Jonathan Wan Partner, Financial Services Consulting

Qualifications

• MSc in Financial Management (Distinction), The University of Manchester, United Kingdom
• Master of Accounting, Monash University, Australia
• BSc (Hons) Mathematics & Computer Engineering, Queen’s University, Canada
• Chartered Accountant, Chartered Accountants Australia & New Zealand
• Fellow of CPA Australia
• Certified Information Systems Auditor, Information Systems Audit & Control Association
• CSX Penetration Testing Overview (CPTO) Certificate, Information Systems Audit & Control Association
• Certified Internal Auditor, The Institute of Internal Auditors
• Certification in Risk Management Assurance, The Institute of Internal Auditors
• Certificate in Data Analytics, ACCA
• Councillor, Chartered Accountants Australia & New Zealand Hong Kong Overseas Regional Council

Background

Jonathan joined Financial Services team of Forvis Mazars in Hong Kong in 2023. With more than 20 years of experience in corporate advisory, Jonathan obtained extensive track records in advocating senior stakeholders for a wide spectrum of local and multinational financial institutions on the establishment of their strategic & IT transformation, governance, risk & compliance (GRC), including regulator driven compliance and system reviews, internal audit and data management frameworks; as well as on the enhancement of operation effectiveness and efficiency on those programmes.

Before joining Forvis Mazars, Jonathan held roles in Big 4 firms as well as the Hong Kong Exchanges and Clearing Ltd., American Express & Marsh McLennan. Jonathan is an active contributor in the professional arena and delivered listing requirements, GRC and Tech related speeches in seminars and training with various professional bodies.  He was a guest lecturer on corporate governance, internal controls and tech-risks for courses co-organized by the Economic Times Business College and the City University of Hong Kong.

Jonathan also advised financial institutes in the adoption on emerging technologies and digital transformation for embracing of web 3, ML and GenAI technologies).

Jonathan led the services on:

• Internal audit co-sourcing with a digital bank in HK and operational resilience review under the Hong Kong Monetary Authority’s Supervisory Policy Manual.
• Securities and Futures Commission pre-inspection review for a state-owned financial conglomerate head-quartered in Beijing, operating across asset management, banking, insurance, securities, trust, and credit rating services.
• Anti-Money Laundering and Counter-Financing of Terrorism (“AML/CFT”) and system validation  assessment for a prominent player in the digital payment technology space with operations spanning over 300 cities in China and more than 100 countries globally.
• IT compliance assessments under the Hong Kong Monetary Authority’s Supervisory Policy Manual (TM-E-1, TM-G-1, TM-G-2, SA-2, C-RAF 2.0),other related reviews on eKYC, transaction monitoring and cloud computing technologies, and IS Guideline (under the Hong Kong Deposit Protection Board) for banking institutions.
• Independent assessments for the Multiple Credit Reference Agencies membership application for credit providers covering consumer personal data privacy, data integrity and IT security controls under the requirements introduced jointly by the Hong Kong Association of Banks, the Hong Kong Association of Restricted License Banks and Deposit-Taking Companies, the Licensed Money Lenders Association Limited and the Hong Kong Monetary Authority.
• IT controls assessment for license corporations under the Securities and Futures Commission regime, including pre-regulator inspection assessments and ISAE 3402 reviews for asset management firms.
• Independent compliance and cybersecurity assessments (covering user application security (web-based), wallet security, physical security, network and system security (including penetration testing and vulnerability scanning) and technical review on the IT infrastructure, cloud environment and other security measures) on a crypto exchanges under the Securities and Futures Commission’s Virtual Asset Trading Platform licensing requirements.
• A cloud security assessment (incl. gap analysis on security controls and configuration setting against the international CIS and CCM standards; vulnerability scanning, penetration test on platform-related applications and API, infrastructure and external attack surface; and performing attack simulation) for a major financial institution located in Asia, serving as a central hub for trading securities, derivatives, and other financial instruments.
• Cybersecurity advisory for financial institutions on implementing/ revamping NGSOC, SIEM tools, low-code platforms and on adapting blockchain solutions.