5 January 2021
In late 2019 the SFC published a circular on the regulatory expectations when using external electronic data storage providers (“EDSPs”). The industry was however still grappling with a number of issues in this area, in particular around the use of a group affiliate as the sole EDSP and the difficulties associated with obtaining the SFC mandated undertakings from third party EDSPs. The SFC has now published a set of FAQs which offers welcome clarification on these issues, and in particular offers an alternative route for compliance. We have highlighted some of the main points of interest below. The SFC expects firms to ensure that they meet the requirements as soon as possible.
The SFC is not changing the requirements set out in the circular last year, however it is introducing a certain amount of flexibility in meeting certain regulatory expectations.
The flexibility is being introduced on several fronts and is welcomed, however licensed corporations (“LCs”) should note that the flexible arrangements are generally accompanied by the proviso that they must first be discussed with the SFC. The FAQ alternatives include;
- If an LC has difficulty appointing two Hong Kong SAR resident Managers-in-Charge (“MIC”) to be responsible for the EDSPs as required in the circular, it may be possible to appoint, with the SFC’s consent, one MIC or one Responsible Officer (“RO”) ordinarily resident in Hong Kong (FAQ 2).
- Crucially, the two MICs (or, with the SFC’s consent, the MIC or RO) can now give the required undertaking for using EDSPs or affiliates (located either in Hong Kong or overseas) instead of requiring the EDSP to give the undertaking/notice. The FAQ sets out a template undertaking to be used by MICs (or the MIC/RO), and the requirements will mean the MICs (or MIC/RO) will need to be confident they/he/she will be able to access and have control over records held with the EDSP. This should therefore be understood to be a flexible arrangement rather than a reduction in standards (FAQ 4).
- The SFC has seemingly allowed some further flexibility with its final sentence in FAQ4 as it notes that “Licensed corporations may also approach the SFC to propose or discuss other alternatives which may satisfy the SFC’s regulatory objectives and requirements”, however this is likely to only apply to very specific situations.
The FAQ make clear that it is permissible for Regulatory Records to be kept solely with affiliates inside or outside of Hong Kong, however, LCs will need to first seek approval from the SFC under section 130 of the Securities and Futures Ordinance (“SFO”) for these arrangements. In addition to SFC approval, LCs will retain regulatory responsibility under these arrangements and will also need to follow the relevant sections setting out obligations in the FAQs and circular – for example, ensuring that the SFC can access the Regulatory Records when required, and the general obligations in Section E of the circular (covering controls and procedures around using EDSPs) (FAQ 5).
LCs which have already exclusively been using affiliates or an EDSP to store Regulatory Records but have not applied for approval under section 130 of the SFO should approach the SFC as soon as possible by (FAQs 6, 7 & 12):
- without undue delay, notifying the SFC’s Licensing Department of the Intermediaries Division; and
- applying for approval under section 130 of the SFO as soon as practicable.
The MICs (or MIC/RO) Undertaking – If an LC is going to use this undertaking, there are certain conditions that must be complied with (FAQ 9):
- LCs must maintain a document which provides an overview of how electronic Regulatory Records are stored exclusively with affiliates and/or EDSPs (an “Access Map”). The Access Map should broadly identify the types of electronic Regulatory Records which are stored exclusively with each affiliate or EDSP, and the physical locations. It must be kept up to date and available to the SFC within two business days upon request;
- LCs must ensure operational resilience by performing a daily back-up of electronic Regulatory Records to ensure a complete and up-to-date set of records are maintained for (i) client transactions (ii) outstanding client positions and (iii) client assets held by the LC or its associated entity.
Changes are made to FAQ on Premises for business and record keeping in line with the new EDSP FAQ.
Action Needed
The FAQs provide some more detail so firms should be reviewing their usage of EDSPs in light of the circular and FAQs together, and taking prompt action where necessary (for example, applying for approval from the SFC under section 130 of the SFO).
The FAQs indicate that actions should be taken “without undue delay”, therefore reviewing EDSP usage arrangements should be a priority area. We have been advising firms on the use of EDSPs and would be happy to help you in reviewing arrangements and liaising with the SFC in relation to your arrangements.
For further information, please contact: