SFC compliance and licensing hints – Sep 2016

General description of electronic trading systems is not sufficient

On 24 August 2016, the SFC reprimanded and fined a company HK$18.5 million for various internal control failures (SFC’s news release available here). One of them was for not having comprehensive documentation on its electronic trading systems.

Since 1 January 2014, licensed companies that conduct electronic trading of securities and futures contracts that are listed or traded on an exchange are required to comply with Chapter 18 and Schedule 7 of the SFC Code of Conduct. Licensed corporations need to manage, supervise and keep proper records of the design, development, deployment and operation of its electronic trading system and to ensure the system’s integrity.

Proper records include (a) comprehensive documentation of the design and development, including any testings, reviews, modifications, upgrades or rectifications of its system; (b) comprehensive documentation of the risk management controls of its system; (c) audit logs on the activities of its system; and (d) incident reports for all material system delays or failures of its system.  Based on the SFC’s statement of disciplinary action in the recent case, having a general description of the checks and controls of the electronic trading system is not sufficient. Licensed companies should also keep records of the design and the operation of each of the checks and controls.

Licensed companies that use an electronic trading system provided by a third party service provider should have arrangements with their service provider to ensure that they keep proper and comprehensive records as required by the Code of Conduct.

What to tell the SFC

According to its April – June 2016 Quarterly Report, the SFC closely monitored the financial position and operations of certain licensed companies that might potentially be affected by “Brexit” back in June. This serves as a timely reminder of the SFC’s circular back in May 2015 regarding compliance with notification requirements set out in the Securities and Futures Ordinance, the Licensing Information Rules and the Code of Conduct. The SFC reminded licensed companies that the notification requirements also cover information relating to their substantial shareholders or directors, as well as other corporations or businesses owned or managed by those substantial shareholders or directors. The circular also mentioned that licensed companies should notify the SFC of an event that may have a significant impact on the operations or viability of the licensed entity’s corporate group as a whole.