enable the
The purpose here is not to say that a overall percentage prospects assessment. firm to cost proposals for contingency fee
negligence claim in a banking litigation This rigorous analysis of probability is a task arrangements (where permitted and sought
matter has only an 18% chance of for which the identification of a base rate by the client). Either way, the tool uses the
succeeding: it may be far higher (or lower) can be very helpful. firm’s substantial mine of timesheet data
than that. Rather, the point is to identify a from past cases to help clients better
“base rate”, being the rate at which past Not just about the merits manage their legal cost risk. Having been
actions of a similar type have succeeded, so Concerns about litigation risk do not stop piloted for English litigation cases, a module
the adviser can orient themself, study past with the merits: cost is another key issue is now being developed for global
cases, consider what might make the where clients expect their lawyers to make arbitration matters.
present case different, and assess its a well-reasoned prediction about the future.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

The need for (informed) lawyers and clients the data with which to Alexander Oddy
judgement inform analysis and guide strategy. That Partner, London
makes a material, incremental difference to T +44 20 7466 2407
Litigation of complex commercial and the quality of the decision-making over the [email protected]
financial disputes is sufficiently bound up in lifetime of a case.” Our experience echoes
human idiosyncrasies that the role of the this sentiment and we are leading the
astute and experienced practitioner will Donny Surtani
discussion on how to re-shape the delivery of
always be paramount. The ultimate decision Consultant, London
legal advice in a disputes context to reflect
maker is going to be a human, and it T +44 20 7466 2216
the evolving data-informed (but not yet
perhaps stands to reason that (for [email protected]
data-driven) paradigm. This poses challenges
non-commoditised work where each for in-house lawyers in banks and financial
dispute is at least somewhat unique) clients service providers to develop their respective
will rely upon another human to help them skills and become comfortable handling new
assess what might happen in a negotiation/ sources of information and receiving advice in
mediation or if the matter goes to trial. But new ways.
that is not to say that humans cannot get
guidance from the data and fine tune their
assessments accordingly.

Solomonic co-founder Cohen sees

commercial parties increasingly expecting
their lawyers to take the data into account
when applying their own expert analysis:
“We know that businesses want their
decisions to be informed by data. Litigation is
a final frontier, which had relied solely on
litigators’ intuition and experience. Now, the
growth of litigation analytics has given

//37
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Regulatory creep or convergence?

Competition law authorities as
financial services regulators
The division of regulatory responsibility between competition law authorities and
traditional financial services regulators is becoming increasingly blurred. Banks are
having to look at their “business as usual” activities through a new lens, knowing that
both competition law and financial conduct regulators are watching closely and
looking for opportunities to assert their authority.

Over the past year, competition law

authorities across the globe have continued to
government funding granted in December
2018. This dedicated branch complements
“The ACCC are already
scrutinise the financial services sector. This the ACCC’s existing Financial Services Unit pursuing numerous
shows no sign of slowing. New prosecutions which focuses on market studies in the
and investigations have been announced and financial services sector, such as the ongoing criminal charges in
competition authorities are actively building
their expertise in financial services. At the
inquiry into foreign currency conversion
services.
the financial
same time, traditional financial services
The ACCC anticipates that the Financial
services sector.”
regulators have been given specific
competition powers and mandates. Services Conduct Branch will complete a
number of in-depth investigations this year
The increasing prominence of competition potentially resulting in court proceedings.
law as a regulatory risk has had significant The ACCC’s Chairman, Rod Sims, has said
implications for the day-to-day compliance that two of the cases “go to the heart of
activities and business practices of banks. competition in banking” and will target the
“cosy oligopoly” of the financial services
Australia: double (regulatory) industry in Australia. Some of these cases
trouble for banks reportedly stem from the ACCC’s inquiry into
residential mortgage products which was
The recent Royal Commission into banking
finalised late last year.
and financial services in Australia was not
kind to Australia’s financial conduct regulator, The ACCC are already pursuing numerous
the Australian Securities and Investment criminal charges in the financial services
Commission (ASIC), which was criticised for sector. This includes charges against a
failing to take action against wrongdoing. In business and five individuals for allegedly
the wake of this criticism, there were calls fixing the Australian Dollar/Vietnamese
from prominent ex-regulators and Dong exchange rates as well as charges
government advisors to give Australia’s against ANZ, Citibank, Deutsche Bank and
competition authority, the Australian six senior officers for alleged cartel conduct
Competition and Consumer Commission in relation to an ANZ share placement.
(ACCC), a greater role in regulating banks.
The ACCC’s interest in the financial services
The Royal Commissioner ultimately resisted sector appears unlikely to wane any time
recommending that any of ASIC’s remit be soon. It recently lobbied the Australian
transferred to another regulator. However, Federal Government for a remit to conduct
this has not deterred the ACCC—its push into what has been described as a “deep dive”
financial services has gathered steam over inquiry into competition issues in the
the past year and it clearly sees itself as financial services sector. The Government
having an important and ongoing regulatory has pushed back on this request – so far – on
role to play. Earlier this year it established a the basis that the sector needs time to
dedicated “Financial Services Competition implement changes following the Royal
Branch”, aided by AU$35 million of Commission.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

//
//39
39
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

In addition to the threat of ACCC action, ongoing investigation into the financial Asian regulators look to
banks can expect more vigorous services sector. The CMA investigation is follow suit
enforcement activity from ASIC, which is believed to be a probe into collusive conduct
looking to reassert its authority. ASIC will Developments are more varied in Asia,
in bond trading, which the FCA passed to the
where competition law authorities are
now be obliged to consciously consider CMA (rather than investigating it itself) due
relatively young and regulation of financial
competition in the financial system, having to limitations in the FCA’s services remains more firmly with the more
been given an explicit reference to do so in competition-related resources and expertise. established financial sector regulators.
legislative amendments that took effect late
However, there have been some notable
last year. However, over the past 18 months the FCA
developments in this space.
has substantially ramped up its competition
This convergence of regulatory oversight enforcement functions, having issued 11 In Japan, the competition regulator (the
combined with an emboldened ACCC and an “advisory” letters on suspected breaches of JFTC) has reportedly clashed with the
under-pressure ASIC has significantly raised competition law and its first formal decision financial services regulator (the FSA) over
the spectre of enforcement risk for banks
under its competition enforcement powers. the review of mergers between regional
operating in Australia.
It has also appointed a new director of banks. Whilst the JFTC has been keen to
competition, Sheldon Mills, in late 2018. apply general principles and practices to the
United Kingdom: the FCA
Mr Mills was previously a senior director of review of regional banks, this has been at
sharpens its competition tools
mergers and state aid at the CMA. odds with the FSA’s encouragement of
The trend of competition law authorities consolidation amongst regional banks
pushing into financial services regulation is Whilst the FCA has many of the powers amidst unfavourable market conditions.
not unidirectional. Financial service generally granted to competition law Following very public remarks made by both
regulators are also building their competition regulators, it also has some unique regulators on the issue, the Prime Minister
law expertise. advantages in enforcing competition law Shinzo Abe has reportedly directed his
infringements. In particular, regulated firms government to review the application of
Unlike ASIC, the UK Financial Conduct have an explicit obligation to report merger control to regional banks.
Authority (FCA) has been granted powers to
suspected infringements to the FCA. In
enforce alleged or suspected infringements In China, the State Administration of Market
connection with its first competition
of UK competition law occurring in the Regulation (SAMR) has reportedly stated
enforcement decision earlier this year and that financial services and fintech are
financial sector.
fining two of the companies involved, the potential target sectors for antitrust
To date, the FCA has closely cooperated with FCA also fined an individual under the enforcement. There have been no
the UK competition regulator, the Financial Services and Markets Act 2000 for public reports of enforcement actions to
Competition and Market’s Authority (CMA), involvement in relevant conduct, signalling a date. However, we understand that a number
in the enforcement of anti-competitive willingness to draw upon its broader range of of financial institutions have received
conduct in the financial services sector. The enforcement powers in tackling competition questionnaires from SAMR, indicating
FCA and the CMA reportedly each have an law infringements. further developments may be on the horizon.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

In Hong Kong, the Competition Commission The pillars of an effective competition law
recently conducted a series of training compliance program for banks include: Sarah Benbow
sessions for various government officials and Partner, Melbourne
regulatory authorities focussed on financial ••Compliance policies, procedures and T +61 3 9288 1252
services, including the Securities and Futures guidelines: should be appropriately [email protected]
Commission (SFC) and the Hong Kong tailored so that the competition law
Monetary Authority (HKMA). Whilst these compliance obligations are practically
understood within the bank; Susan Black
regulators do not have concurrent
Partner, London
jurisdiction under the competition law ••Training: competition law training should T +44 20 7466 2055
regime, it is expected that they will work also be practical and appropriately tailored [email protected]
closely with the Competition Commission in and carried out on a regular basis;
targeting anti-competitive behaviour. Whilst
to date there have been no enforcement ••Culture of compliance: competition law Adelaide Luke
cases in the financial sector, the Competition compliance should be prioritised and Partner, Hong Kong
Commission has rejected an application for a encouraged from the most senior levels of T +852 2101 4135
decision that the Code of Banking Practice the bank and clear action taken to address [email protected]
should be exempt from the application of compliance failures;
competition law. ••Incentives: should be consistent with Andre Pretorius
competition law compliance (or at least Partner, London
Managing these risks not conducive to non-compliance); T +44 20 7466 2738
In this climate of heightened regulatory [email protected]
••Higher risk areas: should be identified
attention, banks should expect to interact within the bank to consider whether more
more frequently with competition law targeted and specific training or some
authorities. Appropriately managing form of monitoring is required.
these interactions can assist both the
financial sector and the relevant authorities
and beneficially set the tone of the wider
relationship.

An effective competition law compliance

program is also more important than ever for
banks – both in terms of helping to avoid
competition law infringements and to
mitigate any enforcement action or penalty if
an infringement does occur.
//41
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Data and cyber perils: personal

exposure and inadequate insurance
As data and cyber dangers loom large and breaches and incidents become the new norm, the
insurance market is in flux and there is a real risk of inadequate protection if great care is not
taken to keep up with the pace of change.

In today’s world, data breaches and cyber What risks do individuals face?
incidents in one form or another are
Data breaches or cyber incidents expose
increasingly common occurrences. The
individuals to a range of possible losses.
World Economic Forum has identified “data
The initial exposure, irrespective of whether

5.6%
fraud or theft” and “cyber attacks” as the
the individual is ultimately exonerated,
fourth and fifth most likely global risks in its
could be liability for eye-wateringly high
2019 Global Risks Report. This year has
already seen the UK’s data protection
authority, the ICO, announce that it
Increase legal fees for defending the individual
against regulatory investigations or claims.
IN GLOBAL “FINANCIAL AND In some cases, such as cross-border
proposes to levy record-breaking fines for PROFESSIONAL LINE PRICING
investigations or class actions, costs can far
breaches of the General Data Protection (PRIMARILY D&O)” IN Q1 2019
exceed what an individual can afford. Fees
Regulation (GDPR) on British Airways (£193 MARSH GLOBAL INSURANCE could potentially be followed by further
million) and Marriott International (£99 MARKET INDEX
liabilities and fines. We look at some
million) as a result of data breaches.
examples below:
However, whilst data and cyber incidents
are towards the top of the risk register for “DATA FRAUD OR THEFT” IS ••Regulatory investigations: in various
many corporates, directors and officers can
easily overlook the potentially significant the 4th
MOST LIKELY
jurisdictions, data protection authorities,
financial services regulators and other
personal exposures they can face as a result official bodies have powers to investigate,
of these perils.
global sanction, or impose fines and penalties
on individuals or require them to produce
As we detail in this article, directors and
officers can face claims, investigations and risk documents or attend interviews. In
the UK, for example, the ICO can
fines in their personal capacity as a result of (2019 GLOBAL RISKS REPORT investigate and impose significant fines
data/cyber incidents. In many cases the WORLD ECONOMIC FORUM) on individuals who are data “controllers”
company will indemnify or fund them and “processors” for breaches of data
against these exposures; but sometimes it protection law. The financial services
may be unable or unwilling to do so. That regulators, the PRA and FCA, can likewise
can leave individuals having to self-fund do so where prudential or conduct
very large sums unless they have issues are involved. Financial services
appropriate insurance. Many will assume regulators around the globe, including
that their insurance team or broker has those in the UK, Spain, Hong Kong and
arranged adequate cover. That may be so, Australia, have in recent years also rolled
but the insurance market is evolving quickly; out senior management accountability or
and the more that can be done by individual accountability regimes, which
individuals to test that the best protections aim to clarify the responsibilities of senior
are in place, the better, particularly where management and other key responsible
personal assets are on the line. individuals (with similar regimes expected
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

shortly in Singapore and Malaysia). These “Recently, a securities class action ••Cyber policies do not cover all risks nor
regimes make it easier to hold individuals do companies necessarily purchase the
to account for breaches of regulatory
lawsuit was filed against FedEx in widest possible cover. There are
requirements occurring within their which the claimants allege that inconsistencies between whether
sphere of responsibility. the company and certain coverage applies only for data breaches
and security failures or also a broader
••Third party claims: directors and directors did not fully disclose range of perils such as system failures,
officers can face personal liability to
third parties. Such claims fall broadly
the extent of the disruption at its payments made following non-invasive
newly-acquired Netherlands email scams, or for issues arising in the
into two categories: (i) claims by
computer systems of a connected party
persons directly affected by the incident based operation as a result of the such as an outsource provider or a
(eg victims of the data breach); and
(ii) claims by shareholders and investors NotPetya malware virus in 2017.” contractor. Put simply, just because an
incident is cyber related does not mean
for losses in share/investment value The role of insurance any particular cyber policy applies.
resulting from a data breach, for which
The potential exposures identified above Improvements, however, are being
they hold the management of the
can place a considerable financial burden made to the scope and quality of
company responsible. Both types of
on individuals. The importance of having wordings and there is greater market
claim may manifest as class actions.
adequate insurance cover for investigation capacity and hence greater limits
The first UK data breach class action is
and defence costs and other losses cannot available in the market.
currently on appeal to the Supreme
Court and in the US shareholder class be overstated. So where can it be found? ••The scope and quality of the wordings is
actions are particularly common. Similar not necessarily consistent between
class actions can be anticipated in other Cyber insurance policies. For example, in some policies
jurisdictions. The associated costs and Cyber insurance can be part of the answer. coverage does not apply for individuals
liabilities may reach both Policies may cover individuals for (as opposed to the company); and where
bet-the-individual and investigations and claims relating to data coverage does apply, it might not be
bet-the-company levels. breaches and cyber incidents. Significantly, possible to access the cover, particularly if
it is widely reported that cyber policy claims the wording has not been reviewed to
••Insolvency events: in a worst case
are being paid in large numbers despite the check it is written on best terms. On a
scenario, a significant cyber/data breach
relative immaturity of the market in most poor wording, an individual might in
could lead to a company’s insolvency, and
jurisdictions other than the USA. principle be deprived of cover for
directors and officers may need to
relatively trivial or inadvertent
respond to third party claims and
However, it would not be safe for individuals non-compliance with policy terms.
investigations by insolvency practitioners,
to presume they are comprehensively
regulators or other bodies. In these ••The amount of cover purchased or
covered by their company’s cyber policy.
situations, any funding that the individual available varies and there might not
Many companies do not (yet) buy cyber
might have had from a solvent company be enough cover as aggregate limits or
insurance, although the trend is that they are
would, in most jurisdictions, fall away. sub-limits are usually shared with
increasingly doing so. Where companies do
Insurance would be the only protection other insureds.
have such policies, coverage varies
available to the individual.
considerably. A few notes of caution then:

//43
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

••Not all losses may be insurable January 2019 the PRA wrote to the major that the company’s insurance programme
irrespective of what the policy says. In UK insurers urging them again to address must be reviewed holistically. Insureds ought
particular, in some jurisdictions, such as the market’s non-affirmative exposure to to identify:
England, there is debate over whether cyber risks; and in June, the International
••the potential data and cyber risks;
some or all data protection fines are Underwriting Association published two
insurable; and in other jurisdictions it is model clauses intended for use in ••the policies under which such risks are
clear they are not. Even that might be non-cyber policies which operate to exclude intended to be covered; and
fixed if the policy were to assess coverage cover for any “Cyber Loss”.
••any gaps in relation to material risk.
for fines and penalties by reference to
laws under which they are insurable. The current position in the London market
has been explained by Francis Kean, This review should be stress tested as part
Despite the issues above, our impression is Executive Director, FINEX at international of the company’s wider crisis or risk
that it is rare that a director or officer asks insurance broker Willis Towers Watson, management strategy, examining what
not only whether the company has as follows: losses would arise that may impact
purchased cyber insurance but also individuals in a given factual scenario and
whether the policy has sufficiently broad what policy coverage may apply.
“Insurers are grappling with their
scope, good quality wording and financial
limits to provide maximum protection for exposure to non-affirmative cyber Conclusion
individuals as well as the company. cover. Wordings are being As the insurance market adjusts to account
Directors and officers (D&O) updated in the D&O market to for looming data and cyber perils, it is
crucial that directors and officers ensure
liability insurance include affirmative cyber cover that they carefully assess their personal and
D&O policies typically respond to claims and we aren’t (yet) seeing cyber corporate risk profile and match this risk
and investigations against individuals in their exclusions. However, the devil assessment with an appropriate
capacity as directors and officers of the combination of insurance products. Cyber
company. They may provide may be in the detail: if broad cover insurance is a starting point but will not
complementary cover to cyber insurance. is the intention, then care must be provide adequate protection by itself. As
Currently, D&O insurance will often provide such, insurance arrangements should be
taken to ensure that affirmative
“silent” or “non-affirmative” cover against examined holistically to ensure that, to the
losses stemming from data or cyber risks, cover clauses do not inadvertently extent it can reasonably be achieved, no
even when not referenced directly in the carve out or sub-limit cyber cover areas of exposure are left out of scope
policy wording. For example, if a director or under one policy without being addressed
officer were investigated for regulatory
that already existed. On the other under another.
breaches regarding oversight of hand, in other lines, such as crime
cybersecurity or systems in the company, or and professional indemnity, we Greig Anderson
asked to attend an interview with an official
body enquiring into the same incident, cover are already seeing insurers Partner, London
may be available under the D&O policy’s starting to narrow coverage for T +44 20 7466 2229
regulatory investigations cover, absent an [email protected]
cyber perils”.
exclusion for cyber related incidents.
What can be done about Alexander Oddy
D&O insurance is more of a commoditised Partner, London
insurance gaps and
product than cyber insurance and best in T +44 20 7466 2407
inconsistencies?
class wordings have expanded considerably [email protected]
in the soft (buyer friendly) market that has The answer is straightforward: as the
prevailed in recent years. But caution ought market moves, it will be essential to review
to be exercised: change may be afoot for wordings year on year to ensure that, price Antonia Pegden
two reasons. First, the D&O market has permitting, best in class cover is purchased Senior Associate, London
now started to harden considerably in light at all times. In particular, a close watch T +44 20 7466 2530
of poor loss ratios reportedly driving up should be applied to whether coverage [email protected]
prices and causing insurers to scrutinise against data and cyber-related claims has
claims more carefully. Marsh reported a been expressly or inadvertently
5.6% global increase in D&O premiums in narrowed—and the question asked whether
Q1 2019. This could possibly cause the any new covers or extensions are available.
scope of wordings, including for cyber risk,
to contract if the harder market continues Individuals may be covered on an affirmative
to prevail over time. Individuals will or non-affirmative basis against losses arising
therefore need to scrutinise their cover from data and cyber perils under a wide
wording more carefully. range of other policies (such as PI insurance
in relation to financial and professional
Second, there is pressure on insurers in services claims and investigations). While a
some jurisdictions to deal with coverage for detailed look at those policies is outside the
cyber perils expressly and to price it. In scope of this article, the overall message is
//45
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Away from prying eyes: data security

in international dispute resolution
The dispute resolution process is an attractive target for hackers and a key—but frequently
underestimated—area of risk. During any formal dispute resolution process, banks create and
share large amounts of data. If this data were to become public, it could cause reputational
damage, influence share prices or provoke regulatory scrutiny.

International arbitration is an increasingly popular

29%
method of dispute resolution in international
finance transactions. In 2018, 29% of all cases
in the London Court of International Arbitration
(LCIA) involved parties in the banking and finance BANKING AND
FINANCE
sector, a higher proportion than any other single
sector1

Where does your data go?

Arbitration is a private method of dispute
resolution where a tribunal, usually of one or three
arbitrators, makes a binding decision on a dispute.
Arbitration clauses typically provide that the 19%
arbitration will be conducted under the rules of, ENERGY AND
and administered by, a neutral arbitral institution. RESOURCES

A typical arbitration involves various participants

ranging from the parties, law firms, and arbitrators,
to arbitral institutions and third parties such
experts, witnesses and service providers.

Each of these participants in the arbitration

14%
TRANSPORT AND
process is likely to hold your data. Clients and their COMMODITIES
legal advisers will generally share information
and discuss drafting points and strategy by
email. Pleadings, evidence, expert reports and
witness statements are also often exchanged
electronically with arbitrators, the other side's 10%
legal advisers, experts, witnesses, arbitral CONSTRUCTION AND
institutions and third party service providers. INFRASTRUCTURE
Document review and production regularly takes
place on electronic data hosting platforms, usually

7%
owned by third party service providers. An award
will be drafted, discussed and exchanged between
the different members of an arbitral tribunal
and may also be sent to the arbitral institution PROFESSIONAL
SERVICES
administering the arbitration, before being sent to
counsel and the parties.
21% OTHER

1. LCIA 2018 Annual Casework Report

THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

“ Each participant represents a fresh target

for cyber attackers and a potential point
of weakness in relation to the security of
arbitration data.”

//47
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

Once data has been sent electronically in

the course of an arbitration, the sender can
no longer monitor or ensure its security. Increasing use of arbitration in
While some arbitrators operate from within
banking and finance
law firms or chambers, others are sole
“Agreeing to arbitration allows a (ii) confidentiality is a concern; (iii)
traders who may have in place more limited
party to avoid having to litigate in a the counterparty is a state-owned
cybersecurity protections. The same could
jurisdiction in whose courts it does entity; and (iv) the counterparty is in
be said of expert witnesses and some fact
witnesses who receive and store data on not have confidence, while producing a jurisdiction where the recognition of
their personal devices. Careful an arbitral award which may have foreign judgments is problematic or
consideration needs to be given by all an advantage over a foreign court where it is expected that enforcement
stakeholders in an arbitration to avoid judgment at the enforcement stage in of an arbitral award under the New
such participants being a weak link in the many jurisdictions.” York Convention will be easier than
chain of custody. 2018 ISDA ARBITRATION GUIDE enforcement of a court judgment.”

According to the UNCTAD (United Nations “Financial institutions tend to favour THE INTERNATIONAL CHAMBER OF
Conference on Trade and Development), COMMERCE’S COMMISSION REPORT ON
arbitration when: (i) the transaction FINANCIAL INSTITUTIONS AND
there have been at least 80 investor-state is significant or particularly complex; INTERNATIONAL ARBITRATION (MARCH 2018)
arbitration proceedings relating to the
financial service sector.
How likely is it that international LIKELY 56%
Ensuring your data is secure arbitration will increasingly be
In international arbitration, parties can used to resolve cross-border
expect to have significant input on NO VIEW 23%
disputes in banking and finance?
procedural matters. It is not yet
commonplace for tribunals to make orders UNLIKELY 21%
on cybersecurity, although this is likely to
change, and therefore the onus (and the QUEEN MARY UNIVERSITY OF LONDON AND WHITE & CASE, 2018 INTERNATIONAL ARBITRATION
SURVEY: THE EVOLUTION OF INTERNATIONAL ARBITRATION
opportunity) to suggest measures to
protect data in the arbitration will be on the
parties. Below are some practical steps
banks can take working with external
Where cybersecurity is critical, it may be a Implementing cybersecurity measures
counsel in an arbitration.
consideration in nominating an arbitrator. It
Following a risk assessment, the next step
Cybersecurity risk assessment may be sensible to send a checklist of
will be to formalise measures to protect
cybersecurity-related questions to
Before commencing an arbitration (if the data in the arbitration. This may take the
arbitrators before or immediately after
bank is the claimant) or immediately once form of a protocol signed by the parties and
nomination or appointment. The answers to
the bank is notified of an arbitration (if it is the tribunal or an order passed by the
such a checklist (or a failure to answer)
the respondent), consider carrying out a risk tribunal covering matters such as:
might lead to concerns that need to be
assessment with your legal advisers. This addressed before the arbitrator's ••Specifying how communications will take
should involve an assessment of whether appointment is confirmed. place between the parties and the
data likely to be relevant to the arbitration is
tribunal, between the tribunal members
••commercially sensitive, and with other participants; through
Who might want your data? password protected email or by secure
••involves customer, employee or other third
••Hacktivists seeking to further a file transfer systems
party data that the banks may be required
to protect (eg under the EU General Data social or political cause. ••Using a secure platform for the
Protection Regulation (GDPR)), or ••State Actors pursuing information to transmission of large volumes of
advance their own political agenda. documents relating to the case or
••confidential data or data that is market
sensitive documents
sensitive. The risk assessment should ••Cybercriminals perpetrating cyber
inform what approach should be taken attacks for monetary gain.
to collection, storage and review of
that data. ••Unscrupulous opponents in the
proceedings.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

••Reducing the use of paper documents Nicholas Peacock

(which represent a confidentiality risk) Increasing focus on cybersecurity Partner, London
and/or a protocol for their storage in international arbitration T +44 20 7466 2803
[email protected]
••Redaction of certain categories of data or ••The International Bar Association
particularly sensitive information and the International Council for
unrelated to the dispute Commercial Arbitration have set up May Tai
a task force to develop practical Partner, Hong Kong
••Reducing access to certain categories
guidance on data protection in T +852 2101 4031
of data
international arbitration. [email protected]
••Reducing unnecessary disclosure
••The International Chamber of
••Breach detection, notification Commerce has published a note to Brenda Horrigan
and mitigation parties emphasising the Partner, Sydney
importance of complying with the T +61 2 9225 5536
••Allocation of liability and penalties that
GDPR in arbitration proceedings, [email protected]
will apply in the event of a breach
including in relation to collecting
(although this may be hard to negotiate
data from witnesses, experts and
in practice)
other individuals.
••Insurance against breach
••The Hong Kong International
••Document retention and destruction Arbitration Centre has adopted new
rules allowing service of documents
via a secure online platform instead
of over email.
••Herbert Smith Freehills is
spearheading a collaboration with a
number of global law firms to look at
the development of an arbitration-
specific online platform to help
protect arbitration data in  future.

//49
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

IBOR transition: a data challenge

It is clear that the transition from London Inter-bank Offered Rate (LIBOR) together with all other
significant Inter-bank Offered Rates (IBORs) is “happening” and represents a significant challenge for
all financial institutions. Firms will require significant support in the transition and, in respect of the
transition involving legacy financial product contracts, at the core of the exercise will be the efficient
and effective collection and management of data from hundreds of thousands of existing contracts.

IBOR transition Given the significance of LIBOR in London and involving various IT platforms
across major currencies and the IBOR (including legacy systems) and data
IBOR transition teams across the globe are
manipulation scandals, the FCA and sources (potentially including hard copy
currently grappling with the difficulties
Prudential Regulation Authority (PRA) are data). Some firms may be able to automate
posed by transition from IBOR benchmark
generally regarded as leading the pack on part of this process, but the position may
rates to risk free rate alternatives (RFRs). For IBOR discontinuation. However, because of vary across products and many will need to
most, if not all, this will involve a large due the widespread reliance on LIBOR and the extract the key information needed
diligence and data collation exercise to sheer scale of the repapering task involved, manually in order to understand the risk of
assess their exposure, before defining the it is perhaps unsurprising the FCA and PRA exposure (eg maturity dates, notional
parameters of a repapering and customer have reported a real divergence across the values and the existing contractual fallbacks
outreach programme. This is happening at a UK market in terms of preparedness for which will operate if there is no
time when the goal posts are still moving LIBOR discontinuation. In particular, this is amendment). This will require considerable
and there is a high level of uncertainty because of the need to transition not just time and effort, and may affect the
across all affected markets. The best new business, but also to convert accuracy of the data collated and therefore
prepared are now engaging with suppliers to outstanding legacy LIBOR contracts, which the robustness of the firm’s risk assessment
develop large-scale transition programmes has been recognised by the regulators to be of IBOR transition.
comprising data collation, due diligence, harder in some markets than others (eg the
data analysis and client outreach platforms. bond market, where consent solicitations The due diligence process will also
are required). The same difficulties apply to present specific data protection
In this article, we consider a number of the
markets in other jurisdictions, where challenges. Data privacy legislation
key issues involved in IBOR transition
regulators are pursuing their own means to around the world, including the General
through a data lens. In particular, we look at
bring about the required market changes, Data Protection Regulation (GDPR) in
the scope of the due diligence and
and in relation to other IBORs. For example, Europe, may restrict the international
repapering process for financial institutions,
in Hong Kong, the Hong Kong Monetary transfer of personal data without
the insights shared by the regulators as to
Authority is actively engaging with market appropriate safeguards being in place. In
what represents good practice in this
participants to make preparations for addition, jurisdictions such as Hong Kong
regard, and potential risks for financial IBOR transition. have data localisation laws requiring data
institutions even where they are sufficiently
or a copy of data to be stored “in-country”.
prepared in the eyes of the regulator. Due diligence and Firms will need specialist advice how to
repapering exercise transfer data around the world within their
Preparedness for LIBOR
discontinuation Many firms have commenced their IBOR organisations in a compliant manner for
due diligence as a first step in transitioning their transition programmes.
Regulators globally have been dialling up legacy contracts (being the focus of this
the pressure on financial institutions to article noting that transition will not only The documents collated will then need to
make sure they are taking appropriate steps impact contracts, but also pricing and risk be sampled to identify defined categories
to prepare for life after IBORs cease. For models etc), adopting different approaches of contract, based on parameters such
LIBOR, this was the recent message from to outsourcing some or all of the work as product type, fallback wording,
Andrew Bailey, Chief Executive of the involved, depending on variables such maturity date etc. This will enable the
Financial Conduct Authority (FCA), at a as the volume of contracts, value total population of contracts to be
LIBOR Transition Briefing in New York on 15 and complexity. categorised accordingly. It is possible to
July 2019.1 The speech marked two years use technology to adopt a systematic
since the FCA first confirmed that it will no For a number of financial institutions, the approach where appropriate, although
longer compel banks to continue to provide due diligence phase will involve large scale this is unlikely to remove the need for
quotes for LIBOR after the end of 2021.2 data collation across multiple jurisdictions detailed manual oversight, particularly
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

“Whilst NatWest has closed a

number of SONIA-referenced loans
on a bilateral basis and is currently
engaged in developing a SONIA-
referenced club transaction, we
would welcome the intervention of
the FCA in facilitating conversations
between market participants to
establish wider SONIA-referenced
lending capability in both the
bilateral and syndicated markets, to
lead on timing and to work on
eradicating blockers. Customer and
market awareness of how SONIA
works is growing but a wider
cascade of SONIA conventions
would encourage greater adoption
across cash markets.”
JAMIESON THROWER, NATWEST, LIBOR TRANSITION
BUSINESS LEAD FOR COMMERCIAL BANKING

//51
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

in the early stages when the scoping It is worth considering the scale of the regulators commented that in “stronger
parameters are set and as yet there is no challenge which IBOR transition represent responses” firms were identifying reliance
one-size-fits-all technology to perform – firms will have thousands (if not tens of on and use of LIBOR beyond a firm’s balance
these exercises as each firm will have its thousands) of contracts which contain sheet exposure and assessing (for example)
own needs and approach. reference to IBORs across different whether LIBOR is present in the pricing,
products and geographies. Unless the valuation, risk management and booking
“NatWest has commenced its regulatory stance softens, all these infrastructure firms use. The regulators
legacy contracts need to be amended, are looking for transition project plans
due diligence exercise. The use of involving a large scale due diligence and with sufficient granularity of detail and the
technology on this workstream is client outreach programme. The financial nomination of a senior executive responsible
industry has grappled with similar large for transition (covered by the Senior Manger
instrumental in organising the scale repapering exercises recently Regime) whose role is clearly defined.
information contained in a large (such as GPDR and Markets in Financial
They expect firms to identify prudential and
universe of affected contracts so Instruments Directive (MiFID II)) however,
the difference with IBOR transition is that conduct risks; and to manage those risks on
that we can inform our the amendments will result in economic the basis of LIBOR discontinuation at the end
repapering strategy and work changes to existing transactions, which of 2021 rather than assuming it will continue
places greater emphasis on the need for in some form thereafter.5
with affected customers in the
firms to conduct careful diligence and
most effective way.” customer outreach programmes.
In other jurisdictions, similar forms of
Dear CEO letters have been issued asking
JAMIESON THROWER, NATWEST,
LIBOR TRANSITION BUSINESS LEAD Insights from the regulators for confirmation of IBOR discontinuation
FOR COMMERCIAL BANKING preparedness, most notably in mainland
Globally, regulators are at different stages of
Europe6, Hong Kong7 and Australia8.
This could remove some documents from engagement with their respective markets.
No feedback has yet been published by
the scope of the repapering exercise, for As mentioned, UK regulators have indicated
regulators in these jurisdictions. However, it
example if they contain an acceptable that not all financial institutions are taking
is not expected that the responses will differ
fall-back or if they mature before 2021 appropriate action to prepare for LIBOR
markedly from those in the UK given that
(or sufficiently soon after that date to be discontinuation, identifying areas of varying
many of the financial institutions involved
low risk). For those remaining contracts, practice across market participants.
operate globally.
firms will need to move into the client
In September 2018, the FCA and PRA
outreach and repapering phase. This Litigation risks
issued a “Dear CEO”3 letter to large banks
will involve more strategic aspects,
and insurance companies, asking for details
such as identifying replacement fallback The demise of IBORs presents risks which
of those firms’ preparations and actions
provisions (based on industry solutions will impact even the most prepared financial
to manage transitioning from LIBOR to
if available); categorising products by institutions. This is because, absent a
alternative interest rate benchmarks (SONIA
sophistication of customer, complexity, statutory fix, there will likely be a rump of
in the UK).
value etc; the appropriate manner of client legacy contracts which is not possible to
execution/consent; and method of client In a joint statement4 setting out their key amend even if efforts are made to do so. This
communication, to name a few. observations from responses received, the risk is recognised by regulators and has been
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

referred to as the “tough legacy” question.9 Evolving regulatory landscape Conclusion

It is likely to affect different markets to
Regulators have repeatedly emphasised The uncertainties may not impact the data
varying degrees. For example, theoretically
that market participants should operate on collection stage, but have the potential to
the risk should be lower in the derivatives
the basis that LIBOR will cease at the end of affect both due diligence and data analysis,
market, where the International Swaps and
2021. However, in Andrew Bailey’s speech as well as any client outreach. For example,
Derivatives Association (ISDA) intends to
on 15 July 2019, he identified the possible if primary legislation is an option for legacy
publish a protocol or set of protocols to
option of a legislative fix for legacy contracts, this would of course impact risk
amend legacy contracts. However, this will
contracts, eg redefining LIBOR as the assessment, as it would significantly alter
only take effect where both parties to the
relevant RFR plus fixed spread. Although he the transition risk for legacy contracts
contract have adhered to the protocol, and
emphasised that this option could not be entered into prior to a specified date.
there are various reasons why parties may
relied upon as being deliverable, he Market participants are therefore in the
not adhere to that protocol.
suggested that there would be consultation unenviable position of carrying out a due
A significant source of risk is likely to stem on this option in 2019. diligence and repapering process while
from the fact that converting LIBOR simultaneously monitoring the evolving
contracts into contracts referencing “NatWest supports Andrew regulatory landscape which will define the
alternative RFRs is not “present value parameters of the very client outreach
Bailey’s recent comments in programme they are designing. The
neutral”, because the alternative RFR may
be inherently lower than LIBOR. The this regard and we will actively transition itself is likely to take years not
potential for value transfer (even allowing participate in the legislative months, and occupy a significant proportion
the potential for a fixed spread adjustment of the market, as participants adapt to the
consultation when published. consequences of an IBOR-free world.
to mitigate this) means that some
counterparties may be reluctant to switch, We also see the establishment
or see it as an opportunity to renegotiate of a consistent adjustment
the commercial deal. This could lead to a Hannah Cassidy
stand-off between the parties, reducing
spread, together with
Partner, Hong Kong
the effectiveness of attempts to amend appropriate fallback wording +852 2101 4133
legacy contracts. for existing loan products, as [email protected]

Fast forward to a world where LIBOR no key to accelerating the adoption

longer exists, and the result will be that of SONIA-referenced lending Harry Edwards
those legacy contracts then rely upon Partner, London
legacy fallback language which was never
and the development of a +44 20 7466 2221
intended to operate following a permanent syndicated market.” [email protected]
cessation of the reference rate. Whatever JAMIESON THROWER, NATWEST,
the applicable fallback, this presents LIBOR TRANSITION BUSINESS LEAD Nick May
significant litigation risk for financial FOR COMMERCIAL BANKING
Partner, London
institutions because of the clear potential A number of market-specific consultations +44 20 7466 2617
for “winners” and “losers” as a result of the are also in progress this year, for example [email protected]
transition from LIBOR.10 Dependent on the ISDA’s consultation on pre-cessation issues
type of fallback, there is also a risk of claims for LIBOR and the precise approach for the Jenny Stainsby
on the basis that the nature of the relevant spread adjustment to mitigate the value Partner, London
product is substantially altered. transfer in derivative contracts. +44 20 7466 2995
[email protected]
1. Andrew Bailey, speech on 15 July 2019: LIBOR: preparing for the end, www.fca.org.uk/print/news/
speeches/libor-preparing-end
2. Andrew Bailey, speech on 27 July 2017: The future of LIBOR, www.fca.org.uk/news/speeches/ Gabrielle Wong
the-future-of-libor Partner, London
3. PRA & FCA, Dear CEO Letter, www.fca.org.uk/publication/correspondence/dear-ceo-letter-transition-
+44 20 7466 2144
from-libor-banks.pdf
4. PRA & FCA Joint Statement, Firms’ preparations for transition from London InterBank Offered Rate (LIBOR) [email protected]
to risk-free rates (RFRs), www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/
publication/2019/firms-preparations-for-transition-from-libor-to-risk-free-rates.pdf?la=en&hash=EA87B
D3B8435B7EDF25A56C932C362C65D516577
Ceri Morgan
5. See our banking litigation blog post for a more detailed analysis of this feedback: www.hsfnotes.com/ Professional Support
bankinglitigation/2019/06/06/libor-discontinuation-fca-thematic-feedback-on-responses-to-dear-ceo- Lawyer, London
letter/ +44 20 7466 2948
6. European Central Bank Letter, Banks’ preparation with regard to interest rate benchmark reforms and the
[email protected]
use of risk-free rates, www.bankingsupervision.europa.eu/press/letterstobanks/shared/pdf/2019/ssm.
benchmark_rate_reforms_201907.en.pdf?8f331a1bb36298a22adcb65e5c41bc8b
7. Hong Kong Monetary Authority Letter, Reform of Interest Rate Benchmarks, www.hkma.gov.hk/media/
eng/doc/key-information/guidelines-and-circular/2019/20190305e1.pdf
8. Reserve Bank of Australia, Regulators Urge Financial Institutions to Plan for LIBOR Transition, www.rba.gov.
au/media-releases/2019/mr-19-12.html
9. Andrew Bailey, speech on 5 June 2019: Last Orders: Calling Time on LIBOR, www.bankofengland.co.uk/
events/2019/june/last-orders-calling-time-on-libor
10. Discussed further in our article: www.herbertsmithfreehills.com/latest-thinking/libor-is-being-overtaken-
will-it-be-a-car-crash //53
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

The emergence of the “super-regulator”:

the lasting legacy of the Australian
Banking Royal Commission
Although the Australian Government has announced its intention to take action on all 76 recommendations
set out in the Royal Commission’s final report, none of these are set to cause the same tectonic shift in the
sector than that caused by the changing approach of regulators, particularly the Australian Securities and
Investments Commission (ASIC).

The Royal Commission’s final report, for all of The shift towards stronger
the publicity and commentary it generated, regulator enforcement
contained themes and recommendations that
While ASIC did not wait until the release
were not unexpected or new in the global
of the Royal Commission’s final report on
landscape. It is a sign of changing times that,
4 February 2019 to ramp up its investigations, BETWEEN JULY 2018
even in jest, the new chair of Australia’s
the shift has been a noticeable one. We are TO JULY 2019
corporate regulator, ASIC, could be likened to a
fictional superhero by Senator Hume, Chair of
seeing a sustained increase in the number of THERE HAS BEEN A
investigations and monitoring initiatives
the Senate Economics Legislation Committee.
targeted at financial institutions, as well as
Previously, ASIC has been described as a
“timid and hesitant”1 regulator with an
innovation in the approach.

As the number of ASIC investigations

216%
INCREASE IN
“ineffective enforcement culture”2, “that rarely increases, more criminal and civil proceedings ASIC WEALTH MANAGEMENT
went to court to seek public denunciation of are expected. The fallout from the Royal
INVESTIGATIONS
and punishment for misconduct.”3 However,

55%
Commission is, largely, yet to be played out in
under intense scrutiny, ASIC now has the courts, but there is little doubt, it will
increased resources (including come. Aside from the sheer volume of
AU$400 million in additional funding); has INCREASE IN ASIC
matters, there has also been a shift in ENFORCEMENT INVESTIGATIONS
hired more staff; and adopted a “why not approach. The banks are facing increased and INVOLVING THE SIX MAJOR
litigate?” approach. It has set about sharpening more significant demands for production of FINANCIAL INSTITUTIONS
its enforcement culture and is planning the documents—in less time—than ever before. (OR THEIR OFFICERS OR
SUBSIDIARY COMPANIES)
functional separation of its enforcement
In a world of “big data”, and having invested

20%
activities by setting up an Office of
Enforcement (a separation that the US significantly in data analytics, ASIC seems
Securities and Exchange Commission (SEC) unafraid of the large volume of materials it is
receiving in response to regulatory notices. INCREASE IN THE NUMBER OF
has had in place since 1972). These, and ASIC ENFORCEMENT
other initiatives, may bring aspects of ASIC’s INVESTIGATIONS
This new environment allows little
work more in line with regulatory

13
scope for banks to negotiate with the
approaches adopted by its larger regulator. Previously, it was common specific
international counterparts. for investigations to resolve in either an referrals
WERE MADE TO
enforceable undertaking; or if proceedings
The Australian Prudential Regulation Authority ASIC BY THE ROYAL COMMISSION
were commenced, in a settlement involving
(APRA), criticised in the Royal Commission for
some limited admissions and an agreed AS AT 31 JULY 2019
never having taken court action, has also
penalty, generally subsequently endorsed 88 ASIC ENFORCEMENT
expressed an increased willingness to use its INVESTIGATIONS
by the courts. The Royal Commission,
enforcement tools. Based on the intent shown AND
however, was highly critical of ASIC’s use 17 COURT ACTIONS
to date (outcomes yet to be seen), stronger
of negotiated outcomes. WERE UNDERWAY INTO ROYAL
regulator enforcement has the potential to be COMMISSION REFERRALS AND
the real lasting legacy of the Australian Banking RELATED MATTERS.
Royal Commission.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

“When I was young I used to watch

Justice League. There was Superman
with Batman, Aquaman and Wonder
Woman…I am actually so impressed
with the calibre of the people you have
recruited to ASIC, Mr Shipton, I think
I’ve just called you Superman…!”1
SENATOR HUME, SENATE ECONOMICS LEGISLATION
COMMITTEE, FEBRUARY 2019

//55
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW

As at June 2019 ASIC staff had been

onsite in one or more financial institutions
164
for a total of days.

Since ASIC’s Close and Continuous

Monitoring Program launched in October
2018, ASIC had held meetings with more
than 550 banking staff at all levels.

As part of ASIC’s Corporate Governance

Taskforce, as at June 2019, across 21
entities;
ASIC received and reviewed over
43,000 documents; and

completed 97 interviews with CEOs, chairs,

board risk committee chairs, and other senior
risk, audit and governance executives.
THE DATA GAME — 2019 GLOBAL BANK REVIEW HERBERT SMITH FREEHILLS

“Negotiation and How to respond? Andrew Eastwood

Partner, Sydney
persuasion, without Despite the intense burden that this shift in
enforcement approach has placed on
T +61 2 9225 5442
[email protected]
enforcement, all too financial institutions, there has—so far—been
little appetite to challenge or seek to limit the
readily leads to the scope of the demands (perhaps, other than in Damian Grave
Partner, Melbourne
perception that seeking to maintain claims for legal
professional privilege). As the heightened T +61 3 9288 1725
compliance is voluntary.” investigatory and enforcement activity [email protected]
continues, the general response has been to
COMMISSIONER HAYNE, resource and respond, being flexible to new
ROYAL COMMISSION FINAL REPORT Tania Gray
types of supervision initiatives. These are Partner, Sydney
usually compulsory processes after all, and T +61 2 9322 4733
“Super-regulators” in action cooperation can help shrink the size of the [email protected]
ASIC’s public rhetoric has been clear: stick faced at the end of it all, particularly
negotiated outcomes will now only be given recent changes to the law on civil
penalty, with penalties for companies Jacqueline Wootton
available for a limited range of enforcement
increasing to AU$525 million for any Partner, Brisbane
matters. In addition, once in court, ASIC
new misconduct. T +61 7 3258 6569
may adopt a new strategy of either going to
[email protected]
trial, or taking admissions from the banks
It is early days in this changing landscape,
on liability, before allowing the court to
and we are yet to see whether this less Leah Watterson
decide the penalty. This approach of taking
compromising approach will pay dividends Senior Associate, Melbourne
matters to trial may lead to some significant
for ASIC. Cultural change is difficult and T +61 3 9288 1849
public losses for ASIC. The early signs are
takes time, whether for a regulator or a [email protected]
that ASIC is ready after responding to a
financial institution. Banks in other
recent major court failure by describing it as
countries have had to weather a similar
a “test case”. Whether ASIC can maintain
storm, and have found ways to survive the
that position over the medium to long term
initial onslaught and resettle into a new
remains to be seen.
normal with the regulator, including one
In parallel, ASIC’s Close and Continuous that leaves room for negotiation.
Monitoring Program has seen financial
institutions required to open their doors to
an intensive supervisory approach which
places ASIC staff onsite within the bank.

ASIC’s Corporate Governance Taskforce

(set up during the Royal Commission) has
also been hard at work to detect cultural
failings that lead to misconduct. In a novel
approach, the taskforce asked directors and
officers to participate in a survey designed
by psychologists and requested that
psychologists attend board meetings to
observe cultural dynamics.

1. Senate Economics References Committee Performance of the Australian Securities and Investments Commission, June 2014 at xviii and Hansard,
Parliamentary Joint Committee on Corporations and Financial Services, Friday 19 October 2018 at p 4.
2. Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry, Final Report 4 February 2019 at p 428.
3. Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry, Interim Report, Executive Summary at xix. //57
HERBERT SMITH FREEHILLS THE DATA GAME — 2019 GLOBAL BANK REVIEW
HERBERTSMITHFREEHILLS.COM

BANGKOK HONG KONG NEW YORK

Herbert Smith Freehills (Thailand) Ltd Herbert Smith Freehills Herbert Smith Freehills New York LLP

BEIJING JAKARTA PARIS

Herbert Smith Freehills LLP Hiswara Bunjamin and Tandjung Herbert Smith Freehills Paris LLP
Beijing Representative Office (UK) Herbert Smith Freehills LLP associated firm
PERTH
BELFAST JOHANNESBURG Herbert Smith Freehills
Herbert Smith Freehills LLP Herbert Smith Freehills South Africa LLP
RIYADH
BERLIN KUALA LUMPUR The Law Office of Mohammed Altammami
Herbert Smith Freehills Germany LLP Herbert Smith Freehills LLP Herbert Smith Freehills LLP associated firm
LLP0010119-FGN
BRISBANE SEOUL
Herbert Smith Freehills LONDON Herbert Smith Freehills
Herbert Smith Freehills LLP Foreign Legal Consultant Office
BRUSSELS
Herbert Smith Freehills LLP MADRID SHANGHAI
Herbert Smith Freehills Spain LLP Herbert Smith Freehills LLP
DUBAI Shanghai Representative Office (UK)
Herbert Smith Freehills LLP MELBOURNE
Herbert Smith Freehills SINGAPORE
DÜSSELDORF Herbert Smith Freehills LLP
Herbert Smith Freehills Germany LLP MILAN
Herbert Smith Freehills Studio Legale SYDNEY
FRANKFURT Herbert Smith Freehills
Herbert Smith Freehills Germany LLP MOSCOW
Herbert Smith Freehills CIS LLP TOKYO
Herbert Smith Freehills

© Herbert Smith Freehills LLP 2019 NPB197154_THE DATAGAME_v5

/041019