Hong Kong SFC licensing and compliance hints – April 2022

View PDF

Authored by: Lilian Lai

Mandatory online submission of corporate licence applications

From 1 April 2022, the Securities and Futures Commission (SFC) has ceased accepting paper corporate licence application forms or regulatory filings. All corporate and individual licence applications, notifications and regulatory filings must be submitted online via the digitalised licensing platform on WINGS.

Guidance on handling client complaints

Noting the large number of complaints against intermediaries and market activities in the recent years, and cases where licensed corporations failed to handle client complaints appropriately, the SFC issued a circular on 31 March 2022 to remind licensed corporations of the requirement to have policies and procedures in place to handle complaints in a timely and appropriate manner. The expected regulatory standards, techniques and good practices for handling client complaints are set out in the appendix.

In the circular, the SFC reminded senior management of the following expected standards of conduct, and their primary responsibility to ensure adherence to the internal controls:

(i) A Manager-In-Charge should be designated to oversee complaint handling and be available to respond to the SFC’s enquiries on the complaint handling practice.

(ii) Dedicated resources should be allocated to handle client complaints e.g. forming a complaints committee, particularly for licensed corporations servicing a large retail client base.

(iii) Serious cases should be escalated internally to senior management, and reported to the SFC without delay if it involves suspected breaches of regulatory requirements.

Be aware of business email compromise

The SFC issued a circular on 24 March 2022 alerting licensed corporations of business email compromise whereby fraudsters pretend to be known business contacts and make seemingly legitimate requests to obtain confidential information or instruct fund transfers. Licensed corporations are reminded to establish policies and procedures to vigilantly monitor and mitigate such risks. Such measures may include verifying clients’ identities, contact information and their requests independently, and adopt surveillance tools to block suspicious e-mails and unauthorised access to internal systems.