SFC’s regulatory sandbox

On 29 September 2017, the Securities and Futures Commission (SFC) launched a regulatory sandbox (Sandbox) for licensed corporations and start-up firms considering carrying on regulated activities through the use of innovative financial technology (Fintech).

The Sandbox provides a confined regulatory environment where the compliance of innovative financial services and products that utilise Fintech are tested before they are fully launched to the market.

It is the SFC’s first launch of a regulatory sandbox, following other regulators’ launch of similar sandboxes since last year.

Entry requirements

Licensed corporations or start-up firms who wish to become “qualified firms” to use the Sandbox must:

• be fit and proper;

• utilise innovative technologies; and

• demonstrate a genuine and serious commitment to conduct regulated activities through the use of Fintech.

Qualified firms must be licensed with the SFC and comply with applicable regulatory requirements (including financial resources requirements). Start-up firms therefore need to apply for and obtain appropriate licences before commencing regulated businesses in the Sandbox.

Companies operating in the Sandbox should expect to be closely monitored and supervised by the SFC. 

Companies interested in using the Sandbox may initiate discussions with the SFC through the SFC Fintech Contact Point.

Operating environment

Qualified firms operating in the Sandbox will be subject to the SFC’s scrutiny as below.

1.       Conditions may be imposed on the licences of qualified firms and limit their operations in the following aspects:

• types of clients;
• maximum exposure of each client;
• maintenance of appropriate compensation schemes for investors; and
• periodic supervisory audits by the SFC.

2.       Qualified firms may need to refine their business models and enhance internal controls and risk management from time to time under the SFC’s intensive supervision.

3.       Qualified firms are expected to have investor protection measures in place to address actual or potential risks.  They will be required to notify clients that they are operating in the Sandbox and provide full disclosure of potential risks and compensation arrangements.

Exit mechanism

Qualified firms may exit the Sandbox and apply for the removal of any licensing conditions imposed in connection with their Sandbox-based activity after they have satisfied the SFC that:

• their technologies are reliable and fit for their regulated business; and
• their internal control procedures are adequate to address the risks identified.

Recognition of technology related experience

When launching the Sandbox, the SFC issued a separate circular to clarify its approach in recognising technology experience as the relevant industry experience for an individual with expertise in the application of technology to investment activity when applying to be a responsible officer.  Routine IT experience will not be taken into account; but the SFC may recognise, for example, experience in the design of investment algorithms or the development of robo-advisory systems.

The applicant will need to demonstrate that:

• the applicant has been a key person in developing, or ensuring the proper and continued functioning of, a technology, platform or system; and

• the technology, platform or system in which the applicant has expertise is central to the regulated activity of the firm he works for.