Compliance reminder about SFC requirements on use of external electronic data storage

Hong Kong Securities and Futures Commission (SFC) licensed corporations (LCs) which store regulatory records in the cloud, data centres or other electronic storage facilities provided by external persons (EDSPs) without keeping copies of such records in their Hong Kong business premises are reminded of the need to comply with the following requirements, according to the circular issued by the SFC on 31 October 2019 (Circular):

• notify the SFC of the external electronic data storage arrangement without undue delay
• seek the SFC’s approval of the premises where the EDSP’s cloud, data centres or other electronic storage facilities are located, as record keeping premises of the LC, under Section 130 of the Securities and Futures Ordinance (Section 130 Application).

Please refer to our article of 19 November 2019 for full details of the Circular.

The SFC’s circular of 31 March 2020, which extended the deadlines for compliance with certain regulatory requirements, does not apply to the situation where no required notification or application for the relevant approval has been made.

Assumptions/misunderstandings about the Circular

Some LCs think that they do not have to comply with the requirements in the Circular because their Hong Kong offices are able to retrieve all regulatory records stored in the cloud or data centres at any time. However the SFC does not regard “having access to” records as the same as “keeping” records, although the SFC’s primary concern must be to ensure that it gets prompt access to complete and accurate records.

The range of EDSPs covered by the Circular is very broad and includes private cloud or data centres which keep records for one LC only. The test is simply whether they are the exclusive keeper of any of the regulatory records of a Hong Kong regulated business.

How to comply with the requirements in the Circular

Notification

LCs need to carefully consider their data storage arrangements and make an online notification to the SFC as soon as possible if they are already storing regulatory records exclusively with an EDSP.

Section 130 Application

In addition, where necessary, the LC will need to submit a Section 130 Application seeking the SFC’s approval of those premises on which a cloud, data centre or electronic storage facility of an EDSP is located as its record keeping premises. If the cloud or data centre is located overseas, as part of this process the EDSP needs to undertake in writing to provide the regulatory records and assistance directly to the SFC. Some LCs are finding it difficult to obtain these undertakings in which case all the LC can do is include in the application an explanation of their efforts and ask for the SFC’s guidance on how to proceed with the application. A number of industry associations in Hong Kong have been working with the SFC in this regard so the situation is still evolving but in the meantime LCs need to do everything they can to try and comply.

Contact us for advice

If you are already storing electronic records with an EDSP or are planning to do so, please feel free to contact us for advice on whether and how you need to comply with the requirements in the Circular. We can also assist with drafting or reviewing draft notifications and Section 130 Application documents.