1. How inspections happen
SFC inspections of licensed corporations are risk-based: retail clients, holding client assets, business complexity and past breaches all raise your score. Beyond routine visits, the SFC runs thematic inspections — a sweep of firms on one topic (AML/CFT, selling practices, cybersecurity), with findings usually published as circulars.
2. What inspectors actually examine
The constant question is always: does practice match the manual? Common sampling areas:
- Client files: account opening, CDD, suitability assessments, risk-rating records
- Dealing & communications: order records, phone/email/IM retention, contract notes
- Financial resources: FRR returns, liquid capital workings, client-money segregation
- Complaints & incidents: whether the complaints process actually runs, late-reporting records
- Supervision evidence: RO/MIC sign-offs, compliance meeting minutes, review reports — proof supervision is real
- Staff personal dealing: declarations and approvals
3. Pre-inspection document checklist
- Compliance manual and internal control policies (current versions, with revision history)
- Org chart + MIC appointments + reporting lines
- Sample client onboarding / CDD files (inspectors will sample)
- Suitability assessments and risk disclosures
- Past 12 months of FRR returns and calculation workings
- Complaints register, error-trade / incident reports
- Staff dealing declarations and CPT records
- Remediation records from the last inspection / internal audit
4. During the visit
- Single point of contact: RO/MIC answers inspector questions; staff should not freelance replies
- Answer from the file, honestly: when unsure, say you will verify against records — never guess on the spot
- Log everything: what was asked, what was taken — write it down
- Do not hide: proactively disclosing a known issue plus the fix beats being discovered
5. Afterwards: the deficiency letter
After the visit the SFC issues a letter listing its findings. Handle it like this:
Confirm each finding — contest items properly where you disagree, rather than swallowing everything
Attach a remediation plan per finding: action, owner, deadline
File proof of fixes — the next inspection starts by checking the last one's follow-up
6. Official sources
| Document | Link |
|---|---|
| SFC intermediaries supervision pages | sfc.hk ↗ |
| Inspection-related circulars (thematic findings, control expectations) | sfc.hk circular gateway ↗ |
| Management, Supervision and Internal Control Guidelines | sfc.hk ↗ |
| Code of Conduct | sfc.hk ↗ |
7. FAQ
Can inspections be unannounced?
They are generally notified, but notice can be short, and regulators have on-site powers in specific cases. Daily readiness is the answer.
Do findings always lead to penalties?
No — most end in a deficiency letter; handled well, it closes there. Escalation to enforcement is typically for serious, repeated, or client-harm issues.
Where do I read thematic inspection results?
The SFC publishes them as circulars — those documents are the most authoritative inspection checklists available; see Enforcement News for our analysis feed.