OLN

Test Blog

What to do if there is issue regarding Testamentary Capacity?

by

BACKGROUND

In our last article, ENSURING TESTAMENTARY CAPACITY FOR AGED AND INFIRM TESTATORS, we have discussed the importance of ensuring testamentary capacity for aged and infirm testators in the will-making process. The next issue then becomes: if we consider that there is issue regarding testamentary capacity, what should we do?

WHAT TO DO IF THERE IS ISSUE REGARDING TESTAMENTARY CAPACITY?

If your solicitor has concerns or doubts about your testamentary capacity, it is always advisable to instruct a medical practitioner to assess testamentary capacity. Whilst it is not necessary for the doctor tasked to be a specialist doctor with experience in diagnosing or treating of mental disorder or mental handicap or to be an Approved Doctor under s. 2(2) of the Mental Health Ordinance (Cap. 136), nevertheless, engaging a mental health expert, especially a psychiatrist, is always preferred and advised.

Usually, the psychiatrist will consider:[1]

1. Understand

Whether you are able to understand the information relevant to decision concerned:

  • Nature and purpose of the will
  • Risks and benefits of executing the will
  • Risks of not signing the will
  • Alternative and their risks and benefits

2. Retain

Whether you are able to retain the information long enough to make an effective decision;

3. Believe

Whether you are able to believe the information and to apply information realistically to own situation;

4. Weigh

Whether you are able to weigh the information in the balance to arrive at a choice – i.e. making a decision based on all the relevant factors (risks, benefits, short term outcomes, and long-term outcomes)

5. Express

Whether you are able to express the choice, through verbal or non-verbal means

If the psychiatrist considers there is testamentary capacity on the testator’s part, it is advisable to adhere to the “Golden Rule”, i.e. to have the psychiatrist to serve as a witness to your will.

HOW CAN OLN ASSIST?

At OLN, we provide initial consultation service regarding wills drafting. Our solicitors are experienced in assessing if the testator has the requisite testamentary capacity. In case of any issue, OLN can arrange mental health specialist doctor to assist in conducting an assessment for client to ascertain his/her testamentary capacity. If you have any questions on the above, please contact our Partner Mr Jonathan Lam or our Associate Mr Dexter Yuen.

[1] Dr. Gabriel B K Hung, “Framework for clinical assessment of mental capacity in older adults” (The Hong Kong Mortgage Corporation Limited, presentation material for HKMC Seminar dated 28th July 2013), available at https://www.hkmc.com.hk/files/page/82/2.%20Framework%20for%20clinical%
20assessment%20of%20mental%20capacity%20in%20older%20adults%20%20Dr.%20Gabriel%20Hung.pdf accessed at 3rd January 2025.


Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

Ensuring Testamentary Capacity for Aged and Infirm Testators

by

BACKGROUND

Population ageing has become a challenge to most metropolitans in the world. Similar to other developed economies such as the United Kingdom and Japan, Hong Kong is also facing a serious problem of aging population. The phenomenon of population ageing is expected to continue, with the median age of Hong Kong’s population estimated to reach 55.5 in 2046[1]. 

As a result, many people have become more open-minded about the discussion of those end-of-life issues, including will preparation and estate planning.

That said, before you rush to instruct solicitor to prepare a will, you must understand that you can only make a valid will when you have testamentary capacity.

But what does it mean to have testamentary capacity? How far does the assessment exercise go?

TEST ON TESTAMENTARY CAPACITY

The principles set out in the UK landmark authority of Banks v Goodfellow[2] remains the standard for determining testamentary capacity in Hong Kong. When being assessed on testamentary capacity, as a testator you must:

  • understand the nature of the act of making the Will and its effects;
  • understand the extent of the property being disposed of
  • comprehend and appreciate the claims to which you ought to give effect.

In Re Estate of Au Kong Tim (Wills: Validity),[3] the Court of Appeal of Hong Kong emphasised the importance of solicitors following this three-limb test, as well as referring to the checklist in the “Assessment of Mental Capacity: A Practical Guide for Doctors and Lawyers” (the “Checklist”) for assessing testamentary capacity.

THE CHECKLIST

According to the Checklist, the three-limb test is particularised as follows:

1. Understand the nature of the act of making the Will and its effects:

You should understand:

  • you will die
  • your Will shall come into operation on your death, but not before
  • you can change or revoke the Will at any time before your death, provided you have the capacity to do so

2. Understand the extent of the property being disposed of:

You should understand and make choices:

  • who should be appointed as executor(s) (and perhaps why they should be appointed)
  • who gets what under the Will
  • whether a beneficiary’s gift is outright or conditional (for example, where the beneficiary is only entitled to the income from a lump sum during his or her lifetime, or is allowed to occupy residential property for the rest of the beneficiary’s life)
  • that if you spend your money or give away or sell your property during your lifetime, the beneficiaries might lose out
  • that a beneficiary might die before you
  • whether you have already made a Will and, if so, how and why the new Will differs from the old one

3. Comprehend and appreciate the claims to which the testator ought to give effect:

Crucially, the judge in Banks v Goodfellow used the word extent, rather than value. There could also be practical difficulties when investments are managed by somebody else, and there are no recent statements or valuations.

In these cases, a reasonableness test should be applied by your solicitors to any estimate you give about the extent of your wealth.

You should understand:

  • the extent of all the properties owned solely by you
  • the fact that certain types of jointly owned properties might automatically pass to the other joint owner, regardless of anything that is said in the will
  • whether there are benefits payable on your death which might be unaffected by the terms of their will (insurance policies, pension rights, etc)
  • that the extent of your properties could change during their lifetime

4. Potential claim of others:

You should be able to comprehend and appreciate the claims to which you ought to give effect. As a testator, you have the right to ignore these claims, despite being up to the extent of being prejudiced or capricious. You must be able to give reasons for preferring some beneficiaries and, perhaps, excluding others. For example possible beneficiaries:

  • may already have received adequate provision from you
  • may be financially better off than others
  • may have been more attentive or caring than others
  • may be in greater need of assistance because of their age, or physical or mental disabilities

HOW CAN OLN ASSIST?

At OLN, we provide initial consultation service regarding wills drafting, as well as advisory work regarding testamentary capacity. Our solicitors are experienced in assessing if the testator has the requisite testamentary capacity. In case of any issue, OLN can arrange mental health specialist doctor to assist in conducting an assessment for client to ascertain his/her testamentary capacity. If you have any questions on the above, please contact our Partner Mr Jonathan Lam or our Associate Mr Dexter Yuen.

[1] Yiu, William and Ng, Kang-Chung, “Hong Kong going grey faster than expected, sparking fears over healthcare, calls for new retirement policies” (South China Morning Post, 17 August 2023), available at https://www.scmp.com/news/hong-kong/society/article/3231335/hong-kong-going-grey-faster-expected-sparking-fears-over-healthcare-calls-new-retirement-policies, accessed on 8 January 2025.

[2] (1870) LR 5 QB 549.

[3] [2018] 2 HKLRD 864.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

Eggs on Ice: The Legal Landscape of Oocyte Cryopreservation on Jurisdictions Around the World

by

(This article was published in the November 2024 Issue of the Hong Kong Lawyer)

Egg freezing has become more mainstream in the post-pandemic era. Weddings were postponed along with pregnancies during the pandemic years and this has been significant for millions of women in their prime childbearing years. A report in the US National Library of Medicine stated that females are born with a finite, lifetime supply of approximately 1-2 million oocytes (immature eggs); by the time a woman reaches the age of 51 (the average age for menopause), her eggs have decreased in both quality and quantity, with approximately one thousand eggs left. Freezing high quality eggs during the prime childbearing years for later use is now considered practical when one is not quite ready for pregnancy and childbirth.

Some US companies have offered egg freezing as an employee benefit for over a decade now. The Guardian reported as early as 2014 that Silicon Valley companies were covering egg freezing costs for their employees, in a push to attract and retain top female talent. A Yale University study published in 2018 on egg freezing found that 85 percent of the women were single, with many of them reporting not having suitable partners. There are a myriad of reasons why women may not be ready for pregnancy or childbirth, including career aspirations, family situations, financial considerations, personal circumstances and health conditions.

Egg freezing for reasons other than purely health conditions is known as egg freezing for generic ”social reasons”

Jurisdictional Variations and Legal Considerations

Not every jurisdiction allows oocyte cryopreservation (egg freezing) to be done for social reasons (i.e., non health conditions) without restrictions. Here is a review of the legal landscape in a number of jurisdictions:

Australia offers a liberal legal regime for egg freezing, allowing the procedure for social reasons. In fact it was the first country to produce a live birth from frozen eggs, in 1984. There are no specific age restrictions, but women are encouraged to freeze their eggs before the age of 35 to optimise success for later live birth(s). The storage limit depends upon state legislation and is generally 10 years in states like New South Wales and Victoria. The Assisted Reproductive Treatment Act 2008 (Section 31A) in Victoria allows its Patient Review Panel to extend the 10 year storage period for eggs and sperm if reasonable grounds are given or if the
panel considers there are exceptional circumstances. The Human Reproductive Technology Act 1991 also provides for a storage period of 10 years in Western Australia, with extensions allowed for “special reasons”. Costs also vary by state, but some health insurance plans may provide coverage for a portion of the expenses.

In Canada, the Assisted Human Reproduction Act governs assisted human reproduction technologies, which encompasses egg freezing. Health Canada’s Guidance Document on the Safety of Sperm and Ova Regulations allows eggs to be stored for up to 10 years. There are no restrictions on age or marital status, although some clinics do not provide services
to non-Canadian citizens. Social egg freezing (termed elective egg freezing) is not covered by
governmental healthcare.

France only recently legalized social egg freezing for all women between the ages of 29 and 37 regardless of marital status or sexual orientation, via the French Public Health Code Article L2141. Although this liberalisation allowed women more autonomy over their reproductive choices, critics decry the reality of the situation since egg freezing is prohibited in the private sector and there could be a wait in the public health system of over two years just for the initial doctor’s appointment. This effectively denies women over the age of 35 the right to egg freezing and is despite the fact that Le Monde reported in 2022 that one in every four couples of childbearing age in France suffers from infertility issues

In the Hong Kong SAR, there are no age restrictions on egg freezing; however, a woman must be legally married to have the eggs fertilised using IVF pursuant to the Code of Practice on Reproductive Technology & Embryo Research. Since same sex marriage is not yet legally recognised in Hong Kong, women in same sex marriages and single women are unable to access post egg freezing services leading to live pregnancies. The Human Reproductive Technology Ordinance established the Council on Human Reproductive Technology, which
oversees the now outdated 2002 code of practice. Frozen eggs can be stored for up to 10 years, and since women are advised to freeze their eggs before the age of 35 due to declining egg quality, this storage limit tries to cap potential pregnancies at age 45. This legal framework illustrates the complex intersection between restrictive marriage laws and reproductive rights in Hong Kong.

Ireland’s Health (Assisted Human Reproduction) Act 2024 was signed by its President on 2 July 2024. There are no restrictions on social egg freezing although it must be privately funded. Where medical treatments have affected fertility, public healthcare may cover egg freezing costs. Eggs may be stored for a maximum of 10 years, following which new consent must be obtained for any extension. The Assisted Human Reproduction Regulatory Authority has the authority to consider and determine applications for extensions of storage.

In 2023, Singapore’s Healthcare Services Act 2020 which governs assisted reproductive services liberalised egg freezing for social reasons pursuant to the Healthcare Services (Assisted Reproductive Service) Regulation 2023, but only for women from the ages of 21 to below 38 years. However, where egg freezing is not done for social reasons, a woman must be
legally married and her husband must consent to the procedure, again representing very conservative societal values. Social egg freezing is not covered under the country’s Medisave, the mandatory medical savings account that all working citizens and permanent residents contribute to, although other reproductive services may be covered.

Spain has had a progressive approach to reproductive technologies since 2006. Assisted Reproductive Technology Law 14/2006 allows egg freezing for social reasons without age restrictions and without time limits. The legal framework supports women’s rights to make
reproductive choices, making Spain one of Europe’s most popular destinations for egg freezing. However, social egg freezing is not covered for citizens under the government healthcare system and must be privately funded.

In the United Kingdom, women are able to freeze their eggs for social reasons. The Human Fertilisation and Embryology Act 1990 regulates the practice, and women can store their eggs for up to 10 years and renew consent for each successive period of 10 years up to a maximum of 55 years. While there are no specific age restrictions, the Human Fertilisation and Embryology Authority in the UK advises that women under 38 years of age are generally able to freeze 7-14 eggs. However, access to public funding for egg freezing is reserved for those facing medical treatment that could affect fertility, with the criteria varying between England, Northern Ireland, Scotland and Wales. Social freezing must be privately funded and it is not subject to any price regulations.

Each state regulates egg freezing in the US. In New York state, liberal laws allow egg freezing for social reasons without age restrictions and regardless of marital status. Pursuant to the colloquial “IVF law”, Insurers are required by law to cover egg freezing if deemed medically
necessary (and three cycles of IVF following egg freezing)

Other Considerations

Cost may be a significant factor in the decision to freeze eggs. The entire process – from initial consultation to pre-treatment testing, ovarian stimulation, trigger injection, monitoring, oocyte retrieval, oocyte assessment to cryopreservation plus subsequent storage fees can often be costly. The financial burden can be considerable, and in many if not most jurisdictions, social egg freezing is not covered under public healthcare or reimbursable under private insurance plans. “Venue shopping” is becoming more and more popular in order to undergo the procedure in jurisdictions with lower costs, high safety standards and ultimately, high success rates in oocyte thawing.

Conclusion

The legal aspects of egg freezing vary significantly across jurisdictions, which should guide women’s decisions about when and where to undergo the procedure. It is crucial to understand these differences alongside other important factors such as costs, clinical success rates, available support systems and the accessibility of ongoing assisted reproductive technology services (e.g., in-vitro fertilisation, surrogacy) including the specific laws governing them. This comprehensive understanding is important for those considering egg
freezing as part of their reproductive plans.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

患者自主权的新纪元：《维持生命治疗的预作决定条例草案》赋予的新权利

by

2024年11月20日，香港立法会通过了《维持生命治疗的预作决定条例草案》，并于2024年11月24日刊宪。 《条例草案》将在经过18个月的缓冲期后，于2026年5月正式生效。这项条例引入了重大变革，使个人在可能因精神或身体状况无法自行作出医疗决定的情况下，能够事先决定其医疗治疗方式。

《条例草案》赋予个人订立预设医疗指示（Advance Medical Directives，简称AMD）的权利，使其能够预先作出具法律约束力的医疗决定。这包括在特定情况下拒绝接受如机械通气、心肺复苏术（CPR）或人工营养及水分补给等生命维持治疗。此外，患者亦有权选择「不作心肺复苏术指示」（Do Not Attempt Cardiopulmonary Resuscitation，简称DNACPR），让患者有权利拒绝心肺复苏。

本文解释《条例草案》引入的新权利，并概述个人如何采取步骤行使这些权利。

预设医疗指示（AMD）

预设医疗指示（Advance Medical Directive，简称AMD）是一份具法律约束力的文件，允许个人指示医护人员在特定情况下不提供生命维持治疗，例如当其处于末期病况、持续植物人状态或不可逆昏迷。

可以拒绝的生命维持治疗的类别：

  • 医疗机械通气
  • 心肺复苏术（CPR）
  • 人工营养及水分补给（如经导管喂食）

步骤 1：确认资格

  • 年满18岁或以上
  • 具备精神能力，能就生命维持治疗作出决定
  • 在订立AMD时，在医生和律师的判断下,不受外界或第三者的不当影响

步骤 2：选择拒绝的治疗

  • 决定要拒绝哪些生命维持治疗，例如：

– 机械通气

– 心肺复苏术（CPR）

– 人工营养及水分补给

步骤 3：填写法定表格

  • AMD必须以书面形式订立，并使用法定表格。表格需签署并由至少两名证人见证。
  • 一名证人必须是注册医生（Registered Medical Practitioner，简称RMP），以确认您具备精神能力并理解决定的后果。
  • 证人不得是您遗产的受益人。

步骤 4：数码存档

完成AMD后，数码副本将安全地存放于专用电子系统中（计划整合至由医务卫生局管理、目前正分阶段开发的电子健康记录平台 eHealth），确保医护人员在需要时能够查阅您的AMD。

步骤 5：撤销

如果您改变主意，可以通过以下方式撤销您的AMD，只要您仍具备精神能力：

  • 口头声明您的撤销意图
  • 提供书面声明
  • 销毁原始文件

「不作心肺复苏术」指示（DNACPR）

《条例草案》亦赋予个人权利，可订立「不作心肺复苏术指示」（Do Not Attempt Cardiopulmonary Resuscitation，简称DNACPR）。该指示明确要求医护人员在患者发生心肺停止时，不进行心肺复苏术（CPR）。

如果您希望选择DNACPR指示，可以通过以下方式开始程序：

选项 1：通过预设医疗指示（AMD）：如果您已订立AMD，您可以在其中包含拒绝CPR的指示，这相当于发出了DNACPR指示。

选项 2：医学判定：当医生判定CPR在您的情况下适当或无效时，医生可以基于医学建议发出DNACPR指示。

选项 3：明确要求：如果您希望主动提出DNACPR指示，必须通过填写法定表格以书面形式确认，并由医护人员记录，确保其与您的意愿和健康状况一致。

紧记： DNACPR指示需由两名注册医生（Registered Medical Practitioners，简称RMPs）确认，其中至少一名必须是专科医生。

《维持生命治疗的预作决定条例草案》标志着个人在医疗决策自主权方面的一次重大转变。通过允许患者订立预设医疗指示（AMD）和选择不作心肺复苏术指示（DNACPR），该条例赋予个人提前作出重要治疗决策的权利，确保即使在未来丧失表达能力的情况下，其意愿仍能得到尊重。

尽管该法案要到 2026 年 5 月才会生效，但个人应考虑在此过渡期间的选择。

如果您想知道关于这方面的保障，请联络我们的合伙人，赵君宜律师（+852 2186 1885 / +852 9169 4356）。

免责声明: 本文仅供参考。本文中的任何内容均不得诠释为香港法律建议或向任何人提供的任何与此相关的法律建议。对于任何人因本文所含的内容而造成的任何损失和/或损害，高李严律师行不承担任何责任。

Breaking the Hell’s Gate and the Importance of Funeral Arrangement Clauses

by

INTRODUCTION

The local blockbuster movie “the Last Dance” has become a cultural phenomenon in Hong Kong. The movie explores the traditional Taoist practice of “Breaking the Hell’s Gate” through a couple of connected stories and addresses the topic of deathcare in a thematic and touching manner, thereby sparking awareness and discussion about end-of-life planning.

This article aims to discuss how one can ensure one’s wishes regarding funeral arrangements be respected, i.e. the specific ceremonies to be performed, the location and type of the service, and burial or cremation.

PRACTICAL STEPS

  1. CONSULTING FUNERAL DIRECTOR OR RELIGIOUS LEADER
    If you have a particular preference regarding your funeral arrangement, you should first consult a funeral director or religious leader to ensure the eligibility and availability of your wishes. This can be particularly important if you desire a ceremony that reflects your faith, as different faiths and religious believes may have different requirements or formalities regarding holding a funeral arrangement in accordance with that religious practice and tradition.

    Further, regarding burial or cremation, it must be noted that with a growing and ageing population in Hong Kong, there is a greater demand for such facilities in Hong Kong[1]. It is advisable to consider the costs and availability of these facilities and plan ahead during your lifetime in securing them.

  2. COMMUNICATING YOUR WISH WITH YOUR FAMILY MEMBERS
    Once you have made up your mind regarding your funeral arrangement, you should also communicate your wishes with your family members. This is to ensure that your family members understand your preferences. It also provides an opportunity for them to ask questions or to clarify with you in case of any ambiguity.

  3. CONSULTING A LAWYER AND DRAFTING FUNERAL ARRANGEMENTS CLAUSE
    After you have been confirmed your preference regarding funeral arrangement and practice can be catered for, you should then consult a solicitor to draft a specific funeral arrangement clause in order to express your funeral wishes.  Clarity is key so that your executor of your Will can honour your wishes.

LIMITATION REGARDING ENFORCEABILITY OF WILL DISPOSITION

Even though you have already followed the above practical steps, you should note that there is a limitation under the law in Hong Kong, namely that there is no property in a dead body, and that a will disposition regarding disposal of a dead body cannot be legally enforced.

In Re Estate of Lu Han Lung [2010] 3 HKLRD 651, the principles surrounding property in dead body, enforceability of will disposition and funeral arrangement are laid down by the Court as follows:-

  1. There is no property in a corpse;
  2. A man cannot by will dispose of his dead body, and any direction by will or otherwise by the deceased on burial cannot be enforced;
  3. As a starting position, the executor named in a will or the known personal representative (if the deceased passed away without leaving a will) is entitled to the possession of the body and is responsible for its burial;
  4. The right of the surviving spouse or de facto spouse will also generally be preferred to the right of the children;
  5. However, such starting position can be displaced where there are special circumstances;
  6. A person with the privilege of choosing how to bury a body is expected to consult with other stakeholders, but is not legally bound to do so; and
  7. The person with the privilege of organizing the funeral and burial cannot exclude friends and relatives of the deceased from expressing their affection for the deceased in a reasonable and appropriate manner.

It is therefore important for the testator to appreciate and understand that even though he/she can include funeral arrangement clause, such clause is not legally enforceable. However, having funeral wishes documented can serve as guidance and help prevent family disputes.

HOW CAN OLN ASSIST?

At OLN, we provide initial consultation service regarding wills drafting. Our solicitors are experienced in drafting will clauses that could cater one’s wishes and instructions regarding funeral arrangement. If you have any questions on the above, please contact our partner Mr Jonathan Lam or our Associate Mr Dexter Yuen.

[1] “LCQ18: Supply of niches” (Press Releases, 4th May 2022), available at https://www.info.gov.hk/gia/general/202205/04/P2022050400446.htm, accessed at 2nd January 2025.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

Cyber Resilience Assessment Framework Introduced for Insurers in Hong Kong

by

Following consultation with the insurance industry, on 11 December 2024 the Insurance Authority published a revised Guideline on Cybersecurity (Revised GL20). It takes effect on 1 January, 2025, introducing a Cyber Resilience Assessment Framework (CRAF or Framework) for insurers.

What Insurers Need to Know

The Framework applies (with limited exceptions) to the authorised insurers in relation to the business they carry on in or from Hong Kong. The provisions do not apply to captive, marine mutual, and special purpose insurers, Lloyd’s and insurers that have ceased underwriting or accepting business and are in run-off. All other provisions of the revised GL20 apply to all authorised insurers except for captive and marine mutual insurers.

The Framework requires insurers to evaluate inherent risk and the maturity of their controls against the prescribed control principles. The Framework’s three step approach is:

– Step One: the insurer conducts an inherent risk assessment.

– Step Two: the insurer conducts a cybersecurity maturity assessment.

– Step Three: the insurer makes a submission to the Insurance Authority on assessment results and proposed remedial measures.

What Insurers Need to Do, Generally

Important aspects of GL 20 require insurers to demonstrate a robust cybersecurity strategy and framework.  The requirements include:

1. Insurer’s board of directors to endorse the cybersecurity strategy and framework (CSF). In doing so it should ensure:

a. There are clearly defined roles and responsibilities including reporting lines and escalation procedures.

b. It should cultivate a strong level of awareness of and commitment to cybersecurity.

c. Risk appetite and tolerances are well defined.

d. This requires a complete risk assessment to identify risks and assess mitigating measures.It has oversight of CSF design and its implementation and effectiveness.

e. Where a designated management team of appropriately qualified individuals are tasked to assist the board, both board and team need to ensure the CSF is updated continuously.

2. Insurers are to include objectives and staff and system user competencies in the CSF, implement continuous monitoring and review the CSF periodically – annually, or more frequently if a material event occurs such as an incident or new system deployment.

3. Insurers are to have a well-developed cybersecurity incident response plan.

What insurers need to do regarding the Framework

Important actions to be implemented by insurers under CRAF include:

1. Conduct assessments:

a. An inherent risk assessment is to be conducted in accordance with the Inherent Risk Assessment Matrix. This is designed to identify the insurer’s rating on a three-tiered system:

i. High – extensive adoption of technologies over numerous delivery channels

ii. Medium – adoption of some complex new technologies

iii. Low or not applicable if appropriate – few emerging technologies are adopted

        b. A cybersecurity maturity assessment is to be conducted in accordance with the Cybersecurity Maturity Assessment Matrix – having regard to Governance, Identification, Protection, Detection, Response and Recovery, Situational Awareness and Third-Party Risk Management. If an insurer wishes to adopt an alternative cybersecurity assessment framework, for example, the framework adopted by the organisation elsewhere or a framework previously used, it must be comparable to the Framework and meet all required conditions.

        2. Make appointments:

        a. an Assessor is to be appointed, with appropriate skills and qualifications (having regard to the inherent risk rating). When assessing cybersecurity controls, the Assessor should determine the sampling size and approach, taking a risk-based approach. Samples may be limited to the preceding 6 months if the assessment is being conducted for the first time. Otherwise, a 12 months period should be used.

        b. If necessary, a Validator with the prescribed qualifications, is to be appointed.

        3. Make submissions to the Insurance Authority:

        a. For insurers with a high inherent risk rating the results of their assessments are to be submitted within 12 months from the effective date of CRAF.

        b. For insurers with a low or medium inherent risk rating the results of their assessments are to be submitted within 18 months from the effective date of CRAF.

        Thereafter, submissions are to be made at least every three years or more frequently (annually) or upon a major change to business or technologies.

        4. Ensure the insurer’s Chief Executive or a senior officer (i.e. a key persons in control function) and the Assessor and/or Validator responsible for conducting Assessment review and approve the assessment.

        Conclusion:

        The insurance industry faces significant cyber risk as a first party issue, in its supply chain and in its insurance portfolios. GL20 is a valuable tool for insurers to measure, implement and enhance their cyber governance, systems, controls and resilience on a continuous basis.

        Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.