OLN

OLN Marketing

What to do if there is issue regarding Testamentary Capacity?

by

BACKGROUND

In our last article, ENSURING TESTAMENTARY CAPACITY FOR AGED AND INFIRM TESTATORS, we have discussed the importance of ensuring testamentary capacity for aged and infirm testators in the will-making process. The next issue then becomes: if we consider that there is issue regarding testamentary capacity, what should we do?

WHAT TO DO IF THERE IS ISSUE REGARDING TESTAMENTARY CAPACITY?

If your solicitor has concerns or doubts about your testamentary capacity, it is always advisable to instruct a medical practitioner to assess testamentary capacity. Whilst it is not necessary for the doctor tasked to be a specialist doctor with experience in diagnosing or treating of mental disorder or mental handicap or to be an Approved Doctor under s. 2(2) of the Mental Health Ordinance (Cap. 136), nevertheless, engaging a mental health expert, especially a psychiatrist, is always preferred and advised.

Usually, the psychiatrist will consider:[1]

1. Understand

Whether you are able to understand the information relevant to decision concerned:

  • Nature and purpose of the will
  • Risks and benefits of executing the will
  • Risks of not signing the will
  • Alternative and their risks and benefits

2. Retain

Whether you are able to retain the information long enough to make an effective decision;

3. Believe

Whether you are able to believe the information and to apply information realistically to own situation;

4. Weigh

Whether you are able to weigh the information in the balance to arrive at a choice – i.e. making a decision based on all the relevant factors (risks, benefits, short term outcomes, and long-term outcomes)

5. Express

Whether you are able to express the choice, through verbal or non-verbal means

If the psychiatrist considers there is testamentary capacity on the testator’s part, it is advisable to adhere to the “Golden Rule”, i.e. to have the psychiatrist to serve as a witness to your will.

HOW CAN OLN ASSIST?

At OLN, we provide initial consultation service regarding wills drafting. Our solicitors are experienced in assessing if the testator has the requisite testamentary capacity. In case of any issue, OLN can arrange mental health specialist doctor to assist in conducting an assessment for client to ascertain his/her testamentary capacity. If you have any questions on the above, please contact our Partner Mr Jonathan Lam or our Associate Mr Dexter Yuen.

[1] Dr. Gabriel B K Hung, “Framework for clinical assessment of mental capacity in older adults” (The Hong Kong Mortgage Corporation Limited, presentation material for HKMC Seminar dated 28th July 2013), available at https://www.hkmc.com.hk/files/page/82/2.%20Framework%20for%20clinical%
20assessment%20of%20mental%20capacity%20in%20older%20adults%20%20Dr.%20Gabriel%20Hung.pdf accessed at 3rd January 2025.


Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

Ensuring Testamentary Capacity for Aged and Infirm Testators

by

BACKGROUND

Population ageing has become a challenge to most metropolitans in the world. Similar to other developed economies such as the United Kingdom and Japan, Hong Kong is also facing a serious problem of aging population. The phenomenon of population ageing is expected to continue, with the median age of Hong Kong’s population estimated to reach 55.5 in 2046[1]. 

As a result, many people have become more open-minded about the discussion of those end-of-life issues, including will preparation and estate planning.

That said, before you rush to instruct solicitor to prepare a will, you must understand that you can only make a valid will when you have testamentary capacity.

But what does it mean to have testamentary capacity? How far does the assessment exercise go?

TEST ON TESTAMENTARY CAPACITY

The principles set out in the UK landmark authority of Banks v Goodfellow[2] remains the standard for determining testamentary capacity in Hong Kong. When being assessed on testamentary capacity, as a testator you must:

  • understand the nature of the act of making the Will and its effects;
  • understand the extent of the property being disposed of
  • comprehend and appreciate the claims to which you ought to give effect.

In Re Estate of Au Kong Tim (Wills: Validity),[3] the Court of Appeal of Hong Kong emphasised the importance of solicitors following this three-limb test, as well as referring to the checklist in the “Assessment of Mental Capacity: A Practical Guide for Doctors and Lawyers” (the “Checklist”) for assessing testamentary capacity.

THE CHECKLIST

According to the Checklist, the three-limb test is particularised as follows:

1. Understand the nature of the act of making the Will and its effects:

You should understand:

  • you will die
  • your Will shall come into operation on your death, but not before
  • you can change or revoke the Will at any time before your death, provided you have the capacity to do so

2. Understand the extent of the property being disposed of:

You should understand and make choices:

  • who should be appointed as executor(s) (and perhaps why they should be appointed)
  • who gets what under the Will
  • whether a beneficiary’s gift is outright or conditional (for example, where the beneficiary is only entitled to the income from a lump sum during his or her lifetime, or is allowed to occupy residential property for the rest of the beneficiary’s life)
  • that if you spend your money or give away or sell your property during your lifetime, the beneficiaries might lose out
  • that a beneficiary might die before you
  • whether you have already made a Will and, if so, how and why the new Will differs from the old one

3. Comprehend and appreciate the claims to which the testator ought to give effect:

Crucially, the judge in Banks v Goodfellow used the word extent, rather than value. There could also be practical difficulties when investments are managed by somebody else, and there are no recent statements or valuations.

In these cases, a reasonableness test should be applied by your solicitors to any estimate you give about the extent of your wealth.

You should understand:

  • the extent of all the properties owned solely by you
  • the fact that certain types of jointly owned properties might automatically pass to the other joint owner, regardless of anything that is said in the will
  • whether there are benefits payable on your death which might be unaffected by the terms of their will (insurance policies, pension rights, etc)
  • that the extent of your properties could change during their lifetime

4. Potential claim of others:

You should be able to comprehend and appreciate the claims to which you ought to give effect. As a testator, you have the right to ignore these claims, despite being up to the extent of being prejudiced or capricious. You must be able to give reasons for preferring some beneficiaries and, perhaps, excluding others. For example possible beneficiaries:

  • may already have received adequate provision from you
  • may be financially better off than others
  • may have been more attentive or caring than others
  • may be in greater need of assistance because of their age, or physical or mental disabilities

HOW CAN OLN ASSIST?

At OLN, we provide initial consultation service regarding wills drafting, as well as advisory work regarding testamentary capacity. Our solicitors are experienced in assessing if the testator has the requisite testamentary capacity. In case of any issue, OLN can arrange mental health specialist doctor to assist in conducting an assessment for client to ascertain his/her testamentary capacity. If you have any questions on the above, please contact our Partner Mr Jonathan Lam or our Associate Mr Dexter Yuen.

[1] Yiu, William and Ng, Kang-Chung, “Hong Kong going grey faster than expected, sparking fears over healthcare, calls for new retirement policies” (South China Morning Post, 17 August 2023), available at https://www.scmp.com/news/hong-kong/society/article/3231335/hong-kong-going-grey-faster-expected-sparking-fears-over-healthcare-calls-new-retirement-policies, accessed on 8 January 2025.

[2] (1870) LR 5 QB 549.

[3] [2018] 2 HKLRD 864.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

Eggs on Ice: The Legal Landscape of Oocyte Cryopreservation on Jurisdictions Around the World

by

(This article was published in the November 2024 Issue of the Hong Kong Lawyer)

Egg freezing has become more mainstream in the post-pandemic era. Weddings were postponed along with pregnancies during the pandemic years and this has been significant for millions of women in their prime childbearing years. A report in the US National Library of Medicine stated that females are born with a finite, lifetime supply of approximately 1-2 million oocytes (immature eggs); by the time a woman reaches the age of 51 (the average age for menopause), her eggs have decreased in both quality and quantity, with approximately one thousand eggs left. Freezing high quality eggs during the prime childbearing years for later use is now considered practical when one is not quite ready for pregnancy and childbirth.

Some US companies have offered egg freezing as an employee benefit for over a decade now. The Guardian reported as early as 2014 that Silicon Valley companies were covering egg freezing costs for their employees, in a push to attract and retain top female talent. A Yale University study published in 2018 on egg freezing found that 85 percent of the women were single, with many of them reporting not having suitable partners. There are a myriad of reasons why women may not be ready for pregnancy or childbirth, including career aspirations, family situations, financial considerations, personal circumstances and health conditions.

Egg freezing for reasons other than purely health conditions is known as egg freezing for generic ”social reasons”

Jurisdictional Variations and Legal Considerations

Not every jurisdiction allows oocyte cryopreservation (egg freezing) to be done for social reasons (i.e., non health conditions) without restrictions. Here is a review of the legal landscape in a number of jurisdictions:

Australia offers a liberal legal regime for egg freezing, allowing the procedure for social reasons. In fact it was the first country to produce a live birth from frozen eggs, in 1984. There are no specific age restrictions, but women are encouraged to freeze their eggs before the age of 35 to optimise success for later live birth(s). The storage limit depends upon state legislation and is generally 10 years in states like New South Wales and Victoria. The Assisted Reproductive Treatment Act 2008 (Section 31A) in Victoria allows its Patient Review Panel to extend the 10 year storage period for eggs and sperm if reasonable grounds are given or if the
panel considers there are exceptional circumstances. The Human Reproductive Technology Act 1991 also provides for a storage period of 10 years in Western Australia, with extensions allowed for “special reasons”. Costs also vary by state, but some health insurance plans may provide coverage for a portion of the expenses.

In Canada, the Assisted Human Reproduction Act governs assisted human reproduction technologies, which encompasses egg freezing. Health Canada’s Guidance Document on the Safety of Sperm and Ova Regulations allows eggs to be stored for up to 10 years. There are no restrictions on age or marital status, although some clinics do not provide services
to non-Canadian citizens. Social egg freezing (termed elective egg freezing) is not covered by
governmental healthcare.

France only recently legalized social egg freezing for all women between the ages of 29 and 37 regardless of marital status or sexual orientation, via the French Public Health Code Article L2141. Although this liberalisation allowed women more autonomy over their reproductive choices, critics decry the reality of the situation since egg freezing is prohibited in the private sector and there could be a wait in the public health system of over two years just for the initial doctor’s appointment. This effectively denies women over the age of 35 the right to egg freezing and is despite the fact that Le Monde reported in 2022 that one in every four couples of childbearing age in France suffers from infertility issues

In the Hong Kong SAR, there are no age restrictions on egg freezing; however, a woman must be legally married to have the eggs fertilised using IVF pursuant to the Code of Practice on Reproductive Technology & Embryo Research. Since same sex marriage is not yet legally recognised in Hong Kong, women in same sex marriages and single women are unable to access post egg freezing services leading to live pregnancies. The Human Reproductive Technology Ordinance established the Council on Human Reproductive Technology, which
oversees the now outdated 2002 code of practice. Frozen eggs can be stored for up to 10 years, and since women are advised to freeze their eggs before the age of 35 due to declining egg quality, this storage limit tries to cap potential pregnancies at age 45. This legal framework illustrates the complex intersection between restrictive marriage laws and reproductive rights in Hong Kong.

Ireland’s Health (Assisted Human Reproduction) Act 2024 was signed by its President on 2 July 2024. There are no restrictions on social egg freezing although it must be privately funded. Where medical treatments have affected fertility, public healthcare may cover egg freezing costs. Eggs may be stored for a maximum of 10 years, following which new consent must be obtained for any extension. The Assisted Human Reproduction Regulatory Authority has the authority to consider and determine applications for extensions of storage.

In 2023, Singapore’s Healthcare Services Act 2020 which governs assisted reproductive services liberalised egg freezing for social reasons pursuant to the Healthcare Services (Assisted Reproductive Service) Regulation 2023, but only for women from the ages of 21 to below 38 years. However, where egg freezing is not done for social reasons, a woman must be
legally married and her husband must consent to the procedure, again representing very conservative societal values. Social egg freezing is not covered under the country’s Medisave, the mandatory medical savings account that all working citizens and permanent residents contribute to, although other reproductive services may be covered.

Spain has had a progressive approach to reproductive technologies since 2006. Assisted Reproductive Technology Law 14/2006 allows egg freezing for social reasons without age restrictions and without time limits. The legal framework supports women’s rights to make
reproductive choices, making Spain one of Europe’s most popular destinations for egg freezing. However, social egg freezing is not covered for citizens under the government healthcare system and must be privately funded.

In the United Kingdom, women are able to freeze their eggs for social reasons. The Human Fertilisation and Embryology Act 1990 regulates the practice, and women can store their eggs for up to 10 years and renew consent for each successive period of 10 years up to a maximum of 55 years. While there are no specific age restrictions, the Human Fertilisation and Embryology Authority in the UK advises that women under 38 years of age are generally able to freeze 7-14 eggs. However, access to public funding for egg freezing is reserved for those facing medical treatment that could affect fertility, with the criteria varying between England, Northern Ireland, Scotland and Wales. Social freezing must be privately funded and it is not subject to any price regulations.

Each state regulates egg freezing in the US. In New York state, liberal laws allow egg freezing for social reasons without age restrictions and regardless of marital status. Pursuant to the colloquial “IVF law”, Insurers are required by law to cover egg freezing if deemed medically
necessary (and three cycles of IVF following egg freezing)

Other Considerations

Cost may be a significant factor in the decision to freeze eggs. The entire process – from initial consultation to pre-treatment testing, ovarian stimulation, trigger injection, monitoring, oocyte retrieval, oocyte assessment to cryopreservation plus subsequent storage fees can often be costly. The financial burden can be considerable, and in many if not most jurisdictions, social egg freezing is not covered under public healthcare or reimbursable under private insurance plans. “Venue shopping” is becoming more and more popular in order to undergo the procedure in jurisdictions with lower costs, high safety standards and ultimately, high success rates in oocyte thawing.

Conclusion

The legal aspects of egg freezing vary significantly across jurisdictions, which should guide women’s decisions about when and where to undergo the procedure. It is crucial to understand these differences alongside other important factors such as costs, clinical success rates, available support systems and the accessibility of ongoing assisted reproductive technology services (e.g., in-vitro fertilisation, surrogacy) including the specific laws governing them. This comprehensive understanding is important for those considering egg
freezing as part of their reproductive plans.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

A New Era of Patient Autonomy: New Rights Under the Advance Decision on Life-Sustaining Treatment Bill

by

On 20 November 2024, the Legislative Council of Hong Kong passed the Advance Decision on Life-Sustaining Treatment Bill, which was subsequently gazetted on 24 November 2024. Set to come into effect in May 2026 following a buffering period of 18 months, the Bill introduces significant changes to how individuals can make decisions regarding their medical treatment, particularly in the event they become mentally or physically incapable of making those decisions in the future.

The Bill grants individuals the right to issue Advance Medical Directives (AMDs), allowing them to make binding decisions about their medical treatment ahead of time. This includes the option to refuse life-sustaining treatments such as mechanical ventilation, CPR, or artificial nutrition and hydration under certain conditions. Additionally, patients will have the right to opt for a Do Not Attempt Cardiopulmonary Resuscitation (DNACPR) order, which allows the patient to reject CPR rescue in the event of cardiopulmonary arrest.

This article explains the new rights introduced by the Bill, and outlines the steps individuals can take to exercise those rights.

ADVANCE MEDICAL DIRECTIVE

An Advance Medical Directive (AMD) is a legally binding document that allows an individual to instruct healthcare providers to withhold life-sustaining treatment under specific circumstances, such as if they are terminally ill, in a persistent vegetative state, or in an irreversible coma.

Types of life-Sustaining Treatments that can be refused:

  • medical ventilation
  • cardiopulmonary resuscitation (CPR)
  • artificial nutrition and hydration (e.g. via a tube)

Step 1: Ensure Eligibility

  • You must be 18 or older
  • Mentally capable of making decisions about life-sustaining treatment
  • Not under undue influence at the time of creation, as adjudged by a doctor and lawyer

Step 2: Choose the Treatments to Refuse

  • Decide which life-sustaining treatments you want to withhold such as:

– Ventilation

– CPR

– Artificial nutrition

Step 3: Complete the Statutory Form

  • The AMD must be created in writing, using a statutory form. This form must be signed and witnessed by at least two people.
  • One witness must be a Registered Medical Practitioner (RMP), who will confirm that you are mentally capable and understand the implications of your decision.
  • Witnesses cannot be beneficiaries of your estate.

Step 4: Store the AMD Digitally

After completing the AMD, a digitized copy can be securely stored in a dedicated electronic system (planned to be integrated into the eHealth platform by the Health Bureau, and currently under phased development) for safekeeping and validation. This ensures that healthcare providers can access your AMD when necessary.

Step 5: Revocation

The creation of an AMD follows the principle of “cautious making, easy revoking.” Revocation is If you change your mind at any point, you can revoke your AMD by the following means, provided you are mentally capable.

  • Verbally stating your intention to revoke
  • Providing a written declaration
  • Destroying the original document

DO NOT ATTEMPT CARDIOPULMONARY RESUSCITATION (DNACPR) ORDER

The Bill also grants individuals the right to issue a DNACPR order, which directs healthcare providers not to attempt CPR in the event of cardiopulmonary arrest.

If you wish to opt for a DNACPR, there are a few ways to initiate the process:

Option 1: Through an AMD: If you create an AMD, you can include instructions regarding the refusal of CPR, effectively issuing a DNACPR.

Option 2: Medical Determination: If CPR is deemed medically inappropriate or futile, a DNACPR may be issued based on a physician’s recommendation.

Option 3: Explicit Request: If you wish to make an explicit DNACPR request, it must be confirmed in writing via the completion of the statutory form and documented by medical professionals to ensure it aligns with your wishes and medical condition.

Reminder: A DNACPR must be confirmed by two Registered Medical Practitioners (RMPs), one of whom must be a specialist.

The Advance Decision on Life-Sustaining Treatment Bill represents a major shift in the autonomy granted to individuals regarding their healthcare decisions. By allowing patients to issue Advance Medical Directives (AMDs) and Do Not Attempt Cardiopulmonary Resuscitation (DNACPR) orders, the Bill empowers individuals to make critical decisions about how they wish to be medically treated in advance, ensuring their wishes are respected even if they become incapable of expressing them later.

Although the Bill will not come into effect until May 2026, individuals should consider their options for this interim period.

If you would like to explore your options in this regard, please contact our Partner, Eunice Chiu (+852 2186 1885 / +852 9169 4356).

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

Breaking the Hell’s Gate and the Importance of Funeral Arrangement Clauses

by

INTRODUCTION

The local blockbuster movie “the Last Dance” has become a cultural phenomenon in Hong Kong. The movie explores the traditional Taoist practice of “Breaking the Hell’s Gate” through a couple of connected stories and addresses the topic of deathcare in a thematic and touching manner, thereby sparking awareness and discussion about end-of-life planning.

This article aims to discuss how one can ensure one’s wishes regarding funeral arrangements be respected, i.e. the specific ceremonies to be performed, the location and type of the service, and burial or cremation.

PRACTICAL STEPS

  1. CONSULTING FUNERAL DIRECTOR OR RELIGIOUS LEADER
    If you have a particular preference regarding your funeral arrangement, you should first consult a funeral director or religious leader to ensure the eligibility and availability of your wishes. This can be particularly important if you desire a ceremony that reflects your faith, as different faiths and religious believes may have different requirements or formalities regarding holding a funeral arrangement in accordance with that religious practice and tradition.

    Further, regarding burial or cremation, it must be noted that with a growing and ageing population in Hong Kong, there is a greater demand for such facilities in Hong Kong[1]. It is advisable to consider the costs and availability of these facilities and plan ahead during your lifetime in securing them.

  2. COMMUNICATING YOUR WISH WITH YOUR FAMILY MEMBERS
    Once you have made up your mind regarding your funeral arrangement, you should also communicate your wishes with your family members. This is to ensure that your family members understand your preferences. It also provides an opportunity for them to ask questions or to clarify with you in case of any ambiguity.

  3. CONSULTING A LAWYER AND DRAFTING FUNERAL ARRANGEMENTS CLAUSE
    After you have been confirmed your preference regarding funeral arrangement and practice can be catered for, you should then consult a solicitor to draft a specific funeral arrangement clause in order to express your funeral wishes.  Clarity is key so that your executor of your Will can honour your wishes.

LIMITATION REGARDING ENFORCEABILITY OF WILL DISPOSITION

Even though you have already followed the above practical steps, you should note that there is a limitation under the law in Hong Kong, namely that there is no property in a dead body, and that a will disposition regarding disposal of a dead body cannot be legally enforced.

In Re Estate of Lu Han Lung [2010] 3 HKLRD 651, the principles surrounding property in dead body, enforceability of will disposition and funeral arrangement are laid down by the Court as follows:-

  1. There is no property in a corpse;
  2. A man cannot by will dispose of his dead body, and any direction by will or otherwise by the deceased on burial cannot be enforced;
  3. As a starting position, the executor named in a will or the known personal representative (if the deceased passed away without leaving a will) is entitled to the possession of the body and is responsible for its burial;
  4. The right of the surviving spouse or de facto spouse will also generally be preferred to the right of the children;
  5. However, such starting position can be displaced where there are special circumstances;
  6. A person with the privilege of choosing how to bury a body is expected to consult with other stakeholders, but is not legally bound to do so; and
  7. The person with the privilege of organizing the funeral and burial cannot exclude friends and relatives of the deceased from expressing their affection for the deceased in a reasonable and appropriate manner.

It is therefore important for the testator to appreciate and understand that even though he/she can include funeral arrangement clause, such clause is not legally enforceable. However, having funeral wishes documented can serve as guidance and help prevent family disputes.

HOW CAN OLN ASSIST?

At OLN, we provide initial consultation service regarding wills drafting. Our solicitors are experienced in drafting will clauses that could cater one’s wishes and instructions regarding funeral arrangement. If you have any questions on the above, please contact our partner Mr Jonathan Lam or our Associate Mr Dexter Yuen.

[1] “LCQ18: Supply of niches” (Press Releases, 4th May 2022), available at https://www.info.gov.hk/gia/general/202205/04/P2022050400446.htm, accessed at 2nd January 2025.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

Cyber Resilience Assessment Framework Introduced for Insurers in Hong Kong

by

Following consultation with the insurance industry, on 11 December 2024 the Insurance Authority published a revised Guideline on Cybersecurity (Revised GL20). It takes effect on 1 January, 2025, introducing a Cyber Resilience Assessment Framework (CRAF or Framework) for insurers.

What Insurers Need to Know

The Framework applies (with limited exceptions) to the authorised insurers in relation to the business they carry on in or from Hong Kong. The provisions do not apply to captive, marine mutual, and special purpose insurers, Lloyd’s and insurers that have ceased underwriting or accepting business and are in run-off. All other provisions of the revised GL20 apply to all authorised insurers except for captive and marine mutual insurers.

The Framework requires insurers to evaluate inherent risk and the maturity of their controls against the prescribed control principles. The Framework’s three step approach is:

– Step One: the insurer conducts an inherent risk assessment.

– Step Two: the insurer conducts a cybersecurity maturity assessment.

– Step Three: the insurer makes a submission to the Insurance Authority on assessment results and proposed remedial measures.

What Insurers Need to Do, Generally

Important aspects of GL 20 require insurers to demonstrate a robust cybersecurity strategy and framework.  The requirements include:

1. Insurer’s board of directors to endorse the cybersecurity strategy and framework (CSF). In doing so it should ensure:

a. There are clearly defined roles and responsibilities including reporting lines and escalation procedures.

b. It should cultivate a strong level of awareness of and commitment to cybersecurity.

c. Risk appetite and tolerances are well defined.

d. This requires a complete risk assessment to identify risks and assess mitigating measures.It has oversight of CSF design and its implementation and effectiveness.

e. Where a designated management team of appropriately qualified individuals are tasked to assist the board, both board and team need to ensure the CSF is updated continuously.

2. Insurers are to include objectives and staff and system user competencies in the CSF, implement continuous monitoring and review the CSF periodically – annually, or more frequently if a material event occurs such as an incident or new system deployment.

3. Insurers are to have a well-developed cybersecurity incident response plan.

What insurers need to do regarding the Framework

Important actions to be implemented by insurers under CRAF include:

1. Conduct assessments:

a. An inherent risk assessment is to be conducted in accordance with the Inherent Risk Assessment Matrix. This is designed to identify the insurer’s rating on a three-tiered system:

i. High – extensive adoption of technologies over numerous delivery channels

ii. Medium – adoption of some complex new technologies

iii. Low or not applicable if appropriate – few emerging technologies are adopted

        b. A cybersecurity maturity assessment is to be conducted in accordance with the Cybersecurity Maturity Assessment Matrix – having regard to Governance, Identification, Protection, Detection, Response and Recovery, Situational Awareness and Third-Party Risk Management. If an insurer wishes to adopt an alternative cybersecurity assessment framework, for example, the framework adopted by the organisation elsewhere or a framework previously used, it must be comparable to the Framework and meet all required conditions.

        2. Make appointments:

        a. an Assessor is to be appointed, with appropriate skills and qualifications (having regard to the inherent risk rating). When assessing cybersecurity controls, the Assessor should determine the sampling size and approach, taking a risk-based approach. Samples may be limited to the preceding 6 months if the assessment is being conducted for the first time. Otherwise, a 12 months period should be used.

        b. If necessary, a Validator with the prescribed qualifications, is to be appointed.

        3. Make submissions to the Insurance Authority:

        a. For insurers with a high inherent risk rating the results of their assessments are to be submitted within 12 months from the effective date of CRAF.

        b. For insurers with a low or medium inherent risk rating the results of their assessments are to be submitted within 18 months from the effective date of CRAF.

        Thereafter, submissions are to be made at least every three years or more frequently (annually) or upon a major change to business or technologies.

        4. Ensure the insurer’s Chief Executive or a senior officer (i.e. a key persons in control function) and the Assessor and/or Validator responsible for conducting Assessment review and approve the assessment.

        Conclusion:

        The insurance industry faces significant cyber risk as a first party issue, in its supply chain and in its insurance portfolios. GL20 is a valuable tool for insurers to measure, implement and enhance their cyber governance, systems, controls and resilience on a continuous basis.

        Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.