In 2026 the SFC's enforcement lens visibly shifted: not only blockbuster fraud, but routine internal controls at mid-tier firms. Two fines landed within five months — Bright Smart Securities HK$2.8m (Jul 2026, wash-trade surveillance failures) and Kylin International HK$9m (Feb 2026, fund-management failures). Together smaller than one big-bank ticket — but the signal is broader: the SFC is now asking every firm, one by one, "does your surveillance actually work?"
1. What each fine was for
Bright Smart (HK$2.8m, Jul 2026, 26PR117): the surveillance system could not detect clients wash-trading between accounts under their own control — fake volume, the building block of manipulation. Neither pre-trade controls nor post-trade surveillance caught it.
Kylin International (HK$9m, Feb 2026, 26PR19): fund-management failures — insufficient due diligence, conflict-of-interest management gaps, valuation-procedure problems. The SFC's message was blunt: a fund manager is not a passive fee-collector; it is a fiduciary answerable to investors.
2. Why this round matters
- From "big cases" to "density": past fines concentrated on large institutions (UBS, DBS). This round hit a mid-size broker and a fund manager — the enforcement radius is widening, and "too small to notice" is no longer a strategy.
- "Having a system" ≠ "it works": Bright Smart had surveillance — but no same-beneficial-owner logic. It is CCTV pointed at the wrong wall. What regulators now test is what the system actually catches.
- The fiduciary framing of fund management: Kylin restates the legal position — diligence, conflicts and valuation are baseline duties, not enhancements.
- The FATF echo: with the 2029 mutual evaluation approaching, enforcement density and visibility are rising — these "mid-size tickets" are part of the data demonstrating effectiveness.
3. Legal and regulatory analysis
| Instrument | How it applies | Compliance meaning |
|---|---|---|
| Code of Conduct 4.3 (internal controls) | Trade surveillance, pre-trade controls, anomaly detection | Rules must cover multiple accounts under one beneficial owner |
| SFO Part XIII/XIV (market misconduct) | Wash trading is false trading — brokers must detect and report | Failing to see it indirectly enables manipulation |
| Fund Manager Code of Conduct (FMCC) | Kylin — diligence, conflicts, valuation | The operationalisation of fiduciary duty |
| STR reporting duty | Suspicious transactions must go to the JFIU | Surveillance output must connect to the reporting pipeline |
RegSir's take
Together these fines say one thing: "do you have a process" is not the question — "does your process catch anything" is. Bright Smart had surveillance with rules written too narrowly; Kylin had a management structure with three core duties done thinly. For mid-tier firms, the cheapest self-defence is a surveillance effectiveness test: inject a simulated wash trade and see whether it fires. If it does not, your surveillance is decoration. The test takes a day; the fine costs far more.
4. Compliance takeaways
- Surveillance must see the beneficial-owner dimension: matched orders across accounts sharing one UBO are the dominant wash pattern — a rule without that dimension is blind
- Run periodic effectiveness tests: inject simulated suspicious patterns, verify the system fires — at least annually, on record
- The fund-manager three-pack: investment-diligence files, conflicts register + handling records, valuation policy + execution evidence — the FMCC baseline
- Wire surveillance output into the STR pipeline: who reviews alerts, within what SLA, what evidence stays — write the whole chain down
5. Official sources
| Document | Link |
|---|---|
| SFC — Kylin International disciplinary action (26PR19, 9 Feb 2026) | sfc.hk ↗ |
| SFC — Bright Smart Securities disciplinary action appendix (26PR117, Jul 2026) | sfc.hk ↗ |
| SFC — Fund Manager Code of Conduct (FMCC) | sfc.hk ↗ |
| Securities and Futures Ordinance — Part XIII/XIV (market misconduct) | elegislation.gov.hk ↗ |