Circular Issued by the Securities and Futures Commission to Licensed Corporations on Review of Online Brokerage, Distribution and Advisory Services

Circular 54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 1 of 4 31 August 2022 Circular to licensed corporations Review of online brokerage, distribution and advisory services

1. The Securities and Futures Commission (SFC) conducted a review of the business models of licensed corporations (LCs) which provided online brokerage, distribution and advisory services and their compliance with regulatory requirements when onboarding clients and distributing or advising on investment products via their online platforms. The review was conducted in various ways including via a fact-finding survey, desktop analysis and inspections.
2. This circular summarises key observations and compliance issues identified from the review. Details of the review, along with the related expected regulatory standards which LCs should be attentive to when providing services online as part of their regulated activities, are summarised in a report attached in the Appendix (the Report).
3. As more retail investors use various types of online platforms for investing, LCs should review their systems, controls and procedures having regard to the expected standards as reminded in this circular and the Report, and ensure that their online platforms are properly designed and operate in compliance with all applicable rules and regulations. Key observations
4. As part of the review, the SFC surveyed 50 LCs about their ways of client onboarding, types of products, services and functionalities offered to clients through online platforms, and the extent of use of social media platforms for marketing and communication purposes. The review found that 96% of new accounts opened by the surveyed LCs within a 12-month period were through non-face-to-face (Non-FTF) client onboarding approaches.
5. There was an increasing number of LCs distributing investment products to clients or executing client orders through their online platforms. The investment products include equities, exchange-traded funds, futures and options contracts, collective investment schemes for both investment and cash management purposes, bonds, and virtual asset￾related products1 (VA-related products).
6. Some LCs have embedded special functionalities into their online platforms for better customer experience such as technical analysis of stocks to facilitate investors’ market research and investments in a self-directed environment, and game-like features to interest investors in using their online platforms. Also, the use of social media platforms by LCs for marketing and communication has become popular. 1 Refer to the Joint circular on intermediaries’ virtual asset-related activities issued on 28 January 2022 for the definitions of “virtual asset” and “virtual asset-related products”.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 2 of 4 Regulatory concerns and reminders 7. While the investment services delivered through online platforms and the innovative features offered thereon may bring convenience to investors, certain common compliance issues associated with them were noted. In particular, the review identified the following key deficiencies: Non-FTF client onboarding 8. Some LCs failed to conduct proper client identity verification procedures when onboarding clients online. For example, there were deficiencies in recognising clients’ designated bank accounts in Hong Kong and some LCs failed to procure appropriate independent assessment for the facial recognition technologies they used to authenticate clients’ identities when onboarding overseas clients. 9. Non-FTF client onboarding generally poses a higher risk of impersonation. Therefore, LCs should conduct proper procedures for client identity verification as specified in the acceptable account opening approaches published on the SFC’s website2 . Online trading, distribution and marketing Clauses and statements which might have restricted client’s rights, excluded LC’s obligations, or misdescribed LC’s services 10. Whilst implementing mechanisms to fulfil their suitability obligations, some LCs appeared to have excluded their potential suitability obligations by including clauses and statements in client agreements and risk disclosures, and request their clients to make a blanket acknowledgement that no solicitation or recommendation was provided by the LCs. This may be seen as an attempt to restrict clients’ rights, exclude the obligations of the LCs, or misdescribe the actual services provided to clients3 . Insufficient product due diligence (PDD) and failure to observe selling restrictions applicable to specific products 11. Some LCs have failed to perform sufficient PDD to properly assess the key features and risks of the products or observe the selling restrictions or additional regulatory requirements when distributing certain investment products, such as VA-related products. Inadequate client risk profiling 12. Certain LCs did not put in place adequate measures to identify and assess inconsistent client information or to detect abnormal frequent updates of client’s risk profile questionnaire during the know-your-client process. In one extreme case, an LC failed to prevent an investor from revising, or detect that an investor had revised, the risk profile questionnaire eight times within one hour and provided inconsistent information in each 2 Refer to the “Rules and standards > Account opening” section of the SFC website. 3 Refer to paragraphs 6.3 and 6.5 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 3 of 4 round of update. Ultimately, the investor was able to obtain a higher risk tolerance classification and purchased investment products rated as higher risk. Lack of monitoring of information and commentaries posted on platforms 13. An LC could not demonstrate that it had proper monitoring mechanisms in reviewing information and commentaries posted by the LC or its affiliates on the online platform so as to ensure that they are accurate and not misleading. 14. LCs that are providing order execution, distribution or advisory4 services in respect of investment products via online platforms are reminded to adhere to the Guidelines on Online Distribution and Advisory Platforms and related Frequently Asked Questions (FAQs). 15. LCs are also reminded that in promoting and providing services through online platforms to overseas investors, they should comply with the requirements imposed by domestic regulatory authorities applicable to them, including on the solicitation of clients, opening of client accounts as well as remittance of funds. Cybersecurity 16. As LCs provide more value-added functionalities to their clients on online platforms, clients will likely build up a significant level of loyalty and reliance in using these platforms. Consequently, any information security deficiencies or system operation interruptions could be detrimental to the reputation or sustainability of the operation of LCs and may cause losses and damages to clients. 17. The review indicated that some LCs have failed to implement adequate mechanisms to mitigate cybersecurity risks, including the factors adopted for two-factor authentication, monitoring and surveillance to detect unauthorised access to clients’ internet trading accounts, channels to promptly notify clients after certain client activities, and session timeout. 18. LCs should be mindful of the relevant requirements regarding cybersecurity, in particular the Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading5 , Circular to licensed corporations on review of internet trading cybersecurity and Report on the 2019-20 thematic cybersecurity review of internet brokers6 . Resources planning and complaint handling 19. LCs are expected to have adequate resources and establish effective procedures to properly carry out their business activities7 . LCs which onboard a large number of clients in a short period of time should ensure that they have proper capacity planning both financially and operationally to cope with the anticipated increase in client activities. For example, there should be adequate resources to deal with client enquiries and 4 Including advisory services provided on a discretionary basis and automated/robo-advice. 5 Including the FAQs on Cybersecurity published by the SFC on 27 October 2017. 6 Published by the SFC in September 2020. 7 General Principle 3 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 4 of 4 complaints8 , regular reviews of system capacity and contingency plans to ensure that services provided to clients are efficient and uninterrupted. Should you have any questions regarding the contents of this circular, please contact Ms Pauline Chan on 2231 1952 or your case officers. Intermediaries Supervision Department Intermediaries Division Securities and Futures Commission Enclosure End SFO/IS/031/2022 8 Circular on handling of client complaints dated 31 March 2022.