1. Implementation of a new investor identification regime in Q4 2022
The Securities and Futures Commission (“SFC”) has taken significant steps to enhance its surveillance and enforcement functions in respect of the financial markets in Hong Kong.[1] In August 2021, the SFC published its consultation conclusions on proposals to introduce an investor identification regime in Hong Kong (“HKIDR”) at the trading-level for the securities market and an over-the-counter securities transactions reporting regime (“OTCR”) for shares listed on the Stock Exchange of Hong Kong (“HKEX”) (“Consultation Conclusions”).[2] The SFC and HKEX also published further guidance regarding the HKIDR and OTCR.[3]
The HKIDR is expected to be launched in Q4 of 2022, with the OTCR to follow in Q2 of 2023.[4] This article outlines the key regulatory requirements of the two regimes, and our practical tips to assist your preparation for the implications of these new regimes.
2. Overview of the HKIDR
Application scope of the HKIDR requirements
The application scope of the HKIDR involves a number of key issues as indicated in the diagram below.
2.1 Which entities are required to comply with the HKIDR requirements?
“Relevant Regulated Intermediaries” (“RRIs”) are subject to the HKIDR requirements. RRIs refer to SFC-licensed corporations and registered institutions which:
- submit (or arrange to submit) for execution of an on-exchange order;
- carry out an off-exchange order; or
- conduct off-exchange trade reporting,
in connection with the carrying out of (i) proprietary trading, or (ii) the provision of securities brokerage services for another person in respect of orders placed through an account opened and maintained for that person.
2.2 Who are the in-scope clients?
The HKIDR requirements apply to “direct clients” of an RRI. Generally, a direct client refers to the most immediate client of an RRI, which has placed or proposes to place an order through a securities account with that RRI. The current rules of the HKIDR do not apply to clients of an RRI’s overseas affiliates.[5]
Who is a direct client of an RRI ultimately depends on the order flow of a transaction. The table below further illustrates the concept of direct client using different trade examples.
|
Types of trades
|
Direct client
|
Example
uses 2
|
|
Proprietary trade of an RRI
|
The RRI itself |
|
|
Trade routed through a chain of intermediaries
|
The first person in the chain of intermediaries which is not an RRI |
|
|
Aggregated order
|
Each client or joint account to which the underlying order relates |
|
|
Trust
|
Trustee |
|
|
Fund manager or investment fund
|
This depends on which entity/person is the securities trading account holder through which an order is placed. If a fund manager’s account maintained with the RRI is used to place orders, then the fund manager will be treated as the direct client. Alternatively, if an investment fund’s account is used to place orders, the investment fund will be treated the direct client. |
|
|
Collective investment scheme or discretionary account
|
This also depends on which entity/person is the securities trading account holder through which an order is placed. If a discretionary account manager’s account is used to place orders, then that discretionary account manager will be treated as the direct client. Alternatively, in the case of a discretionary account used to place orders, the discretionary account client will be treated as the direct client. |
|
|
Trade in joint accounts
|
Each holder of the joint account |
|
2.3 What types of products are covered under the HKIDR?
The HKIDR requirements apply to listed securities (including listed derivatives) traded on the HKEX at the trading-level (but not the holding-level). The HKIDR requirements do not apply to derivatives traded on the Hong Kong Futures Exchange or unlisted structured products (such as equity-linked instruments, equity-linked notes, etc), nor the delivery of HKEX-listed securities in accordance with the terms of these unlisted structured products.
2.4 What are the key regulatory requirements of the HKIDR?
Key regulatory requirements
Under the HKIDR, RRIs are required to:
- Assign an exclusive and permanent broker-to-client assigned number (“BCAN”) to each relevant client that has placed or proposes to place an on-exchange order or off-exchange trade (reportable to HKEX under its rules) in securities listed or traded on HKEX’s trading system (“Reportable Transaction”). Each securities trading account can only have one BCAN.
- Submit up-to-date client identification data (“CID”) of relevant clients along with their BCAN in the form of a mapping file (“BCAN-CID Mapping File”) to a data repository to be maintained by the HKEX. Any changes to the CID should be updated to HKEX on an ongoing basis.
- Tag the relevant BCAN to each Reportable Transaction[6] and report submission errors in HKEX’s prescribed error notification form.
BCAN and CID should be submitted to the HKEX in accordance with the timetable below.
|
Client/account type
|
Deadline to submit CID and BCAN information of the client
|
Example
uses 2
|
|
Existing clients |
By the day before client trades (T-1) Note: The T-1 arrangement aims to help avoid overloading of HKEX’s system. RRIs should submit the BCAN-CID Mapping File before the implementation date of the HKIDR in order to trade for the relevant clients when the HKIDR launches. |
|
|
New clients |
On the same day the client opens the account and places an order (T+0) |
|
|
Dormant accounts (those which have been inactive for 24 months since the last trade) |
On the same day the client re-activates account by placing an order (T+0) |
|
Hierarchy for acceptability of ID document of a direct client
The CID includes:
- a client’s full name on their official ID (in the case of an individual client) or certificate of incorporation;
- the issuing jurisdiction of the ID or certificate of incorporation;
- the ID type; and
- the ID number.
An RRI should follow the hierarchy order in accepting the CID of a direct client as listed in the diagram above – that is, only if a client does not hold the first type of document in the hierarchy then the RRI should accept the next type of document and so forth.
Two points are worth noting in relation to the requirements on the hierarchy for acceptable ID documents:
- For an individual client with multiple nationalities who does not hold an HKID card, an RRI may select and register any of the individual client’s available national identity information in its discretion.
- The SFC has clarified that RRIs cannot simply rely on “know-your-client” information collected under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. In order to comply with the HKIDR requirements in relation to CID, RRIs should inform their clients of the hierarchy of ID documents, and request/update the ID document as required under the hierarchy.[7]
3. Overview of the OTCR
Under the OTCR, RRIs are required to report the following two types of share-related activities to the SFC:
- transfer of ordinary shares and interests in real estate investment trusts (REITs) (collectively, “Shares”), that are:
- listed on the HKEX;
- made in connection with an OTC securities transaction; and
- transactions under which stamp duty is chargeable in Hong Kong;[8] and
- deposit or withdrawal of physical share certificates.
The RRIs will need to report these two types of trades (irrespective of whether the RRIs act as principal or agent in such trades) to the SFC via a designated portal within three trading dates after the transaction day.
Similar to the HKIDR, RRIs must obtain express consent from individual clients before transferring any personal data to the SFC. If the RRIs cannot obtain such consents, they can only effect requests to “transfer out” shares and withdrawal of physical shares certificates, and must not effect requests to “transfer in” shares or physical certificate deposits.
|
Type of transaction
|
Scope of reporting
|
Example
uses 2
|
|
Transfer of Shares |
The scope of reporting covers:
|
|
|
Deposit or withdrawal of physical share certificates |
The scope of reporting covers:
|
|
4. Implications on data privacy requirements
Compliance with the HKIDR and OTCR will involve potential collection, use and transfer of personal data. The SFC has reminded RRIs to adopt data privacy and security measures to safeguard data collected, transmitted and stored, and obtain consent from their clients.
The table below summarises the relevant data privacy requirements.
|
Regulatory requirement
|
What does it mean?
|
Example
uses 2
|
|
Express consent |
RRIs are required to obtain express consents (eg in written form, through electronic means or by phone) from their relevant clients, clearly indicating their agreement to the use and transfer of their personal data to the SFC and HKEX. |
|
|
Explanation before obtaining consent |
RRIs are required to provide clear explanation to clients before obtaining the client consent about the purpose of obtaining the consent and consequences if the clients fail to provide consent. If a client’s consent cannot be obtained, RRIs should not submit the client’s BCAN or CID to HKEX. The RRIs should only effect sell orders in respect of existing holdings of a listed security (but not buy orders) for that client. |
|
|
Authentication of client identity |
RRIs should properly authenticate and validate the identity of the client, and must make further enquiries when necessary. |
|
|
Purpose of use and minimum content of client consent |
Among other things, the client consent must state that:
|
|
|
Proper record of consents and withdrawal of consents |
RRIs are required to maintain a record of client consent, withdrawal for no less than two years after the person ceases to be a client, and provide the record to the SFC upon request. |
|
5. KWM practical tips
5.1 Ensure system compatibility with HKEX’s order management system
RRIs should ensure they have in place systems that are compatible with the tagging and reporting requirements under the HKIDR. Also, in order to discharge its management accountability, the management of an RRI should ensure regular testing and ongoing monitoring are performed to assess the efficiency of such systems.
5.2 Assess existing client documentation
In relation to the client consent on personal data collection and transfer, we recommend that RRIs conduct a comprehensive review of its existing client facing documentation (including account opening documents, personal information collection statements and privacy policy statements), to ascertain whether the existing client consent sufficiently covers requirements under the HKIDR and OTCR. If gaps are identified, then RRIs should update the relevant documents. Where appropriate, RRIs should seek legal advice regarding its observance of the Personal Data (Privacy) Ordinance or any other applicable data privacy laws.
5.3 Revamp of internal policy and procedures
We recommend that RRIs review and revamp its internal policies and procedures (including the compliance manual) to cover, amongst others:
- the regulatory requirements and expectations under the HKIDR and OTCR (including the CID collection requirement, client consent requirement, etc);
- steps on assigning BCAN to clients, compiling the BCAN-CID Mapping Files, and updating clients’ CID;
- processes and procedures for obtaining client consent and communicating the implication and consequences if the client fails to provide an explicit consent; and
- procedures for keeping and maintaining written logs of all client consents and consent withdrawals.
5.4 Enhance internal control systems
As RRIs are required to collect CID from their clients and compile BCAN-CID Mapping Files, they should review and enhance their internal control systems to ensure that any BCAN-CID Mapping Files of their clients are properly stored, processed, and maintained in their systems which should be protected against unauthorised, accidental or inappropriate access, modification, erasure or loss and be readily accessible for compliance checking and audit purposes.
RRIs should also comply with the technical specifications in relation to the compilation of BCAN-CID Mapping Files and tagging (as published by the SFC and HKEX from time to time).[9]
5.5 Human resources planning and training
RRIs are advised to assign appropriate personnel for supervising and handling information collected under HKIDR and OTCR. For example, the Manager-in-Charge of compliance should monitor the progress of the RRIs compliance with the HKIDR/ OTCR; the Manager-in-Charge of operational control should ensure the internal systems are capable of handling the client data collected.
RRIs should also provide their staff members with appropriate compliance training and relevant regulatory updates on the HKIDR and OTCR requirements.
6. How can KWM help?
KWM has extensive experience in advising financial institutions on important regulatory developments. We have a wealth of experience on:
- drafting, reviewing and revamping client facing documentation (including account opening documents, personal information collection statements and privacy policy statements), and policies and procedures for financial institutions;
- advising on issues relating to data privacy law; and
- providing compliance trainings for licensed corporations and registered institutions on the HKIDR and OTCR.
We would be delighted to assist you in navigating the HKIDR and OTCR.
References
[1] Any reference to "Hong Kong" or "Hong Kong SAR" should be construed as a reference to "Hong Kong Special Administrative Region of the People's Republic of China”.
[2] The Consultation Conclusions are available at: https://apps.sfc.hk/edistributionWeb/api/consultation/conclusion?lang=EN&refNo=20CP7.
[3] Guidance papers and circulars published by SFC and SEHK can be accessed via the SFC webpage and HKEX webpage.
[4] The expected launch dates of the HKIDR and OTCR are indicated on the SFC’s webpage, available at: https://www.sfc.hk/en/Rules-and-standards/Investor-Identification-and-OTC-Securities-Transactions-Reporting.
[5] See paragraph 57 of the Consultation Conclusions. In such scenario, SFC has the statutory power under section 181 of the Securities and Futures Ordinance (Cap 571) (“SFO”) to request information about trades, including those involving overseas brokers where suspicious trading activities arise.
[6] BCANs for Reportable Transactions should be submitted when an order is placed or when a trade is reported to HKEX, except where BCANs for aggregated orders may be submitted within a T+3 timeframe.
[7] See paragraphs 134 and 135 of the Consultation Conclusions.
[8] The reporting requirement does not apply to a transaction if: (a) the transaction in respect of the Shares is granted with a partial or full stamp duty relief from the Hong Kong Inland Revenue Department; (b) the transfer of Shares is made in accordance with the terms of a structured product or derivative; or (c) the transfer of Shares is for the conversion of a depository receipt into Shares or vice versa.
[9] The SFC and the HKEX have published information paper and technical specifications in relation to the HKIDR requirements. See: https://www.sfc.hk/en/Rules-and-standards/Investor-Identification-and-OTC-Securities-Transactions-Reporting and https://www.hkex.com.hk/Services/Trading/
Securities/Overview/Trading-Mechanism/HKIDR?sc_lang=en.
