Expected controls for account opening and maintaining relationships with clients with investment accounts

Circular 54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 1 of 3 22 May 2026 Circular to licensed corporations Expected controls for account opening and maintaining relationships with clients The Securities and Futures Commission (SFC) recently reviewed the account opening practices of 12 licensed securities brokers (Review) and have identified, among other things, significant deficiencies in due diligence on account opening documentation, and due diligence and ongoing monitoring of cross-border correspondent relationships (CBCR) with overseas intermediaries. Notably, the Review found that some brokers accepted questionable or forged documents from their clients during the account opening process and failed to identify red flags and irregularities during due diligence and ongoing monitoring of the CBCR with overseas intermediaries. This raises serious concerns about clients’ intentions, including the potential misuse of accounts for suspicious or illicit transactions, and exposed the licensed corporations (LCs) to heightened money laundering and terrorist financing risks. In fact, some of these accounts were later involved in suspicious fund transfers without trading activity. Therefore, LCs must be vigilant against red flags such as accounts used solely as depositories of funds which remain inactive after all funds were withdrawn, frequent changes in bank account, shared bank accounts or addresses among unrelated clients1 , and profiles of clients of overseas intermediaries that are not aligned with the intermediaries’ jurisdiction or typical client base. The SFC issues this circular to remind LCs about the deficiencies identified in the Review and the standards expected of them, as well as additional measures for opening and managing clients’ investment accounts. The deficiencies identified in the Review and the standards expected of LCs are set out in Appendix A to this circular. Among others, LCs should conduct an internal review as soon as practicable to detect if any questionable or forged documents have been accepted for account opening, in accordance with item 1 of Appendix A to this circular and close the accounts that have been involved in the use of questionable or forged documents. The SFC is deeply concerned about certain brokers’ inadequate due diligence in account opening and has zero tolerance for the use of questionable or forged documents in client onboarding or in maintaining ongoing client relationships by LCs. The SFC will take supervisory actions against non-compliant brokers, including requiring internal control and look-back reviews by external consultants, imposing licensing conditions2 to restrict their business activities, and taking enforcement actions as appropriate. 1 Please refer to the SFC’s circular “Detection and prevention of potential layering activities in money laundering” and press release “SFC urges licensed firms to detect and prevent potential layering activities in money laundering”, both issued on 17 November 2025. 2 Pursuant to section 116(6) of the Securities and Futures Ordinance (SFO), a licence granted under section 116(1) of the SFO shall be subject to such reasonable conditions as the SFC may impose, and the SFC may at any time, by notice in writing served on the LC concerned, amend or revoke such condition or impose new conditions as may be reasonable in the circumstances. Attachment

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 2 of 3 Additional measures for opening and managing investment accounts of Chinese Mainland Investors As most questionable or forged documents identified in the Review involved accounts belonging to Chinese Mainland investors and, having considered the associated business, regulatory, and reputational risks that an LC may face, Appendix B to this circular sets out the additional measures required for LCs when opening and managing such accounts. These include conducting reviews upon the SFC’s request, closure of investment accounts that were opened with the use of questionable or forged documents, closure of zero-balance dormant investment accounts to mitigate potential risk of these accounts being exploited by illicit actors to conduct illegal activities, as well as additional measures required of all LCs when opening new investment accounts for Chinese Mainland investors, such as investor declarations. A set of frequently asked questions is also enclosed in Appendix C to assist LCs’ implementation of the controls and measures in this circular. Providing services to investors outside Hong Kong When providing services to investors outside Hong Kong, either directly by LCs, or through affiliates, third-party service providers or intermediaries outside Hong Kong, LCs must comply with all relevant legal and regulatory requirements in both Hong Kong and the applicable jurisdictions. LCs should not engage in or facilitate any illegal activities when providing services to investors outside Hong Kong. In particular, LCs should take note of the notice3 jointly issued by the CSRC and other Chinese Mainland authorities on 22 May 2026, which specifies the remediation plans for certain illegal cross-boundary securities, futures, and investment fund-related activities conducted on the Chinese Mainland. LCs are reminded that any breaches of applicable regulatory requirements in jurisdictions outside Hong Kong may constitute non-compliance with paragraph 12.1 of the Code of Conduct4 , which may result in supervisory or enforcement actions taken by the SFC. Material breaches must be reported to the SFC immediately5 . Senior management responsibilities Senior management are ultimately responsible for ensuring appropriate standards of conduct and robust internal control systems for account opening and maintaining relationships with clients, preventing the acceptance of questionable or forged documents, and maintaining full compliance with applicable regulatory requirements6 . Senior management should promptly address the issues raised in this circular, strengthen LCs’ controls, and ensure all staff members receive proper training to perform their duties effectively7 . Failure to fulfil these responsibilities may call into question the fitness and properness of an LC and its senior management, and may result in supervisory or enforcement action taken by the SFC. 3 Please refer to the webpage of the China Securities Regulatory Commission (CSRC) (Chinese only). 4 Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct). 5 Paragraph 12.5(a) of the Code of Conduct. 6 General Principle 9 of the Code of Conduct. 7 Paragraph III.3 of the Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the SFC.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 3 of 3 The SFC will continue to monitor LCs’ compliance through off-site monitoring, on-site inspections and thematic reviews. We will also collaborate with regulatory authorities in other jurisdictions to address misconduct in the industry in accordance with the memoranda of understanding signed with them. Should you have any questions regarding this circular, please contact your case officers in the Intermediaries Division. Intermediaries Division Securities and Futures Commission Enclosure End SFO/IS/018/2026

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 1 of 6 Appendix A Key findings from the Review and the standards expected of LCs

1. Inadequate due diligence on account opening documentation The Review found that some brokers approved client account opening applications without conducting adequate due diligence on the documents collected. These brokers lacked effective controls to detect irregularities in these documents, such as: • multiple clients submitting statements of securities accounts from other brokers that contained identical information (eg, trade details), with only the names, addresses, or account numbers altered; and • irregularities in the statements or confirmations from other brokers and banks, and utility bills, such as variations in font styles, font sizes and formats (eg, text alignment, character sets), conflicting information within the same document, invalid or impossible dates, discrepancies in asset movements (eg, opening balance and recorded transactions that do not reconcile with the closing balance), and missing or invalid QR codes. Despite these issues, these brokers accepted questionable or forged documents and approved the account opening applications that should have been rejected. In the most serious cases, over 50% of the client accounts sampled by the SFC were found to have used forged documents during the account opening process. Expected standards LCs must maintain adequate resources, act with due care and diligence1 and implement effective procedures2 which are needed for the proper performance of business activities: • Thorough due diligence and robust controls are essential for verifying client identity and detecting irregularities in the client documents submitted during the account opening process before approving the opening of any new accounts; • Account openings should be approved only after completing all know-your-client and customer due diligence procedures, and a comprehensive review by management; • LCs shall adopt necessary procedures to guard against falsification of records required to be kept under the Keeping of Records Rules, and facilitate the detection of any such falsification3 ; 1 General Principle 2 of the Code of Conduct. 2 General Principle 3 of the Code of Conduct. 3 Sections 3(1) and 9(2) of the Securities and Futures (Keeping of Records) Rules (Keeping of Records Rules).

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 2 of 6 • If LCs cannot satisfactorily complete know-your-client and customer due diligence procedures, or have doubts about the authenticity of documents submitted, and as a result, their risk assessment indicates that such a client poses a high risk, they should refrain from establishing a business relationship with the client, or terminate any existing business relationships as soon as practicable; • LCs should warn prospective clients of the serious consequences of submitting forged documents, which include account termination, filing a report with law enforcement agencies, and possible criminal prosecution; and • LCs should conduct an internal review as soon as practicable to detect if any questionable or forged documents have been accepted for account opening. Where LCs identify those client accounts involved in the use of forged documents (including identification documents), the LCs should terminate the business relationship with the clients concerned and make reference to Measure 1 (ii) to (vii) of Appendix B for the steps to close these client accounts and other measures to be taken. 2. Deficiencies in due diligence and ongoing monitoring of CBCR with overseas intermediaries The provision of securities dealing (including initial public offering (IPO) subscription), futures contracts dealing or leveraged foreign exchange trading services to investors through overseas intermediaries, whether affiliated or not, constitutes CBCR. Some brokers failed to identify red flags and irregularities during due diligence and ongoing monitoring of the CBCR with overseas intermediaries. For instance: • a broker solely relied on a questionnaire and confirmation provided by an overseas intermediary for assessing the intermediary’s know-your-client and anti-money￾laundering and counter-financing of terrorism (AML/CFT) controls, despite discrepancies between the questionnaire responses and the actual circumstances of the intermediary. The overseas intermediary indicated in the questionnaire that it mainly served local investors, but it was subsequently found that all of its underlying clients subscribing to Hong Kong IPOs through the broker had a nationality of and resided in another country; and • an overseas intermediary with which a broker maintained a CBCR falsely declared in an AML/CFT questionnaire that it was registered with the local regulator when, in fact, it was not. As a result, the broker was not eligible to apply simplified customer due diligence to the overseas intermediary4 .

4 Paragraph 4.8.3 of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) (AML/CFT Guideline).

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 3 of 6 Expected standards LCs must take additional due diligence measures to mitigate the associated risks arising from the lack of complete information about the overseas intermediaries’ underlying clients and their transactions5 . Given that not all CBCR pose the same level of money laundering/terrorist financing (ML/TF) risks, LCs should adopt a risk-based approach in applying the additional due diligence measures6 . These include: • Understanding the nature, reputation, licensing or registration status and regulatory oversight of the intermediaries, the types of their underlying clients and the expected nature, volume and value of transactions; • Exercising heightened vigilance against red flags during both due diligence and ongoing monitoring. Particular attention is needed if underlying clients’ profiles— such as nationality, residence, or business operations—do not align with the jurisdiction in which the overseas intermediary operates or its typical client base; • Taking additional measures to mitigate any potential ML/TF risks, such as requesting information about underlying transactions or clients, imposing limits on or restricting certain transactions; • Determining from publicly available information (eg, public registers of licensed or registered entities, public databases of regulatory and enforcement actions, news) the reputation of the overseas intermediary and the quality of its regulatory supervision (eg, whether the overseas intermediary is licensed or registered in the jurisdiction that it operates and is subject to effective AML/CFT supervision by relevant regulatory authorities, whether and when the overseas intermediary has been subject to any targeted financial sanctions, ML/TF investigations or regulatory actions); and • Ensuring that overseas intermediaries have adequate and effective AML/CFT controls. For higher-risk relationships, LCs should conduct an in-depth review (eg, on-site visits, review findings reported by internal or external auditors) and not rely solely on the intermediary’s confirmation. If LCs cannot complete a satisfactory review, they should refrain from establishing business relationships with the overseas intermediary. All CBCRs must be subject to ongoing monitoring7 . LCs should ensure their ongoing monitoring identifies and addresses issues, including the aforementioned red flags and weak AML/CFT controls, and take prompt and appropriate actions to comply with all requirements. Where ML/TF risks associated with any overseas intermediaries under a CBCR cannot be adequately mitigated, LCs should avoid establishing or terminate relationships with the overseas intermediary. 5 Paragraph 4.20 of the AML/CFT Guideline. 6 Paragraphs 4.20.5 to 4.20.11 of the AML/CFT Guideline. 7 Paragraph 4.20.13 of the AML/CFT Guideline.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 4 of 6 3. Deficiencies in client identity verification process Some brokers did not perform adequate client identity verification when using the following account opening approaches: (a) Designated Hong Kong bank account approach Clients are required to transfer an initial deposit of no less than HK$10,000 from a bank account in their own names at a licensed bank in Hong Kong. All future deposits and withdrawals must be made through this account. It is necessary to ensure that the initial transfer and all subsequent deposits and withdrawals are duly conducted through the bank account, whose ownership has been duly verified by the bank. In one case, a broker failed to collect sufficient information for the bank transfer such as the sender’s name and the bank account number to confirm the ownership of the bank account, resulting in incomplete identity verification. (b) Remote onboarding of overseas clients approach When onboarding overseas individual clients remotely, LCs are required to use technologies pre-assessed by independent qualified assessors to authenticate identification documents and verify client identities. Additionally, clients should make initial and subsequent deposits and withdrawals through designated overseas bank accounts with banks supervised by the regulators in eligible jurisdictions. In one case, a broker relied only on initial deposits from overseas bank accounts and did not use technologies to authenticate clients’ identification documents or verify their identities as required. Expected standards Proper client identity verification is crucial for establishing legitimate client relationships and preventing fraudulent activities. LCs must take all reasonable steps to establish the true and full identity of each client8 and comply with the requirements for acceptable account opening approaches published on the SFC’s designated webpage9 . In particular: • For online onboarding through an initial deposit from a Hong Kong bank account10, LCs should obtain sufficient evidence to confirm11 that the fund transfer was made from the client's own bank account; and • For remote onboarding of overseas clients12, LCs should ensure that an independent qualified assessor has confirmed the appropriateness and 8 Paragraph 5.1 of the Code of Conduct. 9 Please refer to the SFC’s designated webpage for acceptable account opening approaches and the requirements specified therein. 10 This refers to the acceptable account opening approach #4 on the SFC’s designated webpage. 11 Please refer to the circular “Detection and prevention of potential layering activities in money laundering” issued by the SFC on 17 November 2025 for reasonable measures to ascertain the ownership of the bank accounts. 12 This refers to the acceptable account opening approach #5 on the SFC’s designated webpage.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 5 of 6 effectiveness of adopted processes and technologies for establishing the true identities of clients before implementation of the processes and technologies. These technologies must be capable of authenticating client identification documents, verifying identities, and safeguarding against security or fraud risks such as identity theft. 4. Inadequate controls in collecting client identification data (CID) Some brokers failed to implement adequate controls to comply with the “waterfall” requirements13 for collecting CID of individuals from identification documents, which prioritise Hong Kong identity cards (HKID) over national identification documents, followed by passports. • Some brokers did not take reasonable steps to confirm that clients did not possess identification documents of a higher priority before accepting the documents provided; and • Some brokers allowed clients to open accounts using passports, even though the clients were citizens of jurisdictions that issue national identification documents, which have a higher priority according to the waterfall requirements. Expected standards When collecting CID for compliance with paragraph 5.6 of the Code of Conduct and the investor identification requirements under FINI14, LCs must implement proper controls to ensure full compliance with the waterfall requirements, including obtaining representations and warranties from clients to confirm that no identification documents of a higher priority in the waterfall15 are in their possession. For natural persons, the prescribed priority is: (i) HKID, (ii) national identification document, and (iii) passport. 5. Deficiencies in review of client address The Review found that the brokers generally failed to implement controls to assess the reasonableness of residential addresses provided by individual clients, and to identify anomalies, such as addresses of commercial or government buildings rather than residential locations, or multiple clients sharing the same address. In the most serious 13 Paragraph 5.6(o) of the Code of Conduct. 14 FAQs E7 to E9 in the Fast Interface for New Issuance (FINI): Information Pack published by HKEX. 15 Question 4 of the FAQs on collection of client identification data and the circular “IPO subscription and financing services” issued by the SFC on 20 March 2025.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 6 of 6 case, one broker onboarded about 190 clients who all provided the same address located in a commercial building, and failed to take any follow-up action. Expected standards LCs should obtain residential address information from individual clients16 and may require proof of residential address17 from the clients in order to be satisfied on reasonable grounds as to the address of clients ultimately responsible for originating instructions for transactions18. LCs are expected to review client addresses for anomalies, such as the use of the same address by multiple apparently unrelated clients, inconsistencies in addresses with the clients’ expected residential locations, and addresses that are not valid or searchable on public domains. LCs should follow up on any anomalies identified19. 16 Paragraph 4.2.4 of the AML/CFT Guideline. 17 Footnote 18 of the AML/CFT Guideline. 18 Paragraph 5.4(a) of the Code of Conduct. 19 Paragraph 1(h) of Appendix 2 to the circular “Protecting Client Assets Against Internal Misconduct” issued by the SFC on 5 February 2016 and paragraph 1(f) of Appendix B to the AML/CFT Guideline.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 1 of 4 Appendix B Additional measures for opening and managing investment accounts of Chinese Mainland investors For the purpose of this circular, a “Chinese Mainland investor” refers to an individual investor who uses either or both a resident identity card and a passport issued by the People’s Republic of China as an identification document according to an LC’s records or when opening an investment account. All LCs should implement Measure 3 below starting from the date of this circular when opening new investment accounts for Chinese Mainland investors. All LCs should also ensure that Chinese Mainland investors’ legitimate interests are protected, client assets are properly safeguarded, and applicable requirements are complied with, including but not limited to the Client Money Rules1 and the Client Securities Rules2 , the Code of Conduct and the AML/CFT Guideline, as well as relevant guidance issued by the SFC. For the avoidance of doubt, investment accounts opened under schemes or arrangements jointly developed by regulators in Hong Kong and the Chinese Mainland, such as the Southbound Scheme clients under the Cross-boundary Wealth Management Connect in the Guangdong-Hong Kong-Macao Greater Bay Area shall continue to follow the existing requirements and guidance and do not need to follow the measures stated in this Appendix.[ Measure 1: Closure of investment accounts that were opened using questionable or forged documents (i) Conduct a review of account opening activities (Account Opening Review) upon the SFC’s request3 : (a) Identify client investment accounts opened since January 2023, or any other timeframe specified by the SFC, that have used questionable or forged documents, including documents submitted as proof of having investment accounts maintained with other LCs (such as statements of account issued by those LCs) and proof of identity4 ; (b) For each of those accounts opened using questionable or forged documents, identify the party(ies) responsible for providing the questionable or forged documents and the person(s) responsible for the control failings; and (c) The Account Opening Review shall be conducted by an independent external consultant and in accordance with the scope and methodology prescribed by the 1 Securities and Futures (Client Money) Rules. 2 Securities and Futures (Client Securities) Rules. 3 The SFC will adopt a risk-based approach and request selected LCs to implement Measure 1. The selected LCs will be notified by the SFC separately. 4 For proof of identity, client identity verification through the use of certification services provided by certification authorities whose electronic certificates have obtained mutual recognition status accepted by the HKSAR Government is considered low risk. LCs may exclude from their reviews the documentation generated by such certification authorities for proof of a client’s identity if the clients were onboarded using this account opening approach.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 2 of 4 SFC. It should be completed within three months from the date of the SFC’s request. LCs which are unable to complete the review within this timeframe must notify the SFC5 immediately upon becoming aware of the situation, and in any case no later than one month after the SFC’s request, unless there is reasonable justification. LCs may refer to Finding 1 in Appendix A to this circular for examples of irregularities in documents. (ii) Give advance written notice to the clients of the accounts identified in (i) above for the suspension of any new client-initiated transactions (except for transactions required to close the existing positions or reduce the account balances for settlement of obligations or liabilities) and the intended closure of the accounts. LCs should allow reasonable time for clients to manage the assets in their accounts, such as unwinding their positions and transferring funds to their bank accounts (particularly from which the funds were first transferred to their accounts, to the extent possible). Once all client assets have been withdrawn or disposed of, LCs should close the accounts as soon as practicable. (iii) LCs are expected to close the identified accounts in (i) above within six months from the date of the completion of the Account Opening Review, unless under exceptional circumstances (eg, investment accounts subject to court orders). LCs should maintain proper records of the justifications for not closing the accounts in time. (iv) Act in accordance with client agreements and ensure that all client assets, if any, are properly safeguarded and that client interests remain adequately protected until the accounts are formally closed. (v) Allocate sufficient resources to handle any client enquiries and complaints. (vi) Review the transactions in the identified accounts for any red flags of suspicious activities and make appropriate reports to law enforcement agencies (eg, report on the use of questionable or forged document, suspicious transaction reports) where necessary. (vii) Prohibit the clients of the accounts concerned identified in (i) above from opening any investment accounts with the LC or any of its affiliated firms in the future.

Measure 2: Closure of zero-balance dormant investment accounts A “zero-balance dormant investment account” refers to an investment account held by a Chinese Mainland investor that has no asset balance as of 22 May 2026 or any other date specified by the SFC (reference date) and did not have client-initiated activity in the 12 months preceding the reference date. 5 LCs may discuss with their case officers for any reasonable justification (eg, more time is required by the external consultant engaged by LCs for identifying such accounts).

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 3 of 4 Upon the SFC’s request, LCs should implement the following measures to reduce unnecessary risks (eg, accounts being exploited by illicit actors6 ) associated with the zero￾balance dormant investment accounts7 . (i) Conduct a review to identify all zero-balance dormant investment accounts (Dormant Account Review) within three months from the date of the SFC’s request. (ii) Give advance notice to clients of the identified accounts and suspend the accounts from any new transactions unless and until the LC is able to satisfactorily complete the following reactivation procedures: (a) Contact the identified clients and confirm with them the know-your-client and customer due diligence information are up-to-date and relevant8 ; and (b) Perform the measures in (i) and (ii) of Measure 3 below in relation to clients’ declarations and bank accounts respectively. LCs should maintain proper records for the procedures conducted for each client’s account in a manner that is readily accessible for compliance checks and audit purposes. (iii) Close the identified accounts within six months from the date of the SFC’s request if the LC could not satisfactorily complete the steps in (ii) above unless under exceptional circumstances (such as extenuating circumstances of the clients). LCs should maintain proper records of the justifications for not closing the accounts in time. (iv) Act in accordance with client agreements and provide support to the clients as appropriate with a view to ensuring that client interests remain adequately protected until the accounts are formally closed. (v) Allocate sufficient resources to handle any client enquiries and complaints. If the client accounts identified in the Dormant Account Review involved the use of questionable or forged documents, LCs should terminate the business relationship with these clients by following steps (ii) to (vii) of Measure 1 above for the closure of accounts, instead of following steps (ii) to (v) of this Measure 2. LCs shall provide reports of the Account Opening Review and the Dormant Account Review to the SFC upon request. For LCs found to be conducting the reviews or handling the account closures and client enquiries and complaints unsatisfactorily, the SFC will consider appropriate risk mitigation measures and supervisory action to restrict the LC’s regulated activities, including but not limited to solicitation and account opening activities. 6 In particular, as set out in paragraph 7 of the SFC’s circular on “Detection and prevention of potential layering activities in money laundering”, most of the accounts exhibiting patterns of layering activities typically remain inactive after all funds have been withdrawn. In addition, some of these accounts were found to be held by Chinese Mainland clients who provided forged documents to brokers during account opening. 7 The SFC will adopt a risk-based approach and request selected LCs to implement Measure 2. The selected LCs will be notified by the SFC separately. 8 Paragraph 5.2 of the AML/CFT Guideline.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 4 of 4 Measure 3: Opening new investment accounts Where Chinese Mainland investors approach LCs for opening investment accounts, LCs should implement the following measures, irrespective of the account opening approaches used by LCs for onboarding them. These measures are in addition to LCs’ ongoing legal and regulatory obligations, including those relating to account opening, AML/CFT (e.g. transaction monitoring) and record keeping. (i) Obtain a written declaration from the Chinese Mainland investor: (a) Confirming that all funds which support the investment activities and related settlements are from lawful sources outside of the Chinese Mainland; (b) Confirming that the investor does not have an account that was previously closed or suspended by any LCs or banks due to the use of questionable or forged documents; (c) Undertaking that the investor will notify the LC within 7 business days in the event of any changes in the information in the investor’s written declaration; and (d) Confirming that the investor understands that upon requests from law enforcement agencies or regulatory authorities, the LC may disclose the investor’s personal and other relevant information. (ii) Require the investor to use bank accounts held in the investor’s own name with banks licensed in Hong Kong or supervised by banking regulators in eligible jurisdictions9 for settlement purposes, and ensure that all future deposits and withdrawals for the investment account are conducted exclusively through these bank accounts. (iii) Close the client investment account if the client’s funding sources are subsequently found to be unlawful or in violation of any capital control regulations of the Chinese Mainland. LCs should refer to steps (ii)-(vii) under Measure 1 above for the closure of these accounts. (iv) Maintain proper records for each client’s account opening process in a manner that is readily accessible for compliance checks and audit purposes. (v) Provide information to the SFC upon request, including but not limited to, the number and details of the new investment accounts opened during a specified period and the clients’ written declarations as per (i) above. 9 The list of eligible jurisdictions published on the SFC’s webpage under “Acceptable account opening approaches” is adopted for this purpose.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 1 of 3 Appendix C Frequently asked questions for the circular on expected controls for account opening and maintaining relationships with clients (I) Closure of investment accounts that were opened using questionable or forged documents (Measure 1 in Appendix B)

1. If an LC decides to terminate its business relationship with a client after discovering the use of questionable or forged documents but the client is uncontactable, what measures should it take? The LC should suspend the relevant account from processing and executing any new client￾initiated transactions (except for transactions required to close the existing positions or reduce the account balances for settlement of obligations or liabilities) and terminate the business relationship with the client in accordance with the terms of the client agreement. The LC should continue its attempts to contact the client and ensure that the client assets are properly safeguarded to protect the client’s interests until the account is formally closed.
2. If an LC fails to close the relevant accounts within the specified timeframe, how will the SFC handle the matter? The LC should notify the SFC explaining the reasons why the relevant accounts remain open. The SFC will consider the justifications provided by the LC and handle the matter on a case-by￾case basis taking into account the relevant circumstances of the LC. (II) Closure of zero-balance dormant investment accounts (Measure 2 in Appendix B)
3. If a Chinese Mainland investor maintains more than one investment account with the same LC, and one or some (but not all) of the accounts are zero‑balance dormant investment accounts, is the LC required to suspend and/or close only those zero‑balance dormant investment accounts while the other accounts can be maintained? LCs may adopt a relationship‑based approach. Where a client maintains at least one non‑zero‑balance or non‑dormant investment account with the LC, the LC is not required to close any zero‑balance dormant investment accounts maintained by that client in the client’s own name.
4. For accounts identified as zero‑balance dormant investment accounts, where transactional activities occur after the reference date but before suspension takes place, and thus make such accounts no longer dormant, are LCs still required to suspend and close those accounts under the steps in (ii) and (iii) of Measure 2? For investment accounts identified as zero‑balance dormant investment accounts as of the reference date but subsequently record transactional activities after the reference date and before suspension takes place (eg. due to the time required for LCs to make preparations, notify the relevant clients and execute suspension actions), LCs are expected to cease accepting further fund deposits, acquisitions of investment products or opening new investment positions until and unless the client has completed the reactivation procedures stated under step (ii) of Measure 2.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 2 of 3 In other words, LCs should follow the reactivation procedures to confirm with the clients their information is up-to-date and relevant, obtain the clients’ written declarations and ensure the clients would use bank accounts held in their own name with banks licensed in Hong Kong or supervised by banking regulators in eligible jurisdictions for settlement and fund deposit and withdrawal purposes, within two weeks from the date when the zero‑balance dormant investment accounts are identified. (III) Opening new investment accounts (Measure 3 in Appendix B) 5. Are LCs required to obtain the declaration from Chinese Mainland investors in paper form for opening new investment accounts? The declaration should be obtained in writing. Such written declaration may be obtained in paper form or via electronic means (e.g. through a website, mobile application, email or other appropriate channels). (IV) Due diligence on account opening documentation in Appendix A 6. Are there any specific requirements for personnel conducting internal reviews to detect any questionable or forged documents accepted during account opening? The personnel should possess the relevant knowledge and skills to conduct the internal reviews and be independent of the LC’s account opening process. Depending on the circumstances, the personnel may be the LC’s compliance staff, internal audit staff within the same group, or external consultants. 7. Regarding the internal review to detect if any questionable or forged documents have been accepted for account opening, could the SFC provide more guidance on how to scope the review? While the SFC does not prescribe the methods for identifying clients who used questionable or forged documents to open accounts, LCs may refer to the Appendix A for examples of irregularities in documents. LCs may adopt a risk-based approach with reasonable methodology and selection criteria for identifying any such case(s). If the review reveals significant deficiencies, the LC should extend the scope, including increasing the sample size of the review. 8. What should LCs pay attention to if they detect suspected questionable or forged documents during the internal review and decide to terminate the relationship with the clients? Where an LC detects questionable or forged documents, it should follow steps (ii) to (vii) of Measure 1 in Appendix B to close the identified accounts. When LC terminates the business relationship with the relevant clients, it should ensure proper disclosure of information and adequate communication with the clients regarding the handling of client assets. LCs should also act in accordance with the relevant client agreements and ensure that client assets are properly safeguarded.

54/F, One Island East, 18 Westlands Road, Quarry Bay, Hong Kong 香港鰂魚涌華蘭路 18 號港島東中心 54 樓 +852 2231 1222 www.sfc.hk Page 3 of 3 (V) Others 9. The SFC’s circular reminds LCs to comply with all relevant legal and regulatory requirements in applicable jurisdictions and refers to the notice jointly issued by the CSRC and other Chinese Mainland authorities on 22 May 2026. Can LCs open new investment accounts for Chinese Mainland investors who come to Hong Kong in person? Can LCs continue to serve the existing Chinese Mainland investors? When Chinese Mainland investors come to Hong Kong in person and approach LCs to open investment accounts or for other investment services, LCs should implement Measure 3 in Appendix B in relation to declarations and designation of bank accounts, in addition to fulfilling know‑your‑customer and customer due diligence requirements. LCs may continue to serve existing Chinese Mainland investors provided that, among other things: i. No questionable or forged documents were used in their account opening; ii. The relevant measures in Appendix B are adequately implemented; and iii. The service is conducted in a manner compliant with the applicable requirements under the notice. Where an LC has questions regarding the interpretation or application of the notice, including whether certain activities carried out by the LC on the Chinese Mainland may be unlawful, it should seek legal advice from a qualified legal adviser. 10. Are the additional measures in Appendix B applicable to corporate clients and institutional clients? No. The additional measures target at individual clients and are not applicable to corporate clients and institutional clients.