Circular to Intermediaries: Roadmap for Implementing the Hong Kong Investor Identification Regime for the Exchange-traded Derivatives Market

2026-09-30

The Securities and Futures Commission ( SFC ) issues this circular to outline the roadmap for implementing the investor identification regime at the trading level for the exchange-traded derivatives market in Hong Kong ( HKIDR-DM ), and to provide guidance to licensed corporations ( LCs ) and registered institutions ( RIs ) subject to the HKIDR-DM regarding their main obligations under the regime.

On 22 September 2025 and 23 June 2026, the SFC issued the Consultation Paper ( Consultation Paper ) and the Consultation Conclusions Paper ( Conclusions ) on proposals to implement HKIDR-DM. Pursuant to the Conclusions, relevant LCs and RIs (“ Relevant Regulated Intermediaries ” or “ RRIs ”, as referred to in the Conclusions) will be subject to the HKIDR-DM requirements upon implementation of the regime.

RRIs’ main obligations under the HKIDR-DM

The requirements under the HKIDR-DM are similar to those currently set out in the Hong Kong investor identification regime for the securities market ( HKIDR-S ). Under the HKIDR-DM, RRIs will be required to:

(a) ensure that a unique identification code, namely the “Broker-to-Client Assigned Number” ( BCAN ), is assigned to each Relevant Client [1] who has placed or intends to place orders for futures contracts, options contracts and stock options (together, Futures and Options Contracts ) on the Hong Kong Futures Exchange Limited ( HKFE ) trading system ( HKFE Trading System ) through the Relevant Client’s trading accounts with the RRIs;

(b) ensure that up-to-date client identification data ( CID ) is collected from each Relevant Client and submitted, along with the client’s BCAN (by including both the BCAN and CID in a “ BCAN-CID Mapping File ”), to a central data repository to be maintained by Hong Kong Exchanges and Clearing Limited ( HKEX )[2] within the prescribed timeframe;

(c) ensure that the Relevant Client’s BCAN is included in the order information for each order transmitted to the HKFE Trading System; and

(d) implement robust data privacy and security measures to safeguard the collection, transmission and storage of data, including obtaining express consent from individual Relevant Clients for the collection and handling of their personal data in compliance with the applicable data privacy laws.

For details of the RRIs’ obligations under the HKIDR-DM, please refer to the Conclusions and the to-be-gazetted new paragraph 5.6A of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission ( Code of Conduct ) in the Annex to this circular.

Implementation roadmap and indicative timeline of the HKIDR-DM

Subject to market readiness and the successful completion of the required system testing and market rehearsals, the HKIDR-DM is currently scheduled for implementation in the second quarter of 2028. Before the regime commences, RRIs are expected to complete a number of tasks as part of their preparation for the implementation:

Tasks to be completed

Timeline

Obtaining appropriate client consent

Q3 2026 – Q4 2027

Updating individual and corporate clients’ CID

Q3 2026 – Q4 2027

Enhancing the order management system in tandem with preparation for the rollout of HKEX’s Orion Derivatives Platform ( ODP )

Q3 2026 – Q3 2027

Assigning BCANs to Relevant Clients

Q3 – Q4 2027

Preparation of BCAN-CID Mapping Files

Q3 – Q4 2027

Participating in end-to-end testing and market rehearsals for the HKIDR-DM

Q3 – Q4 2027

Submission of BCAN-CID Mapping Files to HKEX’s data repository

Q4 2027 – Q1 2028

Launch of the HKIDR-DM

Q2 2028

Obtaining appropriate client consent

RRIs subject to the HKIDR-DM should obtain written or other express consent from Relevant Clients who are individuals (ie, natural persons) for the collection and transfer of their personal data to HKEX and the SFC. For corporate clients, such personal data privacy is not applicable and therefore consent is not required. The consent should include the purposes of use specified in the circular on obtaining client consent under the HKIDR-DM ( Consent Circular ) published by the SFC on 30 September 2026.

Alternatively, RRIs would not have to obtain new consent from individual clients if both the following criteria are met:

(a) express client consent on the use of personal data has already been obtained from these clients; and (b) the consent expressly [3] includes all the purposes of use [4] specified by the SFC in the Consent Circular.

In general, consent may be obtained by written and signed acknowledgement on paper, by email, by other electronic means (for example, instant messaging applications) or by phone, provided that the measures set out in the Consent Circular are observed. For details of the acceptable methods for obtaining consent and the related requirements, including client identity authentication, record keeping and retention requirements, RRIs should refer to the Consent Circular.

Updating individual and corporate clients’ CID

RRIs should ensure that the following information has been collected as CID from the Relevant Clients:

(a) For an individual client: - full name as shown on his or her identity document - identity document’s issuing country or jurisdiction; - identity document type [5] (order of priority: (1) HKID card; (2) national identification document [6] ; (3) passport [7] ); and - identity document number on the identity document.

(b) For a corporate client: - full name as shown on its identity document; - identity document’s issuing country or jurisdiction; - identity document type (order of priority: (1) LEI [8] registration document; (2) certificate of incorporation [9] ; (3) business registration certificate [10] ; (4) other equivalent documents); and - identity document number on its identity document.

(c) For a client that is a trust: - the CID of the trustee, which should be the same as that of a corporate or individual client as set out above; - in the case of a trust which is an investment fund (ie, collective investment schemes), the CID of the asset management company or the individual fund, as appropriate, which has opened a trading account with the RRI.

(d) For clients of a joint account: - the CID for all clients (in line with the above proposed requirements, depending on the nature of the client) named for a joint account should be provided under the same BCAN assigned to that account.

RRIs should notify their existing derivatives trading account holders, irrespective of nationality, of the identity document waterfall and request the required identity document (if not already obtained) or updated identity document information, as appropriate, before the HKIDR-DM is implemented.

Enhancing order management systems

Upon the implementation of the HKIDR-DM, RRIs will be required to tag a BCAN to trade orders submitted to the HKFE Trading System, and submit BCAN-CID Mapping Files and other prescribed reporting files in accordance with the HKIDR-DM requirements. For the operational and technical requirements, RRIs should refer to the information paper ( HKEX Information Paper ) and related file interface specifications published by HKEX.

From now until the third quarter of 2027, RRIs should undertake the necessary system enhancements to enable the tagging of BCANs to trade orders and the submission of BCAN-CID Mapping Files via HKEX’s Electronic Communication Platform ( ECP [11] ) in accordance with the HKIDR-DM requirements.

Assigning BCANs to clients

Each RRI is responsible for assigning a unique set of BCANs to its Relevant Clients (including to RRIs conducting Type 1 and/or Type 2 regulated activities themselves in the case of proprietary trades). RRIs do not have to check with one another to determine if a single BCAN has been applied to a client.

Similar to the HKIDR-S, a BCAN consists of the RRI's six-character Central Entity Number (CE Number) assigned by the SFC, followed by a separator dot (".") and a unique numeric identifier of not more than 10 digits should be assigned to a specific Relevant Client. The CE Number prefix should be in capital letter and serves to distinguish BCANs assigned by different RRIs.

RRIs may adopt for the HKIDR-DM the same BCAN assigned to a Relevant Client under the HKIDR-S or the investor identification regime for northbound trading under Mainland-Hong Kong Stock Connect. Where an RRI assigns a BCAN to a Relevant Client under the HKIDR-DM that is different from the BCAN assigned to the same client under the HKIDR-S, it should ensure that the BCAN is unique and does not duplicate any BCANs assigned to another client under either regime. A BCAN may also incorporate an RRI’s internal client identifier or account number, provided that it complies with the requirements set out in the HKEX Information Paper.

For further details of the generation, assignment, format, and tagging of BCANs, RRIs should refer to paragraphs 22 to 32 of the Consultation Paper, the Code of Conduct in the Annex

to this circular, and the HKEX Information Paper.

Preparation and submission of BCAN-CID Mapping File

The BCAN-CID Mapping File contains the BCAN and CID of all Relevant Clients [12] of an RRI in the format prescribed by HKEX. Prior to the implementation of the HKIDR-DM, RRIs should prepare and submit the BCAN-CID Mapping File to HKEX’s central data repository by the prescribed deadline. The RRI assigning the BCAN to the Relevant Client is also responsible for collecting the corresponding CID and preparing the BCAN-CID Mapping File.

Where there is an update to the BCAN-CID Mapping File, be it due to on-boarding of new clients, the closure of a client account or a change in CID information for existing clients, a complete file with the CID of all Relevant Clients should be uploaded to HKEX’s central data repository on the day an update has been made (even where the update is in relation to only one or some of the Relevant Clients). If there has been no update to the CID, the RRI does not have to resubmit the BCAN-CID Mapping File after the initial submission.

After the BCAN-CID Mapping File is completed, the RRI (whether an exchange participant (EP) or a non-EP RRI) should submit it to HKEX’s central data repository in the following manner:

(a) via HKEX’s designated web portal, the ECP; or (b) via another LC or RI through the SFC’s WINGS platform, in which case it should encrypt such data in accordance with HKEX’s requirements as set out in the HKEX Information Paper.

RRIs should take all reasonable steps to ensure that the individual client information (including the data constituting the CID) they collect and submit to HKEX’s central data repository is accurate and kept up-to-date, and to also promptly update HKEX on any changes via the BCAN-CID Mapping File submission. RRIs should also put in place measures to require clients to notify them of any updates to the CIDs. These may include obtaining representations and warranties from their clients as appropriate to assist their verification and maintenance of CID. RRIs may take the chance to review client information to ensure it is up-to-date while observing the requirement to conduct regular reviews of documents, data and information relating to their clients under the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism.

Participating in system testing and market rehearsals

RRIs are expected to participate in the end-to-end testing and market rehearsals for BCAN-CID Mapping File submissions via ECP and BCAN tagging of trade orders prior to the implementation of the HKIDR-DM. The SFC and HKEX will arrange the testing and market rehearsals, and further details will be announced in due course.

Subject to market readiness, the HKIDR-DM is currently scheduled for implementation in the second quarter of 2028.

Further training and communication

To facilitate implementation of the HKIDR-DM, the SFC will collaborate with HKEX to promote investors’ understanding of the consent requirements under the regime and organise training sessions from the fourth quarter of 2026 to assist market participants in preparing for implementation. Market participants are encouraged to participate in these sessions.

The tasks and requirements set out in this Circular are not meant to be exhaustive. RRIs should refer to relevant HKIDR-DM requirements and guidance published by the SFC and HKEX on the SFC webpage and HKEX HKIDR-DM Web Corner .

The SFC will publish frequently asked questions about the HKIDR-DM from time to time. Please address questions about the HKIDR-DM to HKIDR-DM-FAQ@sfc.hk .

For enquiries relating to the following matters, please contact HKEX by email to HKIDR-DM@hkex.com.hk :

• ECP system access, file submission, operation and technical support; - submission of BCAN-CID Mapping Files and other reporting templates; and - testing, market rehearsals arrangement and training arrangements.

Supervision of Markets Division Securities and Futures Commission

[1] For details and examples of the meaning of “Relevant Client”, please refer to the Conclusions.

[2] In this circular, references to HKEX mean HKFE or The Stock Exchange of Hong Kong Limited ( SEHK ), as the context requires.

[3] The requirement to obtain consent will not be complied with where the specified purposes of uses may only be implied or inferred from the client documentation.

[4] The client consent needs not reproduce the purposes of use as specified in the Consent Circular in a verbatim manner, provided that all the purposes are clearly covered.

[5] Certain travel documents, including the Exit-entry Permit for Travelling to and from Hong Kong and Macao, the Permit for Proceeding to Hong Kong and Macao and the HKSAR Document of Identity for Visa Purposes, should not be used as CID where a HKID Card or national identity document is available. Likewise, a passport should only be used where no higher-priority identity document is available. For further guidance, please refer to FAQ C.1 .

[6] In the case of a client with multiple national identities, the client will have the discretion to select any one of his or her available national identity documents for the purpose of the collection of CID. However, the client must consistently use the same national identification document for the purpose of opening trading accounts with any RRIs to ensure uniformity and traceability.

[7] In the case of a client with multiple passports, the client will have the discretion to select any one of his or her available passports for the purpose of the collection of CID. However, the client must consistently use the same valid passport for the purpose of opening trading accounts with any RRIs to ensure uniformity and traceability.

[8] LEI refers to the Legal Entity Identifier which is a 20-character alpha-numeric code under the Global LEI System adopted by the Financial Stability Board to uniquely identify distinct legal entities which participate in financial transactions.

[9] As the Hong Kong Companies Registry implemented the Unique Business Identifier (UBI) on 27 December 2023, the UBI will be adopted as the identity document number on the relevant entity’s certificate of incorporation and business registration certificate.

[10] In the case of Hong Kong incorporated companies, it is noted that a company with branches may have different business registration numbers. However, according to the website of the HKSAR Government’s Inland Revenue Department, a company’s business registration number consists of eight digits and, in the case of a branch, this is followed by a three-digit branch number (e.g., 12345678-001). Accordingly, the company to which the branch is attached can be uniquely identified using only the first eight digits of the business registration number.

[11] ECP provides a paperless channel for stakeholders of HKEX and its subsidiaries to submit and download files, returns or any such other documents.

[12] For submission of BCAN-CID Mapping File for newly on-boarded clients and dormant clients, RRIs should refer to paragraphs 39-41 of the Consultation Paper.