Michael Leung CPA,CISSP,CISA,CCSK,FRM

Operational and technology risk assessment and control framework, setting up fraud operations, working on ebanking security enhancements (data driven technique, introduction of security token etc) Key projects: - embedded financing - virtual banking assistant powered by Gen AI - securities trading and investment fund trading licensing

Recent projects: Open API, embedded H5 channel for customer remote onboarding, major technical sourcing and saas migration

Tech, Fraud, Operational Risk - Tech risk: oversee technology risk matters, including new infra deployment, eKYC solution and its performance, app and backend change content, advise security and account-take-over controls, coordinate independent assessments, liaison with regulators. Recent projects:Anti DDoS, remote onboarding tech review, new build of ebanking from scratch, anti-phishing, craf 2.0 - Op risk: design and monitor business process controls - Fraud risk: design and monitor key risk indicators, analyze user behaviors and transaction patterns, set up anti-fraud rules, liaise with law enforcers and regulators

Focus on regulatory compliance: • Operation and technology incident investigations, root cause analysis and remediation. Topics include internal system failures, investment suitability, alternative liquidity pool, client facilitation, agency trading etc. • Bank licensing • Credit agency review • Credit exposure and liquidity reporting • Sales suitability

Focused on compliance and internal control assessment with expertise in auditing and massive data processing & recalculation. Had participated in various types of assessments: • IFRS9 / HKFRS9 Expected Credit Loss Modelling • Credit risk management (CR-G series) • Technology risk management (TM-G-1,2, SA-1) • Reporting of stamp duty obligations arise from equity, fixed income and derivatives trading (Stamp Duty Ordinance) • Initial listing due diligence (PN21) • US and Japan SOX readiness and attestation • SOC1 Type I & II (ISAE 3402) reporting of unit trust / mutual fund • Compliance with statutory requirements and supervisory guidelines (including Code of Conducts, Guidelines of Professional Investors, Deposit Protection Scheme, NFC Payment) • Internal audit of financial institutions and telecoms Secondment in a regional commercial bank as operation risk head. In charge of daily operation risk monitoring, exception handling and escalation, led projects of remediating regulatory breaches and initiatives of reducing operation risks.