Late 2022 / early 2023: the CSRC ruled that Futu and UP Fintech (Tiger Brokers) had been conducting "unlawful securities business" on the mainland — ending a decade in which Hong Kong-licensed internet brokers acquired hundreds of thousands of mainland clients through apps and advertising. The licence was real; the solicitation was not.
1. The model that worked — until it didn't
Futu and Tiger built a clean legal architecture: Hong Kong SFC licence + mainland client acquisition via internet. Technically, the brokerage was licensed; technically, the marketing happened where the clients were — a jurisdiction where they had no licence. For ten years this ambiguity was tolerated as "internet business". Then it was named.
| Layer | Status under HK law | Status under mainland law |
|---|---|---|
| The brokerage | SFC-licensed, fully compliant | N/A — has no PRC securities licence |
| Client onboarding | Online onboarding allowed by SFC | Soliciting PRC clients without a licence = unlawful |
| Client funds flow | Normal for HK accounts | Remitting funds out for securities trading sits in FX grey zone |
2. The CSRC's split decision
The rectification drew a line between new and existing: no new mainland clients, no new inbound funds — but existing clients could keep trading. It converted hundreds of thousands of accounts into one-way dead money. The brokers' HK revenues held up better than feared precisely because the existing book kept trading — but the growth thesis was terminated.
RegSir's take
This is licence-jurisdiction mismatch made flesh: a Hong Kong licence governs conduct in Hong Kong, not conduct where the client sits. For a decade everyone knew the model was grey — the surprise was how long it lasted, not that it ended. The compliance lesson generalises: "we're licensed somewhere" is never an answer to "are you licensed there". Solicitation is territorial — it happens where the client receives it. Any cross-border digital service should map its client-facing acts by client location, not by corporate domicile.
3. Compliance takeaways
- Map solicitation by client location: marketing, account opening and ongoing service are each jurisdictional acts — check the rules where the client is, not where you are.
- "Existing client" carve-outs are fragile: they survive on enforcement tolerance, not law — don't build growth assumptions on them.
- Reverse-inquiry myths: "the client found us" is a narrow exemption with documentary burden — don't stretch it to cover active acquisition.
4. Official sources & reporting
| Document / report | Link |
|---|---|
| CSRC — rectification notices on Futu / UP Fintech (2022–23) | csrc.gov.cn ↗ |
| SFC — cross-border business FAQ | sfc.hk ↗ |
| SCMP / Reuters coverage of the app removals | scmp.com ↗ |