Loading…
IIQEPrepStudyingPaper 1
Switch exam
MPF intermediaries
MPFMPF Intermediaries ExaminationIIQE Paper 1 · Topic 7
IIQE Paper 1 chapter 7 (7% of the paper): an intermediary's duties to policyholders, personal data under the PDPO (Cap. 486) and its six data protection principles, the four anti-discrimination ordinances, anti-money laundering and counter-terrorist financing under the AMLO and the IA's GL3, bribery under the POBO (Cap. 201), and insurance fraud.
8 min read6 sections
Checked against the IA Paper 1 (Principles and Practice of Insurance) Study Notes, 2024 Edition (8th edition, Nov 2024; for exams from 17 Feb 2025), chapter 7; PDPO (Cap. 486) Part 6A and s.64 (as amended by Ord. 32 of 2021); Cap. 480, 487, 527 and 602; AMLO (Cap. 615); IA GL3 (revised, in force 30 May 2025); Prevention of Bribery Ordinance (Cap. 201) s.9. Reviewed 6 Nov 2026.. Independent prep, not endorsed by the Insurance Authority or the VTC.
Chapter 7 is 7% of Paper 1. It mixes ethics with several ordinances, so most questions ask which law covers a situation, or what the right action is.
Whether the intermediary is a broker or an agent changes whom he works for:
| Insurance broker | Insurance agent | |
|---|---|---|
| Acts for | The client (policy holder or proposer) | The appointing insurer |
| Expectation | Independent and expert; a professional adviser | Represents the insurer's products |
| Liability for poor advice | Professional negligence towards the client; must carry professional indemnity insurance | The insurer is liable for the agent's acts in regulated activities (Cap. 41 s.68) |
The standard of care rises with the expertise an intermediary claims. Someone who presents himself as a specialist in marine cargo is judged as a specialist.
Duties common to every intermediary: no fraud or dishonesty, fair dealing, no taking unfair advantage of a client's lack of knowledge, no undue influence or pressure selling, and keeping within the law, remembering that breaching some statutory duties is a criminal offence.
Trap: professional indemnity insurance is a requirement for broker companies, not for individual agents. Conduct standards, though, apply to everyone.
Takeaway: broker = client's expert agent with PII; agent = insurer's agent, whose insurer answers for him.
Every note. Every question. One pass.
4 more sections of this note are part of Premium.
Passes from HK$148, pay once, no auto-renew
Under the PDPO (Cap. 486): DPP1 purpose and manner of collection, DPP2 accuracy and retention, DPP3 use, DPP4 security, DPP5 openness, and DPP6 access and correction.
Placement (criminal money enters the financial system), layering (complex transactions hide its origin) and integration (it reappears looking legitimate). Long term insurance policies are the most exposed insurance products.
To the Joint Financial Intelligence Unit (JFIU), normally through the firm's Money Laundering Reporting Officer. Telling the customer that a report has been or will be made is the offence of tipping off.
On indictment, a fine of up to HK$500,000 and imprisonment for up to 7 years. Both the agent who accepts an advantage without the principal's permission and the person who offers it commit an offence.
Insurance runs on personal data: health details, salaries, family members, claims histories. The Personal Data (Privacy) Ordinance (Cap. 486) covers data in any form, automated or manual, and binds everyone, including the Government. It is enforced by the Privacy Commissioner for Personal Data.
| Principle | What it requires | Insurance example |
|---|---|---|
| DPP1 Collection | Collect only what is necessary, by lawful and fair means, and tell the data subject the purpose (a Personal Information Collection Statement) | The proposal form explains why health questions are asked |
| DPP2 Accuracy and retention | Keep data accurate and up to date, and no longer than necessary | Delete a declined applicant's medical reports when no longer needed |
| DPP3 Use | Use data only for the collection purpose or a directly related one, unless the data subject gives prescribed consent | Claims data is not reused for an unrelated marketing campaign |
| DPP4 Security | Protect data against unauthorised access, loss or use | Encrypted laptops for agents; contracts with data processors |
| DPP5 Openness | Make policies and practices available | A published privacy policy statement |
| DPP6 Access and correction | Let data subjects see and correct their data | A customer asks for a copy of her file |
A data user is liable for what its data processor does on its behalf, so outsourcing contracts should contain data protection terms.
Direct marketing (Part 6A). Before using personal data for direct marketing, the data user must tell the data subject what data and what kinds of product, and get consent. Consent given orally must be confirmed in writing within 14 days. Providing data to someone else for their marketing needs written consent, and the data subject must be told if it is provided for gain. Maximum penalties: HK$1,000,000 and 5 years where data is provided for gain; HK$500,000 and 3 years otherwise.
Section 64. Disclosing personal data obtained without the data user's consent, with intent to gain or to cause loss, is an offence carrying up to HK$1,000,000 and 5 years. Since 8 Oct 2021 the section also contains the doxxing offences, which the 2024 study notes do not cover.
Trap: an agent wants to pass client lists to a partner bank for its marketing. Oral consent is not enough: providing data to others needs written consent.
Takeaway: six principles: collect, keep accurate, use, secure, be open, allow access. Direct marketing needs consent; passing data on needs it in writing.