Mitigating risks in receiving deposits through simplified eDDA arrangements

Popup advanced search keywords

Advanced search

All of these words:

Any of these words:

The exact phrase:

None of these words:

Popup search form

20 Aug 2026

The Securities and Futures Commission (SFC) issues this circular to highlight the risks associated with the increasing use of simplified Electronic Direct Debit Authorisation (eDDA) 1 arrangements 2 by licensed corporations, SFC-licensed virtual asset service providers and associated entities (collectively referred to as “licensed firms”), such as internet brokers and virtual asset trading platform operators, for receiving client deposits. These risks include those arising from erroneous, unauthorised or fraudulent eDDA setup requests and subsequent direct debit transactions (referred to as “eDDA Deposits”). This circular also sets out measures for assessing and mitigating such risks to assist licensed firms in protecting their operations and clients from financial losses.

Background of simplified eDDA arrangements

Licensed firms adopt simplified eDDA arrangements to enable clients to transfer funds from their own bank accounts (ie, same-name accounts) to their trading accounts through licensed firms’ mobile trading applications or trading websites, thereby facilitating a more efficient deposit process for trading or settlement purposes.

The simplified eDDA setup process adopted by a licensed firm typically involves the following steps:

(a) a client provides the licensed firm, through the firm’s mobile trading application or trading website, with pre-authorisation and necessary personal and bank account information for the firm, as payee, to initiate an eDDA setup request for withdrawing funds from the client’s designated bank account. Such information generally includes the bank’s name, bank account number, bank account owner’s name, the type of identification document used to open the bank account, and the corresponding identification document number; and

(b) the setup request, together with the information provided by the client, is then submitted to the licensed firm’s bank (ie, the payee bank), which further transmits the request and information to the bank at which the client’s designated bank account is maintained (ie, the payer bank) for verification and acceptance.

Subject to the payer bank’s practices and the commercial arrangements between the payee bank and the payer bank, the payer bank may or may not require the bank account owner (ie, the licensed firm’s client as payer) to confirm the eDDA setup request. Where confirmation is required, it is usually conducted through the payer bank’s mobile banking application or internet banking website. The setup process generally takes longer if confirmation is required.

Where confirmation from the bank account owner is not required, the licensed firm may be required by its bank to confirm that authorisation from the bank account owner has been obtained. More importantly, the licensed firm may also be required to indemnify its bank against any losses or liabilities the bank may incur, including third-party claims, arising from the processing of eDDA setup requests or subsequent eDDA Deposits.

Risks associated with simplified eDDA arrangements

When a simplified eDDA setup request is processed without confirmation from the bank account owner, the licensed firm that initiates the setup request and subsequent eDDA Deposits at the client’s request bears primary responsibility for ensuring that it has obtained proper authorisation from the bank account owner. This exposes the firm to risks, including:

(a) Impersonation and unauthorised access risks : An eDDA setup request may be initiated without the bank account owner’s knowledge, particularly in cases involving impersonation or unauthorised access to a client’s trading account, where stolen personal and bank account information is used to initiate the eDDA setup; and

(b) Indemnity and financial risks : The firm faces financial risks arising from the indemnity provided to the payee bank, including in cases of fraudulent or unauthorised eDDA setup requests or eDDA Deposits, as well as disputes or claims arising from erroneous eDDA setup requests containing inaccurate information submitted by the firm based on the information provided by its clients.

Measures for risk assessment and mitigation

Licensed firms are reminded of their obligations to maintain proper internal control procedures and adequate financial and operational capabilities to protect their operations and clients from financial loss arising from fraud and other dishonest acts 3 . In this regard, licensed firms adopting simplified eDDA arrangements for receiving client deposits should review these arrangements, assess the associated risks, and implement appropriate risk mitigating measures.

Risk assessment of simplified eDDA arrangements

Licensed firms are reminded to have a thorough understanding of simplified eDDA arrangements for receiving client deposits, as well as their related risk exposures and obligations. For example, they should review the relevant service agreements, terms of business and other contractual documents with their banks.

Before entering into or continuing with existing simplified eDDA arrangements, licensed firms should:

(a) review the terms of any indemnities provided, or to be provided, to their banks;

(b) identify the payer banks for which their payee banks can facilitate simplified eDDA arrangements, and understand whether such payer banks require confirmation from bank account owners for eDDA setup requests;

(c) assess the relevant risks arising from (b), including those from erroneous, unauthorised or fraudulent eDDA setup requests and eDDA Deposit instructions, as well as the firms’ operational capabilities to address such risks, having regard to the risk mitigating measures that the firms may adopt, and their financial resources to meet potential claims; and

(d) review the risk assessment in (c) periodically and whenever material changes occur to the scale or risk profile of their simplified eDDA arrangements, having regard to risk factors including those mentioned in paragraph 6.

Measures to mitigate the risks associated with simplified eDDA arrangements

Licensed firms should implement risk mitigating measures commensurate with the nature, scale and complexity of their business and operations. Specifically, before processing any new simplified eDDA setup requests from their clients 4 , licensed firms should:

(a) take reasonable steps to ascertain that the eDDA setup request is authorised by the bank account owner 5 , which may include:

(i) where confirmation from the bank account owner is required by a payer bank during the setup process, assessing whether the payer bank has a robust authentication process for confirming that eDDA setup requests are authorised by bank account owners; to facilitate this assessment, appropriate enquiries may be made through the payee bank or directly with the payer bank; or

(ii) where confirmation from the bank account owner is not required or where (i) cannot be satisfied, ascertaining the ownership of the bank account designated for the eDDA setup by requiring the client to make a one-off small-value fund transfer from that bank account to the licensed firm’s designated bank account for crediting to the client’s trading account, and verifying the account holder’s name against the deposit record for that transfer obtained by the licensed firm from its bank 6 ; and

(b) take reasonable steps to ensure that the identification information of the bank account owner submitted in the eDDA setup requests is properly verified, which may include:

(i) accepting only identification information of the bank account owner that is identical to the firm’s records of the client who makes the eDDA setup request; such information includes the name, the type of identification document used to open the bank account, and the corresponding identification document number; or

(ii) where the identification information used for the eDDA setup request differs from that held by the firm, obtaining the identification document purportedly used to open the bank account for verification.

Where the measures in paragraph 10(a) or 10(b) cannot be reasonably satisfied, or where licensed firms detect red flags indicating fraudulent activities, unauthorised access, or other suspicious transactions or activities as part of their ongoing monitoring 7 , licensed firms should, where appropriate, decline the eDDA setup requests and/or withhold the processing of eDDA Deposit instructions and any subsequent instructions or requests relating to the relevant account or transactions, and take follow-up actions before processing further. Examples of red flags include:

(a) repeated failures in eDDA setup requests or deposits;

(b) frequent and/or large eDDA Deposits made by the clients within a short period without an apparent legitimate purpose or commercial rationale;

(c) eDDA Deposits that are inconsistent with a client’s financial profile, expected account activity or historical deposit patterns;

(d) a new eDDA setup request followed by the whitelisting of a new wallet address for depositing or withdrawing virtual assets, or vice versa, particularly in the case of existing clients; and

(e) unusual or suspicious eDDA Deposits that are subsequently converted into virtual assets, followed by instructions or requests to withdraw the virtual assets shortly thereafter.

Licensed firms are reminded of their obligations to promptly investigate and assess whether such transactions or activities warrant further actions including reporting to the relevant authorities, such as the Joint Financial Intelligence Unit or Anti-Deception Coordination Centre of the Hong Kong Police Force (HKPF), as appropriate 8 .

Licensed firms should consider implementing supplementary measures to further mitigate the risks arising from the processing of eDDA setup requests and deposits. For example, they may impose appropriate restrictions on eDDA Deposits, such as limits on transaction amounts or frequency, or a withholding period after eDDA Deposits 9 , or require appropriate step-up authentication for an eDDA setup request or eDDA Deposit instruction, having regard to the client’s profile and the assessment referred to in paragraph 9 above, as well as other relevant risk indicators including those mentioned in paragraph 11.

Where licensed firms are unable to adequately mitigate the risks associated with the use of simplified eDDA arrangements for receiving client deposits, they should use alternative deposit arrangements, such as standard eDDA, bank transfers or other appropriate means, having regard to the nature, scale and complexity of their business and operations.

Disclosure and reminder to clients

Licensed firms should disclose the eDDA settings (including any limits on transaction amounts or frequency and any expiry dates) to clients, obtain their consent to such settings, and remind clients to review and amend those settings with the relevant payer banks as needed.

Furthermore, to promptly identify erroneous, unauthorised or fraudulent eDDA setup requests or deposits, licensed firms should also remind clients to regularly review the bank accounts being registered with the licensed firm for eDDA Deposits, including the number of such accounts and any changes or amendments made to them, and closely monitor their bank account transactions for irregularities, and contact the firm or their banks immediately after spotting any suspicious activities, and/or report the matter to the HKPF, as appropriate.

The SFC recognises the importance of the safe and effective use of simplified eDDA arrangements for receiving client deposits, and has been engaging with relevant authorities and stakeholders about the safeguards and controls associated with these arrangements. Licensed firms should, nevertheless, continue to assess the risks associated with their use of such arrangements and implement appropriate measures to mitigate those risks.

Should you have any queries regarding this circular, please contact Ms Kiki Wong at 2231 1569 for assistance.

Intermediaries Division Securities and Futures Commission

End

SFO/IS/033/2026

1 eDDA is a service under the Faster Payment System which enables a payer to pre-authorise a bank account held in the payer’s own name to be debited by direct debit payments initiated by the payee.

2 For the avoidance of doubt, eDDA instructions may be initiated either by the payer or by the payee: (a) under a standard eDDA arrangement, licensed firms’ clients, as payers, initiate eDDA setup requests through their own banks; and (b) under a simplified eDDA arrangement, licensed firms, as payees, initiate eDDA setup requests on the basis of pre-authorisation and information provided by their clients, as payers. This circular focuses on simplified eDDA arrangements. For details on the differences between standard eDDA and simplified eDDA, please refer to the website of Hong Kong Interbank Clearing Limited .

3 Paragraph 4.3 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct) and paragraph 11.10 of the Guidelines for Virtual Asset Trading Platform Operators (VATP Guidelines).

4 For the avoidance of doubt, when processing new eDDA setup requests, licensed firms should have regard to the applicable limits on the number of bank accounts that a client may designate for deposits and withdrawals, including bank accounts linked through eDDA setup requests. Such accounts should be subject to the same bank account registration mechanism implemented by the licensed firm. Please also refer to paragraph 20 of the SFC’s circular “Detection and prevention of potential layering activities in money laundering” issued on 17 November 2025.

5 For the avoidance of doubt, for clients onboarded via the “online onboarding of clients using a designated bank account in Hong Kong” approach, licensed firms should refrain from accepting the initial deposit through simplified eDDA arrangements unless they are satisfied that the eDDA setup request is authorised by the bank account owner.

6 Licensed firms should refrain from relying solely on deposit record documents provided by clients to ascertain bank account ownership.

7 Chapter 5 and Chapter 7 of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers).

8 Licensed firms are also reminded of their notification obligations to the SFC under paragraph 12.5 of the Code of Conduct and paragraph 16.7 of the VATP Guidelines, where relevant and applicable.

9 Licensed firms should review and, where necessary, amend their client agreements to ensure they remain appropriate in light of their risk mitigating measures, and promptly notify clients of any related changes.

Click here to download the document Page last updated : 20 Aug 2026