How to use: this is the "usual suspects" list — the SFC's formal request is tailored to your business. Map each category to where the documents actually live before a notice arrives; the most-sampled categories are 5 (dealing records), 6 (AML/CFT) and 9 (complaints).
The 12 categories
01Licences & corporate documents
- Business registration, certificate of incorporation, articles
- SFC licences (corporation + all licensed persons)
- Shareholder/director registers, beneficial ownership
02RO & organisational structure
- RO list and RA responsibility mapping
- Management structure chart, delegations of authority
- Evidence of RO oversight (management minutes, approvals)
03Financial resources (FRR)
- Monthly FRR returns
- Liquid-capital workings, bank reconciliations
- Audited financial statements, auditor's report
04Client onboarding & agreements
- Signed client agreements
- KYC files: identity, address, suitability assessments
- Risk disclosures, professional-investor evidence
05Dealing & order records
- Order records, confirmations, telephone recordings
- Trade allocation records, staff dealing declarations
- Best-execution policy and monitoring records
06AML/CFT
- AML/CFT policies and procedures (current version)
- CDD, ongoing monitoring, STR records
- MLRO appointment, annual AML review, staff AML training logs
07Client asset protection
- Client-money segregation, trust account records
- Client securities custody and reconciliations
08Internal controls & compliance
- Compliance manual, internal control reviews
- Conflicts-of-interest policy and declarations, outsourcing oversight
- Self-reported breach notifications to the SFC
09Complaint handling
- Complaints register (all complaints, including resolved)
- Handling procedures, client correspondence
- Internal investigation papers for complaint-related matters
10BCP & IT
- Business continuity plan, DR test records
- Information security policy, incident reports
- Third-party system vendor due diligence
11Training & competence
- CPT records (10 hours per licensed person per year)
- Onboarding and annual compliance training attendance
- Individual licence-status checks (public register captures)
12Marketing & client communications
- Marketing material samples (ads, website captures)
- Recommendation/research distribution records
- Social media policy (if any)
Section 183 bottom line: the SFC has statutory power to require documents. If you can't produce something, explain why; producing false records is a criminal offence. The repository is daily hygiene, not pre-inspection cramming — timestamped folders reveal exactly when the file was assembled.
FAQ
Are SFC inspections unannounced?
Most are notified in advance with a document request, but unannounced visits are within the SFC's powers — records must be retrievable at all times.
How much notice is given?
Usually two to four weeks. With monthly filing against the 12 categories, production is same-day.
What if documents are missing?
Gaps become inspection findings and may escalate to deficiency letters or further inquiries; refusal or fabrication is an offence.
Checklist compiled from inspection practice. General compliance information only — not legal advice. The SFC's formal request in its notice prevails. RegSir is not an SFC-licensed corporation.