Compliance is rarely hard because nobody knows the rules. It is hard because the rules say "as soon as practicable", "fit and proper", "adequate controls" — and leave you to fill in the answer. These are the ten places licensed corporations most often stumble, each mapped to its legal basis and a workable way to run it.
1. Part XV disclosure of interests: 5% is not the only threshold
Why it is hard: long positions trigger at 5%, then every whole-percentage crossing (5→6, 7→6) requires a fresh filing; short positions start at 1%. The killer is derivatives — options, CBBCs and convertibles all count towards the underlying shares, and longs and shorts are computed separately, never netted. Securities lending has its own rulebook.
Legal basis: SFO Part XV (ss.310–376), the Part XV Outline, the Securities Borrowing and Lending Rules (Cap.571X), and the Exclusions Regulation (Cap.571AG).
How to operate: (1) Run a position calendar — reconcile thresholds mechanically after every close, never by memory; (2) convert every derivative into its underlying-share equivalent before aggregating; (3) run stock lending through Cap.571X approved arrangements instead of guessing at exemptions; (4) set a three-business-day deadline alarm — late filing is the most common technical breach.
2. Inside information: how fast is "as soon as practicable"?
Why it is hard: Part XIVA requires a listed corporation to disclose inside information as soon as practicable — with no fixed clock. The safe harbours (negotiations in progress s.307B; confidentiality preserved s.307D) must be continuously satisfied, and any leak forces immediate disclosure. "When did we actually know?" is a question every board meeting may have to answer.
Legal basis: SFO Part XIVA (ss.307A–307E) and the Guidelines on Disclosure of Inside Information.
How to operate: (1) form a disclosure committee — fix in advance what escalates and who decides; (2) keep a recognition checklist: material earnings deviation, major transactions, litigation, senior departures; (3) treat unusual price movement plus media enquiries as a leak signal — pre-agree an "assess within four hours" drill; (4) safe harbours stand only on documented confidentiality — keep the limited-access list current.
3. Suspected market misconduct: what do you do when you see it?
Why it is hard: a client suddenly buys aggressively, or a staff member overhears inside information — an intermediary has no statutory duty to investigate, but the Code of Conduct requires you to safeguard market integrity. The Market Misconduct Tribunal (civil) and criminal prosecution run in parallel; reporting the wrong way can miss both tracks.
Legal basis: SFO Part XIII (Market Misconduct Tribunal, ss.274–295) and Part XIV (criminal offences), the Code of Conduct, Cap.571L (registration of MMT orders).
How to operate: (1) define the escalation line — frontline reports anomalies to compliance, nobody self-investigates; (2) document the assessment even when you decide not to report; (3) money-laundering suspicion goes to JFIU (STR), market misconduct to the SFC — different lines, sometimes both; (4) protect the reporting employee — whistleblower cover is part of internal controls, not an HR nicety.
4. MIC regime: be able to say who owns which function
Why it is hard: eight core functions (overall management, business, risk, finance/accounting, compliance, internal audit, IT, operations) each need a named manager-in-charge; not every MIC must be licensed, but the one supervising regulated activities must be an RO; and departures must be notified to the SFC within seven business days.
Legal basis: the SFC's 2017 MIC circular series (17EC6, 17EC35 and related) requiring submission of MIC particulars and organisation charts.
How to operate: (1) maintain a function map — eight functions against actual names, reviewed every six months; (2) build the seven-business-day notification into the offboarding checklist; (3) one person covering several functions is normal for small firms, but be able to justify it — do not stack internal audit on top of the functions it audits.
5. Client assets: standing authority runs on a 12-month clock
Why it is hard: handling client securities needs written standing authority that expires after twelve months — let it lapse and every transaction after is non-compliant. Repledging client securities has a statutory cap; segregated client-money accounts need daily reconciliation. Breaches here are criminal, not just a fine.
Legal basis: Client Securities Rules (Cap.571H), Client Money Rules (Cap.571I), and the SFC's Suggested Control Techniques and Procedures.
How to operate: (1) track every standing-authority expiry in the master data and batch renewal letters 30 days early; (2) reconcile segregated accounts daily and chase breaks same-day; (3) hard-code the repledging cap into systems so manual override is impossible; (4) collect all authorisations at onboarding — backfilling is the classic audit failure.
6. CIS classification: four elements decide everything
Why it is hard: a collective investment scheme needs four elements — pooled contributions, centralised management, no day-to-day investor control, pooled profits. Marketing a private fund to the public requires s.103 authorisation; the professional-investor route demands proof that every contact is a PI. Misclassification equals unlicensed public offering.
Legal basis: SFO Schedule 1 (CIS definition), s.103, the Collective Investment Schemes Notice (Cap.571M), and the CIS advertising and internet guidelines.
How to operate: (1) run the four-element checklist before launch and document the answer; (2) on the PI-only route, collect PI proof before pitching and keep contact records; (3) run all marketing materials — including webpages and WhatsApp groups — against the internet guidelines; "private placement" is not a magic label.
7. Unlicensed boundary: one line between "information" and "advice"
Why it is hard: is a research note information or advice? Does introducing clients to a broker for a fee trigger Type 1? Intra-group, incidental and professional exemptions each carry their own conditions. Claiming "I only provide information" is no defence — what matters is what you actually do.
Legal basis: SFO Schedule 5 (regulated-activity definitions and exemptions) and s.114 (unlicensed dealing offence).
How to operate: (1) to Schedule 5 — which fee attaches to which activity triggering which RA; (2) the advice red line: specific security + specific action + specific timing = advice; objective factual statements = information; (3) never rely on memory for exemptions — check each condition and file the analysis; (4) when in doubt, ask first — unlicensed activity is a criminal offence, not a warning letter.
8. Suitability and complex products: PI exemption is not a free pass
Why it is hard: Code of Conduct para 5.2 requires a suitability basis before any recommendation. Complex products (derivatives, structured products) carry extra disclosure and selling procedures. Professional-investor exemptions do not mean zero responsibility — parts of the complex-product rules still apply.
Legal basis: Code of Conduct paras 5.2 and 5.5 and the complex-product requirements.
How to operate: (1) maintain a product whitelist — which products are complex and why, in writing; (2) keep suitability records that explain why the product fits that client — not a checkbox; (3) PI exemption documents should state which obligations are waived and which survive — exemptions are item-by-item, not blanket.
9. Staff personal dealing: PA dealing is a core control
Why it is hard: staff trade for themselves while holding client orders and research — uncontrolled PA dealing is a front-running and insider-dealing petri dish. How do you enforce blackouts before IPOs and research releases? A Chinese wall written down is not the same as one that works.
Legal basis: Code of Conduct internal-control requirements and the SFO insider-dealing provisions (ss.270/291 and related).
How to operate: (1) mandatory account disclosure — declare every securities account at onboarding and re-confirm annually; (2) pre-approval for every personal trade, with the compliance blackout list refreshed daily; (3) a minimum holding period (e.g. 30 days) to kill day-trading; (4) make the wall physical — restricted lists and deal-team files off shared drives.
10. OTC derivatives: draw the reporting boundary clearly
Why it is hard: OTC derivative transactions must be reported via the HKTR — but who reports when both sides are Hong Kong entities? Add non-centrally-cleared margin requirements, daily reconciliation and UTI matching, and every step is an operational problem.
Legal basis: the SFO subsidiary legislation on OTC derivatives reporting and margin, plus the joint HKMA–SFC circulars.
How to operate: (1) confirm the reporting split before trading — put it in the confirmation, not on a phone call; (2) run UTI matching daily and chase mismatches the same day; (3) watch margin thresholds in-system, not at month-end; (4) run a "reportable or not" checklist before onboarding any new product type — new categories are not automatically covered.
Official sources
| Document | Link |
|---|---|
| Securities and Futures Ordinance (Cap.571) — Parts XIII/XIV/XIVA/XV, Schedules 1 and 5 | elegislation.gov.hk ↗ |
| Outline of Part XV — disclosure of interests guidance | sfc.hk ↗ |
| Guidelines on Disclosure of Inside Information | sfc.hk ↗ |
| Client Securities Rules (Cap.571H) / Client Money Rules (Cap.571I) | elegislation.gov.hk ↗ |
| MIC circulars (17EC35 and related) | sfc.hk ↗ |
| Code of Conduct for licensed persons | sfc.hk ↗ |
FAQ
Which of the ten appears most often in enforcement?
Insider dealing and market misconduct dominate; unlicensed activity and internal-control failures follow. Read enforcement news closely and a pattern emerges: most firms did not fail on ignorance — they failed on missing records and unclear ownership. That is why every control here ends with "keep the record".
How does a small firm digest all ten?
Do not do everything at once. Turn each issue into a one-page internal checklist — trigger, owner, record to keep. Automate the mechanical parts (disclosure thresholds, standing-authority renewals, MIC deadlines) and reserve human judgment for the rest.
Can RegSir answer my specific scenario?
Yes — every official document cited is in the RegSir corpus. Describe your situation in the app (e.g. "a client holds 4.9% plus an option short position — disclose?") and RegSir will check it clause-by-clause against Part XV and the Outline.