Companies operating in Hong Kong that are (or could be) under US jurisdiction now have additional recommendations to incorporate into their whistleblowing programs as a result of the 1 June 2020 revisions to the US Department of Justice’s Guidance Document on Evaluation of Corporate Compliance Programs (US DOJ Guidance). The US Securities and Exchange Commission (SEC) has already paid over USD 100 million to whistle-blowers (including those from Asia) this calendar year including on 4 June 2020 paying a historic award of nearly USD 50 million to a whistle-blower who provided detailed, first-hand observations of misconduct by a company. In addition to the US, other jurisdictions are either introducing their own whistle-blower programs or have already paid out rewards. For example, rewards have been paid for information on Chinese corporate wrongdoers by a variety of PRC enforcement agencies including the China Securities Regulatory Commission (CSRC).
Now is the time for companies to review their whistle-blower programs to ensure that employees’ concerns are addressed appropriately and effectively. In this alert, we provide an overview on the guidance set forth in the Hong Kong legal framework on whistleblowing and provide an update on the recommendations in the new US DOJ Guidance. These frameworks, read together, provide a practical overview of what constitutes best practices in Hong Kong.
Overview of whistle-blowing framework and new updates
Local Requirements
In Hong Kong, one set of regulations that has a direct bearing on how companies should implement whistle-blowing procedures are those issued by the Hong Kong Monetary Authority (HKMA) as part of its ongoing Bank Culture Reform initiative which was introduced in 2017. The initiative’s aim is to foster sound culture and values in banks. The HKMA has also issued measures setting out the expectation that banks would implement effective whistle-blowing mechanisms that allow staff to report illegal and unethical practices without fear of retaliation, encourage employees to speak up and incorporate regular review of “the effectiveness of such channels of escalation.”
Self-reporting or disclosure obligations also set out requirements which apply to whistle-blower programs. For example, the Hong Kong Securities and Futures Commission (SFC) requires regulated companies to immediately self-report actual or suspected breaches of laws or regulations. Making available a whistle-blowing channel to all employees and third parties is key to complying with self-reporting obligations because it is often the employees, vendors and business partners who have crucial insight as to any misbehaviour happening on the ground. Obtaining whistle-blower information at the earliest opportunity will enable companies to act promptly to investigate and remediate issues thereby reducing the likelihood of penalties or avoiding undue business disruption in the form of dawn raids.
Finally, companies should take note of the laws scattered across various Hong Kong ordinances which protect whistle-blowers’ anonymity, protect them from dismissal and discrimination, and grant immunity from breach of confidentiality claims. For instance, under discrimination legislation (including the Sex Discrimination Ordinance) employees are protected from discrimination by way of victimization (i.e. being treated less favourably than other employees) when they make a discrimination or harassment complaint or give evidence in relevant proceedings. Further, under anti-money laundering legislation (including the Organized and Serious Crimes Ordinance), employees who disclose confidential information related to money laundering or proceeds of crime may be protected from breach of confidentiality claims.
The spirit and wording of these laws make clear that companies must adopt a policy of no-retaliation against employees who blow the whistle in good faith.
The US DOJ Guidance
The recent US DOJ Guidance states that its purpose is to
“assist prosecutors in making informed decisions as to whether, and to what extent, the corporation’s compliance program was effective at the time of the offense, and is effective at the time of a charging decision or resolution, for purposes of determining the appropriate (1) form of any resolution or prosecution; (2) monetary penalty, if any; and (3) compliance obligations contained in any corporate criminal resolution (e.g., monitorship or reporting obligations).”
Put simply, a robust compliance program will assist to convince US (and other) prosecutors that any offense that occurred at the corporate entity was an aberration and not a deep structural or cultural problem.
The new US DOJ Guidance prescribes what corporates should do to evaluate their own whistle-blowing programs. The previous Guidance simply stated that “the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations of a breach of the company’s code of conduct, company policies, or suspected or actual misconduct” was a “hallmark of a well-designed compliance program.” The new US DOJ Guidance adds additional recommendations, including that the company should:
- Publicize the whistleblowing framework to third parties such as distributors, suppliers, contractors and other counterparties, not just employees;
- Evaluate whether employees are aware of the hotline and feel comfortable using it; and
- Periodically test the whistleblowing framework’s effectiveness, such as by tracking a report from start to finish.
Recommended actions
With the new US DOJ Guidance in mind and the backdrop of the existing Hong Kong legal framework, we recommend that Hong Kong companies take the following practical steps in relation to their whistleblowing program:
- Train third parties, not just employees, on how to use the mechanism. One option is to include such a training in an overall compliance training of third parties. This can be a great way to ensure that the third parties are aligned with the company’s compliance expectations and understand the company’s other policies and procedures (e.g., anti-bribery and corruption).
- Each year, conduct an overall review of the whistleblowing program. This means reviewing a snapshot of how many reports were made over the past year and how they were resolved. If no reports came through the hotline in a particular year, this is likely to be a sign that the program is underutilised and is an indicator that a refresher training for employees would be beneficial.
- Each year, conduct an in-depth review of a sample selection of reports using the whistle-blowing procedure in order to assess how the process was conducted from start to finish. This review may identify the need for improvements to the whistle-blowing policy and procedure.
- Periodically, conduct:
- An anonymous cultural survey of employees and third parties on the whistle-blowing program. This survey should cover their willingness to use the mechanism and their view of its safety and effectiveness if they made a report.
- A comprehensive legal survey of local laws, regulations and official guidelines around whistle-blower protection and procedures in all the countries in which the company operates to ensure that the whistle-blowing program complies with local requirements. For instance, authorized institutions in Hong Kong should keep apprised of the HKMA culture supervisory measures relevant to whistle-blowing mechanisms and make sure those measures are implemented.
- An update of the whistle-blowing policy and procedure that takes into account any new legal obligations and addresses feedback received from the reviews and survey noted above. This is also an opportunity to improve any system issues that were identified in whistle-blower investigations that have been conducted.
Baker McKenzie’s Compliance & Investigations team regularly assists clients in assessing their whistleblowing programs and ensuring that they comport with requirements in a range of jurisdictions, including Hong Kong, the United States and China.
