Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 1 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To describe the HKMA's approach to supervising the regulated activities of AIs that are registered with the SFC under the Securities and Futures Ordinance Classification A statutory guideline issued by the MA under the Banking Ordinance, §7(3) Previous guidelines superseded Circular “Depositaries of SFC-authorised Collective Investment Schemes (Type 13 Regulated Activity)” dated 27.07.23 and SB-1 “Supervision of Regulated Activities of SFC-Registered Authorized Institutions” (V.3) dated 10.05.24. Application To all AIs that are registered with the SFC under the Securities and Futures Ordinance Structure

1. Introduction 1.1 Terminology
2. Regulatory and supervisory framework

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 2 2.1 General 2.2 Registration with the SFC and scope of regulated activities 2.3 Cooperation between the HKMA and the SFC 3. Supervisory approach 3.1 General 3.2 Guidelines and supervisory standards 3.3 On-site examinations 3.4 Off-site reviews 4. Major legal and regulatory requirements 4.1 General 4.2 Corporate governance and internal controls 4.3 Registration of relevant individuals and appointment of executive officers 4.4 Fitness and properness, competence and continuous professional training 4.5 Know-your-customer and client agreement 4.6 Product due diligence 4.7 Selling of investment products 4.8 Corporate finance advisory activities and bookbuilding and placing activities in equity capital market and debt capital market transactions 4.9 Asset management 4.10 Back-office functions 4.11 Controls, monitoring and supervision 4.12 Professional investors 4.13 Client Identity Rule Policy 4.14 Providing depositary services for SFC-authorized collective investment schemes

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 3 4.15 Other major requirements for regulated activities 4.16 Regulatory requirements for prevention of money laundering and terrorist financing 5. Reporting of certain events 6. Disciplinary actions —————————

1. Introduction 1.1 Terminology 1.1.1 In this module:  “associated entity” has the meaning set out in Schedule 1 to the Securities and Futures Ordinance. In broad terms, an associated entity of a RI refers to a company which is in a controlling entity relationship (as defined in the Securities and Futures Ordinance) with the RI, and receives or holds in Hong Kong client assets of the RI;  "executive officer" has the meaning set out in §2 of the Banking Ordinance. Essentially, an executive officer is an individual appointed by a RI to directly supervise the conduct of one or more regulated activities of that RI. Such officer must have received prior written consent from the MA;  “intermediary” means a licensed corporation or a registered institution under the Securities and Futures Ordinance;  “licensed corporation” means a corporation which is granted a licence by the SFC under §116 or §117 of the Securities and Futures Ordinance;

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 4  “misconduct” for the purposes of Part IX of the Securities and Futures Ordinance has the meaning set out in §193 of that Ordinance;  “misconduct” in relation to a relevant individual and for the purposes of §58A of the Banking Ordinance has the meaning set out in §58A(6) of that Ordinance;  “misconduct” in relation to an executive officer and for the purposes of §71C of the Banking Ordinance has the meaning set out in §71C(12) of that Ordinance;  "regulated function" in relation to a regulated activity has the meaning set out in §20(10) of the Banking Ordinance. It basically refers to any function performed for or on behalf of or by an arrangement with a RI relating to the regulated activity, other than work ordinarily performed by an accountant, clerk or cashier;  “related corporation” has the meaning set out in Schedule 1 to the Securities and Futures Ordinance;  "relevant individual" has the meaning set out in §20(10) of the Banking Ordinance. In generic terms, a relevant individual is an individual who carries out any regulated function in one or more regulated activities of a RI. An executive officer is therefore a relevant individual;  "RI" means an AI that is a registered institution under the Securities and Futures Ordinance;  "securities" has the meaning set out in Schedule 1 to the Securities and Futures Ordinance;  "SFC" means the Securities and Futures Commission;

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 5  "SFC Code" means the Code of Conduct for Persons Licensed by or Registered with the SFC, issued and updated by the SFC from time to time; and  “structured product” has the meaning set out in Schedule 1 to the Securities and Futures Ordinance. 1.1.2 The explanations of legal terms given above and the summaries of legal and regulatory requirements provided in the remainder of this module are for readers' reference and guidance only. Legal advice should be sought where precise interpretation is required. 2. Regulatory and supervisory framework 2.1 General 2.1.1 The regulatory framework for RIs is set out in the Banking Ordinance and the Securities and Futures Ordinance. The Banking Ordinance (along with its subsidiary legislation) is a statute providing the legal framework for banking supervision. It provides for the authorization and supervision of AIs so as to provide a measure of protection to depositors and to promote the general stability and effective working of the banking system. The Securities and Futures Ordinance (along with its subsidiary legislation) is the principal legislation to regulate the securities and futures industry in Hong Kong, which is a consolidated package of the regulations pertaining to financial products; securities and futures market and industry; and protection of investors. 2.1.2 AIs carrying on business in regulated activities are required to be registered with the SFC as RIs. Under §169 of the Securities and Futures Ordinance, the SFC has specific power to publish codes of conduct for the purpose of giving guidance relating to the practices and standards with which intermediaries and their representatives should comply in carrying on regulated activities.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 6 2.1.3 While the ultimate responsibility for the regulation of intermediaries in the securities and futures market rests with the SFC, the HKMA is the “front line supervisor” for RIs responsible for the day-to-day supervision of the regulated activities of RIs under the regulatory regime stipulated in the Securities and Futures Ordinance and the Banking Ordinance. §5(3) of the Securities and Futures Ordinance provides that the SFC, in performing any of its functions in relation to any RI, may rely, in whole or in part, on the supervision of such RI by the MA. 2.2 Registration with the SFC and scope of regulated activities 2.2.1 Under §119 of the Securities and Futures Ordinance, the SFC may, upon application by an AI, register the applicant for carrying on one or more regulated activities specified by the SFC. 2.2.2 For definitions of each of the regulated activities, refer to Schedule 5 to the Securities and Futures Ordinance. 2.2.3 To apply for registration, variation of regulated activity under §127 of the Securities and Futures Ordinance, or modification or waiver of a condition imposed on the registration under §134 of the Securities and Futures Ordinance, an AI needs to complete the specified forms and submit them, together with the required supporting documents, to the SFC. To facilitate planning, applicants should notify the HKMA of their intended application in advance. 2.2.4 Every RI also needs to appoint at least two executive officers to directly supervise each regulated activity that is the subject of its registration. It is a statutory condition of registration under Part V of the Securities and Futures Ordinance that, in relation to each regulated activity, there is at least one executive officer available at all times to supervise the business of that activity. The executive officers must obtain the MA’s written consent and applications should be submitted directly to the HKMA.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 7 2.2.5 In deciding whether to register or refuse to register an AI, the SFC will refer the application to the MA, will have regard to any advice given by the MA and may rely wholly or partly on that advice in making its decision. 2.2.6 In advising the SFC whether he is satisfied that the applicant is fit and proper to be registered for the regulated activities concerned, the MA will take into account the factors set out in §129 of the Securities and Futures Ordinance. The HKMA will also make reference to any relevant rules, codes, guidelines or guidance issued by the SFC. In practice, the HKMA will evaluate the application taking into account matters such as the AI’s previous experience in the activities, management capabilities, controls and resources. 2.3 Cooperation between the HKMA and the SFC 2.3.1 The HKMA and the SFC co-operate in the exercise of various statutory responsibilities and powers in relation to the supervision of RIs’ conduct of regulated activities, including registration, examinations, investigations and disciplinary actions, in accordance with the Securities and Futures Ordinance and the Banking Ordinance. 2.3.2 Under §120 of the Banking Ordinance, the MA has the right to exchange information about the regulated activities of RIs with the SFC. 2.3.3 A Memorandum of Understanding (“MoU”) has been signed between the HKMA and the SFC to set out the operational details relating to the respective roles and responsibilities of the two regulators in respect of the securities supervisory regime, and to strengthen co-operation between them. The MoU has been posted on the public website of the HKMA. Issues of supervisory concern involving the regulated activities of RIs are discussed in the regular meetings and other forms of supervisory dialogues between the two regulators under the MoU. Complaints received by the SFC involving RIs are forwarded to the HKMA for follow up.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 8 3. Supervisory approach 3.1 General 3.1.1 Pursuant to §7 of the Banking Ordinance, one of the functions of the MA is to take all reasonable steps to ensure that the businesses of AIs are carried on with integrity, prudence and the appropriate degree of professional competence. Further, the MA’s mandate is to promote and encourage proper standards of conduct and sound and prudent business practices amongst AIs. 3.1.2 In its efforts to enhance bank customer protection, the HKMA takes into account the G20/OECD High-level Principles on Financial Consumer Protection. These principles, which include disclosure and transparency, and responsible business conduct, have been incorporated in the Code of Banking Practice (“Code”) issued jointly by the Hong Kong Association of Banks and the DTC Association, and endorsed by the HKMA. The Code applies to the overall relationship between AIs and their customers in Hong Kong, and should be observed by AIs in dealing with and providing products and services to their customers. The HKMA has also worked closely with the banking industry to promote customer-centric culture and appropriate values that are consistent with the goal of ensuring sustainable long term growth of the business, which in turn help foster proper business conduct of AIs to take due care of customers’ interests. 3.1.3 In the context of regulated activities, the HKMA performs the role of front line supervisor and supervises RIs’ compliance with all relevant requirements, providing an appropriate degree of protection to investors.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 9 3.1.4 In practice, a RI’s board1 and management bear the primary responsibility for putting in place sound controls and systems commensurate with the RI’s risk profile for properly managing the risks associated with the activities. They have the responsibility of, among others, protecting their customers’ interests, and are expected to play a proactive role in ensuring effective risk management and instilling customer-centric culture in the RI. Meanwhile, the HKMA monitors RIs’ compliance with relevant laws and regulatory standards, promotes good corporate governance and risk culture, and takes a range of supervisory and enforcement actions to address issues identified. 3.1.5 The HKMA adopts a risk-based supervisory approach and measures that are appropriate and proportionate to the risks posed by RIs’ regulated activities to the investing public. To ensure a fair and consistent supervisory process, generally speaking, there are three levels of measures that the HKMA would consider. 3.1.6 The first level of supervisory action is encouraging adoption of good practices. The HKMA would share good practices with the industry, and encourage RIs which have not yet adopted such good practices to do so, as far as practicable, to strengthen their practices and controls. 3.1.7 In addition, where the HKMA identifies management, system and / or control deficiencies of RIs in its supervisory process, the HKMA would consider the second and the third level of supervisory action, taking into consideration the nature and the severity of the deficiencies and implications. 3.1.8 The second level of supervisory action would be deployed where deficiencies in controls or practices of RIs are

1 For a locally-incorporated AI, the board may delegate its oversight duties to designated board-level committee(s). As regards the Hong Kong operations of an AI incorporated outside Hong Kong, the term “board” generally refers to the local senior management of the AI under the scrutiny by its head office or regional headquarters.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 10 identified. Such deficiencies may include RIs’ controls or practices that do not meet the regulators’ expected standards. To address such deficiencies, the HKMA would consider various supervisory actions according to the specific circumstances of each case. Usually the RI concerned will be required to implement corrective actions to rectify the problem. Where the deficiencies suggest systemic issues, the RI concerned would be required to take more rigorous actions. Typically, it would be instructed to commission an independent review of the relevant controls and / or transactions according to the HKMA’s requirements and take proper actions to address the review findings. For example, if the deficiencies have impact on aggrieved customers’ interests, the RI concerned would have to address aggrieved customers’ concerns through appropriate measures such as enhanced complaint handling procedures. The RI concerned might also be required to cease business practices that have caused serious supervisory concerns. 3.1.9 The third level of supervisory action would be triggered when the HKMA finds prima facie case of any ground for discipline, such as misconduct by a RI and / or staff of a RI, or any of them ceasing to be a fit and proper person. In this situation, the HKMA would consider possible enforcement actions, and / or other appropriate follow-up actions, including referring the case to the SFC for investigation or collaborating with the SFC to take appropriate disciplinary actions. 3.1.10 The objective of the HKMA's enforcement work is to enforce the laws in Hong Kong governing the various operations of RIs. By taking effective enforcement actions and other appropriate follow-up actions against offenders, the HKMA strives to deter improper practices and behaviour in order to promote proper standards of conduct and prudent business practices among RIs, and to provide a measure of protection to depositors and investors.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 11 3.1.11 The HKMA's enforcement standards with respect to the conduct of RIs are consistent with those adopted by the SFC. The overriding principles of the HKMA’s enforcement processes are to ensure fairness, integrity and legal compliance, and to observe the due process. 3.1.12 While the HKMA will generally have regard to the above categorisation of supervisory and enforcement actions, the actual measures to be taken in each case will be governed by the facts and circumstances of that case. 3.2 Guidelines and supervisory standards 3.2.1 The general approach adopted by the HKMA is to require RIs to comply with standards equivalent to those applied by the SFC to licensed corporations in their regulated activities.2

3.2.2 The SFC has the power under the Securities and Futures Ordinance to issue, from time to time, rules on specific aspects of regulated activities and codes and guidelines in relation to the carrying on of regulated activities. These rules, codes or guidelines, etc. are applicable to RIs insofar as the latter’s regulated activities are concerned. 3.2.3 The SFC also issues circulars and Frequently Asked Questions from time to time providing further guidance and / or reminding intermediaries to comply with the relevant requirements of the SFC. The SFC consults the HKMA before making, publishing or amending any rules, codes,

2 In particular for the Securities and Futures Ordinance, RIs are generally subject to the provisions of the Securities and Futures Ordinance in the same way as licensed corporations in respect of their regulated activities. The major areas of difference, which arise from the need to avoid regulatory overlap, are:  capital requirements – RIs are not subject to the Securities and Futures (Financial Resources) Rules; and  handling of client money – RIs are not subject to the Securities and Futures (Client Money) Rules, as these are adequately covered under the Banking Ordinance as well as guidance issued by the HKMA from time to time.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 12 guidelines and etc. insofar as they apply to AIs for their being RIs or associated entities of intermediaries. 3.2.4 In interpreting the regulatory requirements of the SFC, the HKMA consults the SFC where appropriate and draws reference from the latter’s experience in applying the requirements to licensed persons. 3.2.5 The HKMA may issue circulars, guidelines or guidance notes to RIs on the application of the Securities and Futures Ordinance, as well as the rules, guidelines and business conduct codes issued by the SFC, to the conduct of regulated activities by RIs. 3.2.6 In addition, the HKMA takes into account the unique circumstances of banking environment in the supervision of RIs’ conduct of regulated activities. In particular, these include the special trust in banks by their customers; the increasing diversity of investment products with varying complexity and risks; and the growing public expectation for enhanced protection of bank customers. Against such background, the HKMA, as the regulator of AIs, may promulgate additional investor protection measures and requirements on top of the requirements of the SFC, by issuing circulars or guidelines to AIs from time to time. The HKMA consults the SFC regarding the circulars or guidelines, insofar as they apply to AIs in relation to carrying on of regulated activities. 3.2.7 In promulgating additional investor protection measures, the HKMA acknowledges that it is not appropriate to adopt a one-size-fits-all approach, taking into account the diversity of bank customers which include relatively more sophisticated customers (e.g. private banking customers and corporate customers). Therefore, some enhanced investor protection measures are targeted at retail customers, whereas a more measured approach is adopted in enhancing investor protection for relatively more sophisticated customers (e.g. private banking customers and corporate customers).

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 13 3.2.8 The HKMA will take into account a RI’s compliance with the applicable legal and regulatory requirements in considering whether that AI satisfies the continuing authorization criterion in respect of adequate systems of control under paragraph 10 of the Seventh Schedule to the Banking Ordinance. 3.2.9 RIs should ensure their management and staff are well￾informed of any new and the latest applicable legal and regulatory requirements. 3.3 On-site examinations 3.3.1 The HKMA conducts on-site examinations of the regulated activities of RIs. The focus of examination is mainly on regulatory compliance, internal controls and management supervision. 3.3.2 The objectives of the examinations are to enable the HKMA to understand the way in which regulated activities of the relevant RI are being conducted and to determine whether it has established appropriate and effective policies, procedures and controls to ensure compliance with the relevant legislation, rules, codes, circulars and guidelines issued by the SFC and the HKMA. RIs should be able to demonstrate that the relevant practices and procedures are well established and effectively applied. 3.3.3 The HKMA monitors the quality and competence of relevant individuals in its on-site examinations, taking into account the relevant provisions in the SFC’s Fit and Proper Guidelines, Guidelines on Competence and Guidelines on Continuous Professional Training (see subsection 4.4 below). 3.3.4 While the general power to conduct examination of AIs comes from §55 of the Banking Ordinance, the MA also has a specific power under §180 of the Securities and Futures Ordinance in respect of the inspection of RIs, their associated entities and related corporations. Refer to paragraph 4.15.2 below for more details.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 14 3.4 Off-site reviews 3.4.1 To facilitate the continuing supervision of the regulated activities of RIs, the HKMA requires all RIs to submit semi￾annually the information specified in the “Return of Securities Related Activities – MA(BS)14”. The return is designed to provide the HKMA with a general overview of the regulated activities being carried out by each RI as well as the trends in the industry. 3.4.2 The HKMA also requires RIs to submit regular and / or ad￾hoc surveys or reviews for its off-site surveillance. 3.4.3 The HKMA may deploy mystery shopping programme to test check RIs’ practices, where necessary. 3.4.4 Information collected from off-site surveillance will be used for prioritising supervisory resources to focus on potential issues (e.g. in determining the scope and focus of on-site examinations). 4. Major legal and regulatory requirements 4.1 General 4.1.1 The HKMA requires RIs to comply with all relevant legislation, rules and regulations and to conduct their regulated activities in a responsible, honest and business￾like manner. Senior management should ensure that appropriate policies and procedures, management oversight, internal controls and staff training are in place for such purposes. Failure of any RI or relevant individuals to observe and abide by any applicable legal and regulatory requirement will call into question their fitness and properness for the conduct of regulated activities, and may lead to disciplinary action. 4.1.2 The major legal and regulatory requirements are listed below: Legal requirements

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 15  Banking Ordinance, Securities and Futures Ordinance and subsidiary legislation: – Refer to subsection 2.1 above for details; Major regulatory requirements  Fit and Proper Guidelines, Guidelines on Competence and Guidelines on Continuous Professional Training: – Refer to subsection 4.4 below for details;  Code of Conduct for Persons Licensed by or Registered with the SFC (“SFC Code”): – The SFC Code seeks to assist RIs and relevant individuals to comply with applicable regulatory requirements, and gives guidance relating to the practices and standards with which RIs and relevant individuals are ordinarily expected to comply. The SFC Code is principles-based and RIs are responsible for adoption of proper internal controls and risk management systems, having due regard to the nature, size and complexity of their regulated activities. – The SFC and the HKMA are guided by the SFC Code in considering whether a RI or a relevant individual is fit and proper to remain registered. As such, a breach of the SFC Code will call into question the RI’s or the relevant individual’s fitness and properness. Among other circumstances, it will be a misconduct if, in the opinion of the regulators, an act or omission is or likely to be prejudicial to the interest of the investing public or to the public interest (see §§58A(6) and 71C(12) of the Banking Ordinance and §193(1) of the Securities and Futures Ordinance);

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 16  Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the SFC: – These guidelines amplify paragraph 4.3 of the SFC Code, which requires a registered person to have satisfactory internal control and internal management systems. They set out various key controls and attributes of an adequate internal control system, as well as possible effective methods of achieving these attributes. – The internal control needs of RIs may vary, depending upon each RI’s particular circumstances, of which the HKMA will take into account when assessing the adequacy of the RI’s internal controls. The HKMA and the SFC also issue from time to time other guidelines, circulars and Frequently Asked Questions to provide guidance concerning various regulated activities. Other major requirements for regulated activities are listed in subsection 4.15 below. 4.1.3 A general description of the major legal and regulatory requirements applicable to regulated activities of RIs and their relevant individuals is given in the following subsections. RIs and their relevant individuals should refer to the relevant documents for detailed requirements and ensure adherence to them. They are also advised to regularly visit the HKMA’s website and the SFC’s website for updates on regulatory requirements. 4.2 Corporate governance and internal controls 4.2.1 RIs should have policies and procedures for establishing, documenting and maintaining an effective management and

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 17 organisational structure with clear lines of responsibility and accountability3 . 4.2.2 A RI’s board of directors and senior management, including committees of the board, should be organised in a way that enables the board to address and control the regulated activities of the RI. The board of directors and senior management, including committees of the board, should be composed of individuals with an appropriate range of skills and experience to understand and run the RI’s regulated activities. 4.2.3 Senior management should properly manage the risks associated with the business of regulated activities of the RI. They should understand the nature of such business of the RI, its internal control procedures and its policies on the assumption of risk. They should clearly understand the extent of their own authority and responsibilities. The senior management of a RI should bear primary responsibility for ensuring the maintenance of appropriate standards of conduct and adherence to proper procedures by the RI. 4.2.4 RIs should ensure that it has adequate resources to supervise diligently and does supervise diligently persons engaged in the conduct of its regulated activities. 4.2.5 RIs should have internal control procedures and financial and operational capabilities which can be reasonably expected to protect its operations, its clients and other licensed or registered persons from financial loss arising from theft, fraud, and other dishonest acts, professional misconduct or omissions.

3 For example, a RI is expected to identify at least one individual as principally responsible for the overall management of the whole business of the RI (generally the chief executive) as well as managing each of the businesses or functions listed in paragraphs 2 to 8 of the Fourteenth Schedule to the Banking Ordinance, to the extent that these individuals are involved in the management of the business constituting any regulated activity for which the RI is registered. Refer to the HKMA’s circular “Management Accountability at Registered Institutions” dated 16.10.2017 for further guidance.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 18 4.2.6 RIs should ensure that key duties and functions shall be appropriately segregated, particularly those duties and functions which when performed by the same individual may result in undetected errors or may be susceptible to abuses which may expose the firm or its clients to inappropriate risks. 4.2.7 Regular and effective communication should occur within a RI to ensure that management is continually and timely apprised of the status of the RI’s operations and financial position, including qualitative and quantitative risks posed thereto or weaknesses detected therein, non-compliance with legal and regulatory requirements, and the overall adherence to the RI’s defined business objectives. 4.2.8 RIs are expected to demonstrate to the satisfaction of the HKMA that their remuneration systems (or, in the case of RIs incorporated outside Hong Kong, the remuneration systems applicable to officers and employees engaged in the conduct of their business and operations in Hong Kong) are sound and in compliance with the relevant guidance. 4.3 Registration of relevant individuals and appointment of executive officers Relevant individuals 4.3.1 Under §20(3) of the Banking Ordinance, every RI is required to submit specified particulars of its relevant individuals to the MA for inclusion of such individuals’ particulars in the HKMA Register of Securities Staff of AIs (“HKMA Register”) 4 . In accordance with §20(4B) of the Banking Ordinance, such particulars are available for public inspection in the form of an on-line record on the HKMA public website.

4 This refers to the register established and maintained by the MA under §20(1)(ea) of the Banking Ordinance.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 19 4.3.2 A relevant individual does not have to be an employee of the RI. For example, the individual can be an employee of the RI’s parent or group company that supports the conduct of a regulated activity of the RI. 4.3.3 Pursuant to §20(4) of the Banking Ordinance, RIs should give notice to the MA of any subsequent change in the information submitted for the purpose of the HKMA Register. Such notification has to be made to the MA within 7 business days of the change. RIs should ensure they have put in place adequate policies and procedures to ensure compliance with this statutory requirement. 4.3.4 The reporting of the specified particulars of relevant individuals, including any subsequent change, and the removal of the specified particulars of relevant individuals, is effected by an on-line submission mechanism5 . 4.3.5 Only those individuals whose names are entered in the HKMA Register may engage in any regulated function of any regulated activity of a RI. RIs should therefore submit the names and particulars of individuals for inclusion in the HKMA Register prior to such individuals engaging in such capacity. 4.3.6 RIs are expected to establish and maintain a database of the names and particulars of relevant individuals in order to facilitate reporting to the HKMA. To be in line with the information requirements for licensed representatives under the Securities and Futures (Licensing and Registration)(Information) Rules, such database should also include the following information or records, with supporting evidence for (d) and (e), for each relevant individual: (a) residential address; (b) correspondence address, if different from (a);

5 All changes and removal relating to executive officers however should be notified to the HKMA by submissions in writing or such other means as the HKMA may indicate.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 20 (c) contact telephone number; (d) details of any registration or authorization (however described) to carry on a regulated activity by the SFC or a regulatory organisation or authority in or outside Hong Kong6 (e) any membership (however described) of a stock exchange or futures exchange in Hong Kong or elsewhere; (f) the types of services provided by the individual in relation to the conduct of regulated activities on behalf of the RI (which may be in the form of job description); and (g) any current directorship, partnership or proprietorship and the dates of appointment, or commencement, of any such directorship, partnership or proprietorship (as the case may be). 4.3.7 It is a statutory condition of registration for a RI to ensure that its relevant individuals are fit and proper to be so engaged. In determining whether an individual is and remains fit and proper to be a relevant individual, RIs should ensure that the individual concerned meets the Fit and Proper Guidelines, the Guidelines on Competence and the Guidelines on Continuous Professional Training issued by the SFC. Refer to subsection 4.4 below for specific guidance. 4.3.8 The HKMA will not assess the fitness and properness of relevant individuals prior to placing their names on the register. As noted in paragraph 4.3.7 above, this responsibility rests with the RI concerned. The HKMA will however conduct background checks on the relevant individuals with the SFC and, if necessary, other relevant (e.g. supervisory, law enforcement) agencies. RIs should

6 RIs should check whether the individual is permitted to take employment in Hong Kong.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 21 inform all their relevant individuals that their personal information may be forwarded by the HKMA to other bodies for such purpose. The HKMA will treat all data about the individuals concerned in accordance with the Personal Data (Privacy) Ordinance. Any disclosure of such data to other persons will be in accordance with §§120 and 121 of the Banking Ordinance. Executive officers 4.3.9 Under §§71C and 71D of the Banking Ordinance every RI shall appoint not less than two executive officers to be responsible for directly supervising the conduct of each regulated activity. Further, it is a statutory condition of registration under Part V of the Securities and Futures Ordinance that, in relation to each regulated activity, there is at least one executive officer available at all times to supervise the business of that activity. To ensure compliance, RIs should consider appointing more than two executive officers for each regulated activity where appropriate. 4.3.10 The same executive officers can be appointed for more than one regulated activity. They should be fit and proper, vested with sufficient authority and have received the consent of the MA. As executive officers are relevant individuals, their particulars also have to be entered in the HKMA Register. 4.3.11 Where a person has become or continues to be an executive officer of an AI in contravention of §71C, it is a ground for revocation of the AI’s authorization under paragraph 15A of the Eighth Schedule to the Banking Ordinance. 4.3.12 In considering whether to grant consent to persons applying to become executive officers, the MA will take into account the factors set out in §129 of the Securities and Futures Ordinance and the requirements stipulated by the SFC in the Fit and Proper Guidelines and the Guidelines on

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 22 Competence. Refer to subsection 4.4 below for specific guidance. 4.3.13 As a general guideline, if any of the individuals directly responsible for supervising the conduct of a regulated activity is the Chief Executive, an Alternate Chief Executive, or a Director of a RI, the HKMA would expect such person to be appointed as an executive officer. Where such appointments result in less than two executive officers for any regulated activity, the appointment of the remaining executive officer(s) should be based upon seniority. In other words, the executive officers for each regulated activity should be the relevant individuals in the highest rank according to the RI’s internal ranking. 4.3.14 Notwithstanding these general guidelines, the MA must be satisfied, among other things, that the appointed executive officers are vested with sufficient authority within the RI for such purpose. The HKMA will take into account the size of the RI, the significance of the regulated activity in relation to the overall business of the institution, the management structure as well as the reporting line of the executive officers. 4.3.15 Where a person applies to become an executive officer for more than one regulated activity, the MA is unlikely to give consent in respect of all such regulated activities if there is potential conflict of interest. This may arise if, say, Type 6 and Type 9 regulated activities are supervised by the same individual at the same time. A possible exception is where the proposed executive officer comes from the very top level of management overseeing a substantial part of the AI’s operations, e.g. the Chief Executive, an Alternate Chief Executive, or a Director. 4.3.16 RIs should note that it is a minimum authorization criterion under paragraph 4 of the Seventh Schedule to the Banking Ordinance for the MA to be satisfied that an AI has adequate systems of control to ensure that each person

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 23 who is, or is to be, an executive officer is fit and proper to hold that particular position. Removal of relevant individuals (including executive officers) from their roles 4.3.17 Where a RI forms the view that a relevant individual is no longer fit and proper to be engaged in the conduct of any regulated activity, it should promptly make submission via the on-line mechanism to remove the individual’s information from the HKMA Register within 7 business days. In the case of an executive officer, the RI should notify the HKMA by submission in writing or such other means as the HKMA may indicate within 7 business days. 4.3.18 Where  a relevant individual is, or was at any time, guilty of misconduct; or  the MA is of the opinion that a relevant individual is not, or has ceased to be, a fit and proper person in his capacity as that type of relevant individual, the MA may, after consultation with the SFC, exercise his power under §58A of the Banking Ordinance to remove or suspend the information of the relevant individual concerned from the HKMA Register. 4.3.19 Where  an executive officer is, or was at any time, guilty of misconduct; or  the MA has ceased to be satisfied that an executive officer is a fit and proper person to be such type of officer or has sufficient authority within the RI concerned to be such officer, the MA may, after consultation with the SFC, exercise his power under §71C of the Banking Ordinance to withdraw or suspend his consent.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 24 4.3.20 In addition, the MA may make recommendations to the SFC regarding the exercise of the latter’s powers under the Securities and Futures Ordinance to impose other disciplinary measures on the relevant individuals (including executive officers) concerned. Refer to section 6 below for more details. Relevant individuals under temporary engagement 4.3.21 In line with the SFC’s granting of temporary licences for representatives under the Securities and Futures Ordinance, a RI may temporarily engage an individual in the conduct of a regulated function of one or more regulated activities (refer to the SFC’s Licensing Handbook for restriction on the types of regulated activity applicable to temporary licences for representatives) provided that:  the engagement is for a period not exceeding 3 months;  such engagements of the same individual should not in total exceed 6 months in any period of 24 months;  such individual carries on the relevant activity for or on behalf of the RI or one of its group companies principally in a place outside Hong Kong. With reference to requirements set out in paragraph 5.3.7 of the SFC’s Licensing Handbook, the RI needs to be satisfied that the individual carries on the activity under an authorisation by a regulatory body in that place which performs a function similar to the functions of the SFC. That regulator should be empowered under the law of that place to investigate and (where applicable) take disciplinary action for the individual’s conduct in Hong Kong. If the regulator in the individual’s jurisdiction does not directly authorise the individual, the RI will need to be satisfied that: o the regulator outside Hong Kong has put in place relevant codes or guidelines that set out the entry requirements applicable to individuals

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 25 joining the industry under its jurisdiction, e.g. education, training, examination, experience and/or other competence requirements; o the individual is obliged to comply with relevant rules and/or codes or guidelines issued by the regulator outside Hong Kong that govern the individual’s conduct in carrying out regulated activities in the non-Hong Kong jurisdiction; and o the regulator outside Hong Kong has the power to remove and prohibit unsuitable individuals from carrying out regulated activities under its jurisdiction, e.g. revoking an authorisation, or issuing a banning order from entering the industry;  the RI is satisfied that the individual is a fit and proper person to be so engaged for the regulated activity; and  the RI must implement internal control procedures and maintain records to demonstrate that the above conditions have been satisfied. 4.3.22 The specified particulars of such temporarily engaged staff would also need to be included in the HKMA Register, i.e. they are also relevant individuals. It is therefore the responsibility of the RI to ensure that all temporarily engaged staff are fit and proper to be so engaged for the regulated activity. In assessing the competence of such temporarily engaged staff, authorization by a regulator outside Hong Kong and industry knowledge gained outside Hong Kong will be taken into account. 4.3.23 Temporarily engaged staff may be allowed exemptions from the recognised industry qualification and local regulatory framework paper requirements for temporarily engaged staff. For details of the exemptions, refer to the Guidelines on Competence. Itinerant professionals

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 26 4.3.24 In line with the SFC’s granting of licences for itinerant professionals, a RI may engage an individual who will repeatedly visit Hong Kong on business for a short period each time as an itinerant professional, provided that:  the engagement for the itinerant professional to perform regulated activities in Hong Kong is not more than 45 days in each calendar year;  either: (i) at all times the itinerant professional be accompanied by a relevant individual (who is not a temporarily engaged staff or itinerant professional) in performing regulated activities in Hong Kong; or (ii) the itinerant professional only provides services that constitute regulated activities to professional investors 7 , where the RI should have provided training in the form of a structured course to the individual to ensure that he is fully aware of the Hong Kong regulatory framework before he commences carrying on regulated activities in Hong Kong and should arrange at least one executive officer in relation to the concerned regulated activity to directly supervise or otherwise be responsible for advising the individual in conducting regulated activities in Hong Kong;  the RI is satisfied that the individual is a fit and proper person to be so engaged for the regulated activity; and

7 As defined in Part 1 of Schedule 1 to the Securities and Futures Ordinance but does not include any person of a class which is prescribed by Securities and Futures (Professional Investor) Rules.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 27  the RI must implement internal control procedures and maintain records to demonstrate that the above conditions have been satisfied. 4.3.25 The specified particulars of such itinerant professionals would also need to be included in the HKMA Register, i.e. they are also relevant individuals. It is therefore the responsibility of the RI to ensure that all itinerant professionals are fit and proper to be so engaged for the regulated activity. 4.3.26 In assessing the competence of itinerant professionals by RIs, itinerant professionals who perform regulated activities in Hong Kong may be allowed exemption from the local regulatory framework paper requirements. For the avoidance of doubt, itinerant professionals should fulfil other competence requirements, including recognised industry qualification. 4.3.27 The RI should assume full responsibility for the supervision of the itinerant professional’s activities during his stay in Hong Kong and ensure he will comply with the relevant rules and regulations at all times. 4.4 Fitness and properness, competence and continuous professional training Fitness and properness 4.4.1 The standards that the HKMA and the SFC apply when considering whether a RI is and remains fit and proper for registration are set out in the Fit and Proper Guidelines. The Fit and Proper Guidelines also specify the standards for assessing the fitness and properness of relevant individuals (including executive officers) to carry out regulated activities. These encompass areas such as financial status or solvency, educational or other qualifications or experience, ability to carry on regulated activities competently, honestly and fairly, as well as reputation, character, financial integrity and reliability.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 28 4.4.2 The HKMA requires all executive officers to meet the fit and proper guidelines applicable to responsible officers of licensed corporations. All other relevant individuals of RIs should satisfy the guidelines for licensed representatives. As noted in paragraph 4.3.7 above, the obligation is on the RI to ensure that its relevant individuals are fit and proper. Competence 4.4.3 Competence is one of the key elements in the fit and proper test. For a RI, competence is considered by reference to the institution’s organisational structure and the combined competence of its personnel. One important factor is the policies and procedures on system of functional barriers to address potential conflicts of interest arising from carrying on more than one type of regulated activities (e.g. Type 6 and Type 9) concurrently. As a general guideline, RIs should not engage an individual in the conduct of multiple regulated activities concurrently if there is potential conflict of interest. This may arise if, say, Type 6 and Type 9 regulated activities are conducted by the same individual at the same time. 4.4.4 RIs should ensure that all relevant individuals meet the competence requirements set out in the Guidelines on Competence. This means, among other things,  acquiring a recognised industry qualification, or possessing a degree8 in a designated field9 ; and  passing a local regulatory framework paper, unless the individual and the RI meet the exemption criteria

8 If an applicant who is a degree holder has attained a post-graduate diploma or certificate which is (a) issued by a university or other similar tertiary institution in Hong Kong or elsewhere; or (b) recognised as Level 6 or above under the Qualifications Framework in Hong Kong, then the post-graduate diploma or certificate will also be taken into account in assessing the applicant’s competence. 9 This refers to a degree in Accounting, Business Administration, Economics, Finance or Law, or a degree in another field but with passes in at least 2 courses in the designated fields, or an internationally recognized professional qualification in Law, Accounting or Finance.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 29 relating to experience, scope of activities, regulatory support from other personnel, internal control etc as stipulated in the Guidelines on Competence10 . 4.4.5 Some important points to note in relation to competence examinations:  RIs are required to ensure that an individual has passed the relevant industry and local regulatory framework papers before he can be engaged as a relevant individual, unless exempted as provided for in the Guidelines on Competence. Recognised industry qualification and local regulatory framework paper examinations should be completed not more than 3 years prior to the date of engaging in a regulated function of any regulated activity. Recognised industry qualification gained more than three years ago may be recognised if the individual has substantial relevant working experience and has remained in the industry or can prove recent licence or registration with a relevant regulator either in Hong Kong or elsewhere. Local regulatory framework paper examinations gained more than three years ago may also be recognised if the individual is or has been a relevant individual (or licensed representative) or an executive officer (or responsible officer) within the past three years for a regulated activity in which such local regulatory framework paper examinations are relevant.  Different regulated activities may require a pass in different papers of the recognised industry qualifications and the local regulatory framework papers, and additional examination requirements

10 In this case, the individual should also complete an additional 5 hours of continuous professional training on local regulatory knowledge in the relevant regulated activity on a one-off basis, either within the preceding 6 months or within 12 months after the exemption.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 30 where applicable. For details of the competence examination papers, refer to the Guidelines on Competence. 4.4.6 In line with the SFC’s treatment of licensed representatives, the HKMA will allow a six-month grace period for a relevant individual who has yet to pass the local regulatory framework paper but has otherwise satisfied the competence test. Such grace period should be regarded as a one-off concession and will not normally be allowed again in any future registration or application for consent to become executive officer, in respect of the same examination paper(s). In respect of these individuals, the relevant RI is responsible for:  ensuring such individuals have met all other requirements under the SFC Fit and Proper Guidelines;  keeping proper records indicating that such individuals are subject to the six-month grace period; and  ensuring that the aforesaid records are under regular and independent review (which may be performed by internal audit or compliance personnel) and that prompt action is taken to remove an individual from the HKMA Register if that individual cannot obtain a pass in the local regulatory framework paper by the end of the six-month grace period. 4.4.7 If an individual applies to be an executive officer for Type 6 regulated activity and intends to give advice on matters falling within the ambit of the Codes on Takeovers and Mergers and Share Buy-backs (“codes-related matters”), he must satisfy the HKMA that he has sufficient experience in this area. For this purpose, the HKMA will take into account the views of the SFC. If the applicant cannot satisfy the HKMA that he has sufficient experience in this area, the MA’s consent (if granted) will be subject to a condition that the applicant cannot act as a sole executive officer of the RI

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 31 in relation to codes-related matters. In the case where the applicant does not intend to give advice on codes-related matters, the MA’s consent (if granted) will be subject to a condition that the applicant cannot act as an executive officer to give advice on codes-related matters. Continuous professional training 4.4.8 To provide assurance that relevant individuals remain competent on a continuing basis, they should receive continuous professional training (“CPT”) in accordance with the Guidelines on Continuous Professional Training. A relevant individual needs to attain at least 10 CPT hours per calendar year (regardless of the number and types of regulated activities he engages in). In view of the higher level of responsibility and accountability placed on executive officers, they are required to take two additional CPT hours (i.e, at least 12 CPT hours per calendar year). These two CPT hours should cover topics relating to regulatory compliance. For details, refer to Guidelines on Continuous Professional Training. 4.4.9 Relevant individuals who are under temporary engagement or itinerant professionals are not required to fulfil the CPT requirements. 4.4.10 The HKMA will not seek to pre-endorse internal training organised by RIs. The HKMA will monitor compliance with the CPT requirements during on-site examinations of the regulated activities of RIs. 4.4.11 RIs are responsible for requiring their relevant individuals to update their knowledge and skills continuously through CPT in order to maintain their professional competence and to remain fit and proper. The HKMA will review the fitness and properness of RIs’ relevant individuals in on-site examinations, and may impose higher requirements on CPT hours for individual RIs if it considers this necessary. Setting up of policies and procedures and keeping of records

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 32 4.4.12 RIs should put in place adequate policies and procedures to ensure that their relevant individuals are and continue to be fit and proper, according to the Fit and Proper Guidelines, the Guidelines on Competence and the Guidelines on Continuous Professional Training. Controls should include, but are not limited to, the following:  The responsibilities of relevant individuals should be clearly defined and supported by up-to-date job descriptions, organisation charts and levels of authority.  The qualities required for individual positions in terms of skills, knowledge, experience, and training etc. should be clearly defined.  RIs should have clearly defined policies and procedures for satisfying themselves about the fitness and properness of relevant individuals at the time of appointment or recruitment. The possible assessment procedures include:  obtaining a self-declaration from the individual regarding such matters that will require notification to the HKMA as mentioned in subsection 5.5 below;  inspection of the individual’s original documents to evidence educational or professional qualifications (including, where applicable, evidence of having passed the relevant recognised industry qualification and local regulatory framework paper) and membership of any professional bodies or associations;  checking public records for evidence of public reprimands, disciplinary actions, personal bankruptcy and judgement debts (and, if the individual is currently a licensed representative

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 33 or a relevant individual, inspecting the SFC register or the HKMA Register respectively);  obtaining references from previous employers and from referees nominated by the individual; and  reviewing the record and past performance of the individual who is an existing employee.  RIs should maintain records and documentary evidence in relation to their assessment in determining how each relevant individual meets the requirements of the Guidelines on Competence. The records and documentary evidence should cover details (including the relevant dates) of the postsecondary education attained, professional and vocational courses attended and qualifications achieved, as well as employment history. These should be made available for inspection when required by the HKMA.  RIs should have clearly defined systems for appraising the performance of relevant individuals. Such systems should give due weight to compliance with internal guidelines and legal and regulatory requirements.  RIs should design and implement a continuous training programme that best suits the needs of their relevant individuals. This should be subject to annual evaluation with a view to prioritising the training needs of their relevant individuals.  Records and documentary evidence of attendance or completion of training should be maintained to record the CPT activities undertaken by each relevant individual. These should be kept for a minimum of 3 years and produced for inspection when required by the HKMA.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 34  There should be designated personnel responsible for ensuring all relevant individuals of the RI are fit and proper in accordance with regulatory requirements and internal guidelines.  RIs should have clearly defined policies and procedures for investigating apparent breaches of internal guidelines or legal or regulatory requirements by relevant individuals or complaints about the conduct of such individuals. In the course of such investigation, a RI should conduct a thorough assessment to determine whether the individual is fit and proper. The assessment should be properly documented. Any doubt about the individual’s fitness and properness should be cleared before he can be appointed as a relevant individual or allowed to carry on his existing duties as a relevant individual.  There should be clearly defined policies and procedures for taking internal disciplinary action where this is appropriate. 4.4.13 RIs should also refer to the circulars and guidance issued by the HKMA or the SFC from time to time for other recommended controls in relation to registration and ensuring fitness and properness of relevant individuals. 4.5 Know-your-customer and client agreement 4.5.1 Pursuant to paragraph 5.1 of the SFC Code, RIs should take all reasonable steps to establish the true and full identity of each of its clients, and of each client’s financial situation, investment experience, and investment objectives. Investor characterisation 4.5.2 Paragraph 5.1A of the SFC Code further requires that RIs should, as part of the know your client procedures, assess the client’s knowledge of derivatives and characterise the client based on his knowledge of derivatives, unless exemption applies. Where a client without knowledge of

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 35 derivatives wishes to purchase a derivative product and the RI has not solicited the client or made a recommendation to the client in relation to the proposed transaction, RIs should: (i) explain to the client the relevant risks associated with the product, if the product is traded on an exchange; or (ii) warn the client about the transaction and provide appropriate advice as to whether or not the transaction is suitable for the client in all the circumstances, if the product is not traded on an exchange. Customer risk profiling 4.5.3 In order to ensure investment recommendations or a complex product(s) are suitable for a customer, RIs should take into consideration the customer’s circumstances, e.g. information about investment objectives, investment experience and knowledge, financial situation, investment horizon and risk tolerance, etc. 4.5.4 For retail banking customers, the HKMA expects that the assessment of a customer’s risk profile in general should be carried out by non-sales staff, and the assessment process should be audio-recorded, unless otherwise exempted. Holistic assessment for vulnerable customers (VCs) 4.5.5 VCs are customers who have lower ability to understand the risks and withstand the potential losses of an investment. AIs are expected to exercise extra care when dealing with VCs and provide VCs with additional protection in certain circumstances (refer to paragraph 4.7.12 below). 4.5.6 In determining whether a customer is a VC, the principle is that AIs should consider holistically the circumstances of a customer to assess the degree of riskiness or vulnerability that a customer may not be able to understand the risk and withstand the potential losses of an investment (“VC Assessment”). Among the circumstances of a customer, the core considerations should be the level of financial sophistication (e.g. investment experience of the customer),

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 36 the state of mind (e.g. the ability of the customer to make investment decision), and the level of wealth of the customer which provides an indication on whether the customer could withstand the potential losses of an investment. 4.5.7 A suggested framework for VC Assessment for retail banking customers is set out in the HKMA’s circular “Investor Protection Measures in respect of Investment, Insurance and Mandatory Provident Fund Products” issued on 25.09.2019. In view of the different nature of the clientele and the mode of operations, AIs may use other frameworks for VC Assessment for non-retail banking customers (such as private banking customers) following the principle. Client agreement 4.5.8 Pursuant to paragraph 6.1 of the SFC Code, RIs should enter into a written agreement with each client before services are provided to the client, unless an exemption applies. Such written agreement should contain the minimum content as set out in paragraph 6.2 of the SFC Code, subject to the applicable provisions of the Code as mentioned therein. Pursuant to paragraph 6.5 of the SFC Code, a RI should not incorporate any clause, provision or term in the client agreement or in any other document signed or statement made by the client at the request of the RI which is inconsistent with its obligations under the SFC Code. RIs should refer to the SFC Code for the detailed requirements and guidance. 4.6 Product due diligence 4.6.1 In general, RIs should conduct adequate product due diligence and obtain a thorough understanding of the investment products they solicit or recommend to customers. RIs are also required to perform product due diligence for complex investment products where suitability obligations are triggered. 4.6.2 RIs may adopt a proportionate approach in conducting product due diligence and documenting the due diligence

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 37 work by having regard to the nature and extent of risks of the investment products. 4.6.3 Ongoing product due diligence is expected to be conducted at appropriate intervals having regard to the nature, features and risks of investment products, unless an exemption applies. 4.6.4 RIs and their relevant individuals should refer to the relevant guidance issued by the HKMA and the SFC, including those mentioned in paragraph 4.7.15. 4.7 Selling of investment products Suitability obligations 4.7.1 There are various regulatory requirements relating to selling practices promulgated by the HKMA and the SFC. Among them, paragraphs 5.2 and 5.5 of the SFC Code and HKMA’s circular “Requirements Applicable to Online and Offline Distribution of Non-SFO-Regulated Structured Investment Products” issued on 30.10.2018 corresponding to these paragraphs of the SFC Code for non-SFO￾regulated structured investment products set out suitability obligations:  Having regard to information about the client of which the RI is or should be aware through the exercise of due diligence, the RI should, when making a recommendation or solicitation, ensure the suitability of the recommendation or solicitation for that client is reasonable in all the circumstances; and  A RI providing services to a client in complex investment products (other than certain exchange-traded derivative products, non-leveraged currency-linked or interest rate￾linked deposits with standardised features) should ensure that – (i) a transaction in a complex investment product is suitable for the client in all the circumstances;

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 38 (ii) sufficient information on the key nature, features and risks of a complex investment product is provided so as to enable the client to understand the complex investment product before making an investment decision; and (iii) warning statements in relation to the distribution of a complex investment product are provided to the client in a clear and prominent manner. RIs should adopt a holistic approach when conducting suitability assessment, taking into account all relevant factors and circumstances of the client. 4.7.2 RIs can adopt a proportionate and risk-based streamlining approach (“Streamlined Approach”) compliance with suitability obligations under paragraphs 5.2 and 5.5(a) of the SFC Code when dealing with sophisticated professional investors (“SPI”), i.e. Individual PIs (see subsection 4.12.1) who meet the specified criteria on a higher level of financial means, knowledge or experience and investment objectives. Under the Streamlined Approach, point-of-sale procedures are simplified because through the “know your client” process at the outset, a RI could ascertain the customer’s financial situation, knowledge or experience and investment objectives and, hence, the RI is not required at a transaction level to match the SPI’s risk tolerance level, investment objectives and investment horizon, or to assess the SPI’s knowledge, experience and concentration risk. Explanation of product characteristics, nature and extent of risks could also be provided to the SPI upfront under the Streamlined Approach. A corporation which has as its principal business the holding of investments and is wholly owned by one or more SPI(s) may be treated the same as the SPI(s) for the purpose of the Streamlined Approach. Refer to the joint circular “Streamlined Approach for Compliance with Suitability Obligations when Dealing with Sophisticated Professional Investors” issued by the HKMA and the SFC on 28.07.2023 for detailed guidance.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 39 Derivative products 4.7.3 Paragraph 5.3 of the SFC Code requires a RI providing services to a client in derivative products, including futures contracts or options, or any leveraged transaction to assure itself that the client understands the nature and risks of the products and has sufficient net worth to be able to assume the risks and bear the potential losses of trading in the products. Disclosure 4.7.4 GP5 of the SFC Code sets out that RIs should make adequate disclosure of relevant material information in its dealings with its clients. RIs may vary their processes and provide product explanations in a proportionate and risk￾based manner having regard to the circumstances, such as the client’s financial markets sophistication and prior trading experience as well as product-specific complexity and risks. 4.7.5 Pursuant to paragraph 8.3A of the SFC Code, where a RI distributes an investment product to a client (including where it sells an investment product to or buys such product from the client), the RI should deliver transaction related information (including but not limited to monetary and non-monetary benefits) as set out in paragraph 8.3A of the SFC Code to the client prior to or at the point of entering into the transaction. 4.7.6 The SFC Handbook for Unit Trusts and Mutual Funds, Investment-Linked Assurance Schemes and Unlisted Structured Investment Products sets out the detailed product-specific requirements applicable to unit trusts and mutual funds, investment-linked assurance schemes and unlisted structured investment products. In particular, product summaries in the form of a Product Key Facts Statement (“Product KFS”) shall be prepared for all these products authorized by the SFC. Save as otherwise provided in the applicable product codes, the Product KFS shall be a part of the offering documents of the product.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 40 RIs, as distributors, should distribute both the Product KFS and the offering documents to customers prior to or at the point of sale. Regarding currency-linked instruments and interest rate-linked instruments issued by authorized institutions, authorized institutions are required to produce an Important Facts Statements for such instruments, to enhance product disclosure to retail customers purchasing such instruments. 4.7.7 In addition, according to the SFC Code on Unit Trusts and Mutual Funds, no application form may be provided to any member of the public unless it is accompanied by the offering document, as well as the scheme’s most recent audited annual report together with its interim report if published after the annual report. 4.7.8 The SFC Code on Unlisted Structured Investment Products imposes an obligation on issuers of unlisted structured investment products shall confer on investors a right in respect of such products offered to the public (except where the scheduled tenor is one year or less), whereby investors may cancel their orders, sell the product back or otherwise unwind the transaction, and receive a refund. The right is exercisable “post-sale”, i.e. for a period of at least 5 business days in Hong Kong after the investor places an order. Where an investment product confers a cooling-off or unwind right on the investor, and the investor exercises his right, the relevant intermediary who sells or distributes such a product shall promptly execute the instruction for the client and pass on to the client the full amount of refund (including the sales commission) received from the product issuer less a reasonable administrative charge. The sales commission should include the amount retained by the distributor in relation to that transaction and the administrative charge should be disclosed at or prior to the point of sale and should not contain any profit margin. To comply with such requirement, RIs are reminded to put in place proper systems and procedures to facilitate their clients to exercise their rights under such mechanism.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 41 4.7.9 In addition, the HKMA has introduced a number of investor protection measures for enhancing RIs’ sale process of investment products, including those promulgated in the HKMA’s circular “Investor Protection Measures in respect of Investment, Insurance and Mandatory Provident Fund Products” issued on 25.09.2019. Paragraphs 4.7.10 – 4.7.13 below are some key measures for retail banking customers: Physical segregation 4.7.10 Retail banks should ensure clear physical segregation between deposit-taking activities and investment activities in retail bank branches, so as to prevent any possible confusion of a retail banking customer in distinguishing between a deposit and an investment product. Audio-recording of face-to-face sale process 4.7.11 Retail banks should audio-record the face-to-face sale process for (i) distribution of / advice on complex investment products; or (ii) solicitation or recommendation of non-complex investment products, exchange-traded derivatives, or non-leveraged currency-linked or interest rate-linked deposits with standardised features, involving risk mismatch. This aims to maintain a proper record of the sale process to ensure adequate disclosure and suitability of investment recommendations or transactions. Precautionary measures for vulnerable or inexperienced customers 4.7.12 AIs are expected to be more vigilant in the dealing with more vulnerable or inexperienced customers, where appropriate. AIs should not entice vulnerable customers to make hasty investment decisions. Among others,  Retail banks should implement a Pre-Investment Cooling-off Period for sale of unlisted derivative products (excluding investment funds) and unlisted debentures with certain specified features, so as to allow retail banking customers with less sophistication at least 2 calendar days to understand and consider the

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 42 appropriateness of the proposed investment, and consult their family or friends before order placement; and  Retail banks should allow vulnerable customers to choose during the initial transaction whether they would like to (i) bring along a companion to witness the sale process and / or (ii) have a second front line staff member to handle the sale. The vulnerable customers can choose to have either, neither or both safeguards. 4.7.13 Taking into account supervisory experience, market condition and feedback from banking industry and bank customers, the HKMA refines the regulatory requirements and provides clarification to facilitate compliance as and when appropriate, provided that the over-arching principles of conduct supervision and investor protection are not compromised. 4.7.14 In order to assist licensed and registered persons to comply with the suitability obligations and product disclosure standards expected of them, the SFC issued the following Frequently Asked Questions:  “Frequently Asked Questions on Triggering of Suitability Obligations” issued on 23.12.2016  “Frequently Asked Questions on Compliance with Suitability Obligations by Licensed or Registered Persons (FAQs)” issued on 23.12.2016 (updated on 23.12.2020)  “Frequently Asked Questions on Guidelines on Online Distribution and Advisory Platforms (the Guidelines) and Paragraph 5.5 of the Code of Conduct” issued on 28.03.2018 (updated on 23.12.2020) Key relevant guidance issued by the HKMA includes:  “Investor Protection Measures in respect of Investment, Insurance and Mandatory Provident Fund Products” issued on 25.09.2019

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 43  “Frequently Asked Questions on Investor Protection Measures” issued on 23.12.2020 Product / service-specific guidance 4.7.15 The HKMA (in collaboration with the SFC where necessary) has also issued a number of circulars and guidelines to provide guidance to RIs on expected standards in selling certain specific investment products or providing certain services that warrant special attention, especially in relation to product due diligence, product risk disclosure and suitability assessment. For example:  HKMA’s circular “Guidance on Selling of Accumulators” issued on 14.03.2025 – Set out requirements on selling of accumulators and further guidance on FX accumulators.  Guidelines on Online Distribution and Advisory Platforms issued by the SFC and the HKMA’s circular “Requirements Applicable to Online and Offline Distribution of Non-SFO-Regulated Structured Investment Products” issued on 30.10.2018 – Set out principles and requirements applicable to online distribution and advisory platforms for investment products, including robo-advisory services operated by licensed or registered persons.  HKMA-SFC’s circular “Distribution of Insurance-linked Securities and Related Products” issued on 11.10.2021 – Reminds intermediaries to observe the requirements governing selling practices, including the suitability obligations and requirements for complex products, under the SFC Code when they distribute insurance-linked securities and related products.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 44  HKMA’s circular “Sale and Distribution of Debt Instruments with Loss-absorption Features and Related Products” updated on 21.10.2022 – Provides guidance on investor protection measures on sale and distribution of debt instruments with loss-absorption features and related products.  HKMA’s circular “Sale and Distribution of Green and Sustainable Investment Products” issued on 29.11.2023 – Shares with the industry the good practices observed in a recent review conducted by the HKMA on sale and distribution of green and sustainable investment products, and set out the expected standards in respect of sale and distribution of green and sustainable investment products by RIs.  HKMA-SFC “Joint circular on intermediaries’ virtual asset-related activities” issued on 22.12.2023 – Provides guidance for intermediaries which wish to engage in virtual asset-related activities, including (A) distribution of investment products with exposure to virtual assets, (B) provision of virtual asset dealing services, (C) provision of asset management services in respect of virtual assets, and (D) provision of virtual asset advisory services.  HKMA’s circular “Amendments to Implementation Arrangements for the Cross-boundary Wealth Management Connect Pilot Scheme in the Guangdong￾Hong Kong-Macao Greater Bay Area” issued on 24.01.2024 – Set out implementation arrangements for Cross￾boundary Wealth Management Connect between banks in the Mainland cities in the Greater Bay Area and banks in Hong Kong.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 45 4.8 Corporate finance advisory activities and bookbuilding and placing activities in equity capital market and debt capital market transactions 4.8.1 The main regulatory requirements are set out in the Corporate Finance Adviser Code of Conduct, the Codes on Takeovers and Mergers and Share Buy-backs and the SFC Code. 4.8.2 Corporate Finance Advisers engaging in corporate finance advisory work under the Listing Rules, the Takeovers Code or the Share Repurchase Code are required to observe the specific requirements under the respective codes and rules as regards their conduct. 4.8.3 The Corporate Finance Adviser Code of Conduct sets out the standards for RIs engaging in Type 6 regulated activity (Corporate Finance Advisers) on:  conduct of business;  competence;  conflicts of interest;  standard of work;  duties to the client;  communications with regulators; and  personal account dealings. RIs should refer to the Corporate Finance Adviser Code of Conduct for the requirements and guidelines in respect of the conduct of Corporate Finance Advisers. 4.8.4 Corporate Finance Advisers must act with due skill, care and diligence and observe proper standards of market conduct. 4.8.5 Corporate Finance Advisers should maintain proper books and records, and be able to provide a proper trail of work done upon request.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 46 4.8.6 The Codes on Takeovers and Mergers and Share Buy￾backs provide a framework for takeover, merger, privatisation and share buy-back activities affecting public companies. It is part of the financial and other professional advisers’ responsibility to use all reasonable efforts to ensure that their customers understand, and abide by, the requirements of the Codes on Takeovers and Mergers and Share Buy-backs. 4.8.7 Under the Codes on Takeovers and Mergers and Share Buy-backs, RIs advising on corporate finance should seek to afford fair treatment for shareholders who are affected by takeovers, mergers and share buy-backs. The Codes on Takeovers and Mergers and Share Buy-backs are designed to achieve fair treatment by:  requiring equality of treatment of shareholders;  mandating disclosure of timely and adequate information to enable shareholders to make an informed decision as to the merits of an offer; and  ensuring there is a fair and informed market in the shares of companies affected by takeovers, mergers and share buy-backs. 4.8.8 RIs engage in providing services to issuers, investors or both in respect of an offering of shares or debt securities and involve bookbuilding activities; placing activities; or advising, guiding and assisting the issuer client in those bookbuilding and placing activities conducted in Hong Kong (referred as “capital market intermediary” (“CMI”)), as defined in the SFC Code, should comply with paragraph 21 of the SFC Code. Paragraph 21 of the SFC Code sets out the standards of conduct expected of a CMI in a share or debt offering. CMIs are also reminded to fulfil their obligations under applicable laws, rules and regulations, including properly addressing actual and potential conflicts of interest, ensuring the fair treatment of both their issuer client and investor clients, and upholding the integrity of the market at all times. Senior management of a CMI should

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 47 establish and implement adequate and effective policies, procedures and controls to ensure compliance with the rules and regulations which are applicable to the roles they play in an offering. 4.9 Asset management 4.9.1 The main regulatory requirements are set out in the Fund Manager Code of Conduct. It sets out conduct requirements for persons whose business involves the management of collective investment schemes and/or discretionary accounts (in the form of an investment mandate or pre-defined model portfolio). Fund managers are also required to comply with the SFC Code and other applicable codes and guidelines in force from time to time. In particular, fund managers managing SFC-authorized collective investment schemes are required to comply with SFC Handbook for Unit Trusts and Mutual Funds, Investment-Linked Assurance Schemes and Unlisted Structured Investment Products. In case of any inconsistency among the SFC Code, the Fund Manager Code of Conduct and other applicable codes or guidelines, the more stringent provision will apply. 4.9.2 Key requirements of the Fund Manager Code of Conduct include:  system of functional barriers to prevent the flow of confidential or price-sensitive information between different areas of operations;  proper segregation of duties;  effective arrangements to identify, prevent, manage and monitor any actual or potential conflicts of interest;  internal rules on personal account dealing to give customers priority and to avoid conflicts of interest;  ensuring transactions are in accordance with the portfolio’s stated investment strategy, objectives, investment restrictions and guidelines;

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 48  best execution of fund orders, fair and prompt order allocation and sufficient safeguarding of customer assets;  prohibition on insider dealing;  taking into account the fund’s stated objectives and not trading excessively on behalf of a fund; and  requirements on transactions with connected persons and cross trades between house accounts and client accounts, and between client accounts. 4.9.3 The Fund Manager Code of Conduct also stipulates other requirements covering organisation and resources, responsibilities of management, risk management, compliance, records, audits, portfolio valuation, reconciliation, dealing with fund and fund investors, delegation and custody, marketing activities, fees and expenses and specific requirements for discretionary accounts such as client agreement, performance review and valuation reports. RIs should refer to the Fund Manager Code of Conduct for the detailed requirements and guidelines. 4.10 Back-office functions Order execution and safekeeping of client assets 4.10.1 RIs should take all reasonable steps to execute promptly client orders in accordance with clients’ instructions, and should execute client orders on the best available terms when acting for or with clients. 4.10.2 RIs should have appropriate controls with respect to access to systems, where such systems are used to transmit important information, e.g. funds transfer instructions, settlement instructions and trade confirmations. 4.10.3 RIs should, in the handling of client transactions and client assets, act to ensure that client assets are accounted for properly and promptly. Where the RI or a third party on behalf of the RI is in possession or control of client positions

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 49 or assets, the RI should ensure that client positions or assets are adequately safeguarded. 4.10.4 RIs should ensure that appropriate and effective procedures are established and followed to protect the institution’s and its clients’ assets from theft, fraud and other acts of misappropriation. In particular, the authority of the firm and its staff to acquire, dispose of and otherwise move or utilise the institution’s or its clients’ assets is clearly defined and followed. 4.10.5 RIs should also comply with the Securities and Futures (Client Securities) Rules, which prescribe the manner in which RIs must treat and deal with client securities and securities collateral received or held in Hong Kong in relation to the conduct of a regulated activity, and “The Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission”. The SFC has issued a guideline “Suggested Control Techniques and Procedures for Enhancing a Firm’s Ability to Comply with the Securities and Futures (Client Securities) Rules and the Securities and Futures (Client Money) Rules”. RIs should adopt those suggested controls relevant to compliance with the Securities and Futures (Client Securities) Rules. Provision of trade documents and keeping of records 4.10.6 In accordance with the Securities and Futures (Contract Notes, Statements of Account and Receipts) Rules, RIs should provide specified documents, e.g. statements of account, contract notes, receipts to clients to inform them of transactions undertaken and / or assets held for them within specified time periods. 4.10.7 RIs should also keep specified records in relation to regulated activities as required in the Securities and Futures (Keeping of Records) Rules. 4.11 Controls, monitoring and supervision

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 50 4.11.1 RIs should have adequate management supervision of the sale of investment products to ensure compliance with all applicable laws and regulations. They should compile proper management information system (“MIS”) reports to draw senior management’s attention to risks or non￾compliance, and conduct effective regular compliance reviews. The approach and sampling methodology should be commensurate with the risks. 4.11.2 Compliance function should play a robust role in ensuring that the RI is in compliance with the statutory provisions, regulatory requirements and applicable codes of conduct, monitoring and testing compliance, and reporting regularly to senior management on compliance matters. 4.11.3 RIs should also ensure adequate coverage of review in respect of regulated activities by internal audit function. Conflicts of interest 4.11.4 RIs should have policies and procedures, and maintain system of functional barriers to address potential conflicts of interest arising from, for example, carrying on more than one type of regulated activities concurrently; and ensure that price-sensitive information privy to the research staff or staff handling corporate finance matters should not be available to staff outside those departments, except on a “need to know” basis. 4.11.5 Where a RI (and its relevant individuals) has a material interest in a transaction with or for a client or a relationship which gives rise to an actual or potential conflict of interest in relation to the transaction, it should neither advise, nor deal in relation to the transaction unless it has disclosed that material interest or conflict to the client and has taken all reasonable steps to ensure fair treatment of the client. Refer to paragraphs 10.1 and 10.2 of the SFC Code for detailed requirements on conflicts of interest. Employee dealings

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 51 4.11.6 RIs should have a policy which has been communicated to employee in writing on whether employees are permitted to deal or trade for their own accounts in securities or futures contracts. Refer to paragraph 12.2 of the SFC Code for detailed requirements. Complaints handling 4.11.7 RIs should have written policies and procedures to ensure that client complaints related to regulated activities are handled in a timely and appropriate manner. Senior management of RIs should be responsible for ensuring effectiveness of the complaints handling and redress mechanisms. Refer to Supervisory Policy Manual module IC-4 “Complaints Handling and Redress” and paragraph 12.3 of the SFC Code for detailed requirements. 4.12 Professional investors 4.12.1 “Professional Investor” (“PI”) is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance. It includes: (a) specified entities set out in paragraphs (a) to (i) of the definition (e.g. banks and insurance companies). These PIs are referred as Institutional PIs in the SFC Code; and (b) persons of a class which is prescribed by the Securities and Futures (Professional Investor) Rules (under paragraph (j) of the definition). These PIs can be further categorised into:  Corporate PIs - trust corporations, corporations or partnerships falling under §§4, 6 and 7 of the Securities and Futures (Professional Investor) Rules; and  Individual PIs - individuals falling under §5 of the Securities and Futures (Professional Investor) Rules.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 52 4.12.2 Some legal restrictions imposed by the Securities and Futures Ordinance and Companies (Winding Up and Miscellaneous Provisions) Ordinance do not apply to licensed or registered persons in dealing with PIs, for example:  For investment products regulated under the Securities and Futures Ordinance offered to PIs only, the products and offer documents are exempt from authorisation from the SFC. This is usually referred to as “private placement”.  Unsolicited calls to PIs are exempt from the prohibition under §174 of the Securities and Futures Ordinance.  The Securities and Futures (Contract Notes, Statements of Account and Receipts) Rules allow exemptions (subject to satisfying the specified prerequisites) for certain requirements when clients are PIs.  Prospectuses related to offers of any shares in or debentures of a company to PIs are excluded from the requirements on prospectuses as prescribed in Companies (Winding Up and Miscellaneous Provisions) Ordinance. 4.12.3 Exemptions are provided to different categories of PIs to different extent:  Institutional PIs – Licensed or registered persons dealing with Institutional PIs are automatically exempt from the provisions set out in paragraphs 15.4 and 15.5 of the SFC Code.  Corporate PIs – Should licensed or registered persons wish to be exempt from the provisions set out in paragraph 15.4 of the SFC Code, they should observe the assessment requirements set out in paragraph 15.3A (e.g. appropriate corporate structure and investment process and controls; and sufficient investment background of the person(s) responsible for

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 53 making investment decisions) and comply with paragraph 15.3B (procedural requirements) of the SFC Code. Should licensed or registered persons wish to be exempt from the provisions set out in paragraph 15.5 of the SFC Code only, they should just comply with paragraph 15.3B of the SFC Code.  Individual PIs – Only provisions set out in paragraph 15.5 of the SFC Code can be exempt. Should licensed or registered persons wish to be exempt from the provisions set out in paragraph 15.5 of the SFC Code only, they should comply with paragraph 15.3B of the SFC Code. 4.12.4 Paragraph 15.4 of the SFC Code specifies those provisions of the SFC Code that may be exempt when dealing with Corporate PIs where RIs have complied with paragraphs 15.3A and 15.3B of the SFC Code and Institutional PIs, including the suitability obligations under paragraphs 5.2 and 5.5 of the SFC Code. Paragraph 15.5 of the SFC Code specifies provisions of the SFC Code that may be exempt when dealing with Corporate PIs and Individual PIs where RIs have complied with paragraph 15.3B of the SFC Code and Institutional PIs, such as informing clients the identity and status of employees of the licensed or registered person, and confirming with clients promptly essential features of a transaction. 4.12.5 A proportionate and risk-based streamlining approach is in place for RIs to comply with suitability obligations under paragraphs 5.2 and 5.5(a) of the SFC Code when dealing with Individual PIs who meet the specified criteria on a higher level of financial means, knowledge or experience and investment objectives, refer to paragraph 4.7.2 above. 4.13 Client Identity Rule Policy 4.13.1 This policy explains the client identity rule in paragraph 5.4 of the SFC Code. RIs should make reasonable efforts to establish and record the identity of customers (and the

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 54 ultimate beneficial owners of accounts, if different) before entering into any transactions on their behalf. They should also provide the SFC, or the exchanges in Hong Kong (“the regulators” for this purpose) with this information within two business days if the regulators so request. 4.13.2 RIs should refuse the business of those persons who are not prepared to provide the client identity information to the regulators as requested under the policy. 4.14 Providing depositary services for SFC-authorized collective investment schemes 4.14.1 RIs carrying on Type 13 regulated activity should ensure compliance with all applicable requirements, including the Securities and Futures (Client Securities) Rules, the Securities and Futures (Keeping of Records) Rules, and Schedule 11 to the SFC Code which sets out additional requirements on management and supervision as well as operational controls and compliance for depositaries of Type 13 regulated activity. 4.15 Other major requirements for regulated activities 4.15.1 In the conduct of regulated activities, RIs and their relevant individuals are also governed by the following statutory requirements:  Part VII of the Securities and Futures Ordinance -  rules and codes for business conduct in relation to regulated activities which are made by the SFC under §§168 and 169 respectively;  rules on the requirements for options trading made by the SFC under §173;  restrictions on short selling (§§170, 171 and 172);  restrictions on unsolicited calls (§174); and  prohibition on certain representations (§176).

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 55 Refer to the HKMA’s circular “Calls in Relation to Securities or Futures Products and Services” dated 13.01.2003 for specific guidance on the restrictions on unsolicited calls.  Rules made by the SFC under §397 of Part XVI of the Securities and Futures Ordinance. For example – Securities and Futures (Licensing and Registration) (Information) Rules: – The rules supplement the regulatory regime in Part V of the Securities and Futures Ordinance. The rules aim to ensure that the SFC and the HKMA are provided with information required for proper consideration of applications under Part V of the Securities and Futures Ordinance, and that the information provided is updated to reflect major changes that occur. To ensure compliance, RIs should study the relevant rules in detail and seek legal advice on the precise interpretation where necessary. 4.15.2 Under Part VIII, §180 of the Securities and Futures Ordinance, the MA as the relevant authority can authorize a person in writing to: (a) enter the premises of a RI or its associated entity; (b) inspect and make copies of records and documents relating to: – the business, or any transaction or activity undertaken in the course of (or which may affect) the business, conducted by the RI or the associated entity, or – any transaction carried out by a related corporation of the RI or the associated entity; and

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 56 (c) make inquiries of the RI or the associated entity (or a related corporation of the RI or the associated entity) concerning: – any record or document referred to in (b), or – any transaction or activity undertaken in the course of, or which may affect, the business conducted by the RI or the associated entity. The purpose is to ascertain whether a RI or its associated entity complies with the applicable requirements in §180(2) of the Securities and Futures Ordinance. 4.15.3 While the SFC relies on the HKMA for the day-to-day supervision of the regulated activities of RIs, it may commission an investigation of matters relating to a RI under §182 of the Securities and Futures Ordinance, including where it:  has reasonable cause to believe that: (a) an offence under any of the relevant provisions (as defined in Schedule 1 to the Securities and Futures Ordinance) may have been committed; (b) a person may have engaged in defalcation, fraud, misfeasance or other misconduct in connection with – (i) dealing in any securities or futures contract; (ii) the management of investment in any securities or futures contract; (iii) offering or making any structured product or collective investment scheme; or (iv) giving advice in relation to the allotment of securities, or the acquisition or disposal of, or investment in, any securities, structured product, futures contract, or an interest in any securities, structured product, futures contract or collective investment scheme;

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 57 (c) market misconduct may have taken place; or (d) a person’s conduct of any of the activities referred to in (b)(i) to (iv) is not in the interest of the investing public or in the public interest;  has reason to inquire whether any RI or relevant individual is or was at any time guilty of misconduct, or is not fit and proper to engage in regulated activities;  has reason to inquire whether any condition under §104, §104A or §105 is being complied with; or  decides to provide assistance to regulators outside Hong Kong under §186 in respect of the above matters. Pursuant to §182(4) the SFC shall undertake prior consultation with the MA in respect of any investigation to inquire whether any RI or relevant individual is or was at any time guilty of misconduct, or is not fit and proper to engage in regulated activities. 4.15.4 RIs should also ensure compliance with the following key codes, guidelines and guidance issued by the SFC:  Guidelines on Online Distribution and Advisory Platforms;  Guidelines for the Regulation of Automated Trading Services;  Corporate Finance Adviser Code of Conduct;  Codes on Takeovers and Mergers and Share Buy￾backs;  Fund Manager Code of Conduct;  Code of Conduct for Persons Providing Credit Rating Services; and  Circular to Product Providers of SFC-authorized unit trusts and mutual funds, SFC-authorized investment￾linked assurance schemes and SFC-authorized

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 58 unlisted structured investment products – Guidance on Internal Product Approval Process issued on 30.04.2014 (updated on 04.03.2016), in so far as a RI is a relevant product provider. The SFC has also issued, and issues from time to time, other guidelines, circulars and Frequently Asked Questions to provide guidance on expected standards in conducting various regulated activities. RIs and their relevant individuals are advised to regularly visit the SFC’s website for updates on regulatory requirements. 4.16 Regulatory requirements for prevention of money laundering and terrorist financing 4.16.1 In addition to the Anti-Money Laundering and Counter￾Terrorist Financing Ordinance and the HKMA’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions), RIs and associated entities that are AIs are required to have regard to paragraph 4.1.6 of the SFC’s Guideline on Anti-Money Laundering and Counter Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) (the “Guideline”) for the definition of “customer” for the securities, futures and leverage foreign exchange businesses (hereafter collectively referred to as “securities sector”), paragraph 4.20 of the Guideline for the provision on cross-border correspondent relationships applicable to the securities sector, Chapter 12 of the Guideline for the provisions in relation to virtual assets, and Appendix B to the Guideline for illustrative indicators of suspicious transactions and activities in the securities sector. 5. Reporting of certain events 5.1 Under §135 of the Securities and Futures Ordinance, a RI is required to notify both the SFC and the HKMA in writing of the following events and within the specified time limits:

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 59  at least 7 business days’ advance notice of any intended cessation of any regulated activity;  at least 7 business days’ advance notice of any intended change of address at which it proposes to carry on any regulated activity; and  a notice (together with full description of the change) within 7 business days of any change in the information as specified in Part 2 of Schedule 3 to the Securities and Futures (Licensing and Registration)(Information) Rules. 5.2 Also, pursuant to §135 of the Securities and Futures Ordinance, an AI (regardless of whether it is a RI or not), where it is a substantial shareholder of a licensed corporation, is required to give a notice in writing (together with full description of the change) to the SFC within 7 business days of any change in the information as specified in Part 4 of Schedule 3 to the Securities and Futures (Licensing and Registration)(Information) Rules. The AI concerned should also report the information to the HKMA in parallel. 5.3 It should be noted that some of the rules made under the Securities and Futures Ordinance contain the specific requirement of notifying the SFC of a breach of certain provisions in such rules. AIs should study all the applicable rules to ensure compliance with their reporting obligations. 5.4 Every AI should notify the HKMA as soon as practicable of the breach of any provision of the Banking Ordinance (including its subsidiary legislation), and the Securities and Futures Ordinance (including its subsidiary legislation), where the breach is committed by:  the AI itself being an intermediary or an associated entity of another intermediary; or  its associated entity. 5.5 In line with the reporting requirements imposed by the SFC on licensed representatives under the Securities and Futures (Licensing and Registration)(Information) Rules, RIs are required to

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 60 notify the HKMA in writing within 7 business days upon knowledge of certain information (including any subsequent changes) of any of their relevant individuals. The required information is on whether or not the person is or has been, in Hong Kong or elsewhere:  convicted of or charged with any criminal offence (other than a minor offence11) whether or not evidence of such conviction is admissible in proceedings in Hong Kong or elsewhere;  subject to any disciplinary action or investigation 12 by a regulatory body13 or criminal investigatory body14 (as the case may be);  subject to any order of the court or other competent authority for fraud, dishonesty or misfeasance;  a substantial shareholder or director of a corporation or business that is or has been subject to any disciplinary action or investigation12 by a regulatory body13 or criminal investigatory body14 (as the case may be), or involved in the management of such corporation or business;

11 “Minor offence” means an offence punishable by a fixed penalty under the Fixed Penalty (Traffic Contraventions) Ordinance (Cap. 237), the Fixed Penalty (Criminal Proceedings) Ordinance (Cap. 240) or the Fixed Penalty (Public Cleanliness Offences) Ordinance (Cap. 570), or offence of a similar nature committed in a place outside Hong Kong. 12 Subsection 5.5 does not include disclosure of information concerning an ongoing criminal investigation by a regulatory body or criminal investigatory body if such disclosure is prohibited by any statutory provision in Hong Kong or elsewhere. RIs are however required to notify the HKMA of the results of the investigation with 7 business days after they become aware of the completion of such criminal investigation. 13 For this purpose, “regulatory body” includes the SFC, the MA, a recognized exchange company (as defined in Schedule 1 to the Securities and Futures Ordinance), any professional body or association, an examination authority, an inspector appointed under any enactment, and other equivalent bodies or persons, in Hong Kong or elsewhere. 14 “Criminal investigatory body” means the Hong Kong Police Force and the Independent Commission Against Corruption established under §3 of the Independent Commission Against Corruption Ordinance (Cap. 204), and public bodies in Hong Kong or elsewhere carrying out criminal investigations.

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 61  a substantial shareholder or director of a corporation or business that is or has been subject to any order of the court or other competent authority for fraud, dishonesty or misfeasance, or involved in the management of such corporation or business;  engaged in any judicial or other proceedings;  a party to a scheme of arrangement, or any form of compromise, with his creditors;  in default of compliance with any judgement or court order;  a substantial shareholder or director of a corporation or business which was wound up otherwise than by way of a member’s voluntary winding up, or involved in the management of such corporation or business;  a partner of a firm which was dissolved other than with the consent of all the partners;  bankrupt or aware of the existence of any matters that might render him insolvent or lead to the appointment of a provisional trustee of his property under the Bankruptcy Ordinance (Cap. 6);  refused or restricted from the right to carry on any trade, business or profession for which a specific licence, registration or other authorization is required by law;  a substantial shareholder or director of a corporation that has been refused or restricted from the right to carry on any trade, business or profession for which a specific licence, registration or other authorization is required by law, or involved in the management of such corporation;  disqualified from holding the office of director; or  a patient as defined in §2 of the Mental Health Ordinance (Cap. 136). 5.6 RIs should also refer to the SFC Circular “Circular to intermediaries regarding compliance with notification requirements” (issued on

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 62 11.05.2015) and its further guidance, for example,“Circular to intermediaries on compliance with notification requirements” (issued on 01.06.2018), which elaborate the SFC’s and the HKMA’s expectation on how RIs should comply with notification requirements under the Securities and Futures Ordinance, the Securities and Futures (Licensing and Registration) (Information) Rules and the SFC Code. Among others, a RI should notify the SFC and the HKMA of an event where:  it directly involves the RI or any of its relevant individuals and may have an impact on the fitness and properness of the RI and any of its relevant individuals;  it may have a significant impact on the operations or viability of the RI’s corporate group as a whole;  it arises from a material failure of systems and controls that are applicable to the RI, even if the failure occurred outside of Hong Kong to other group entities;  the RI introduces changes to its business activities to provide robo-advisory financial services; or  the RI intends to engage in any activities involving virtual assets (which include the provision of dealing and advisory services in VA-related products, and virtual assets, as well as VA asset management services), or intends to make any changes to these activities conducted (including changes in the type of clientele served). Also, pursuant to paragraph 12.5 of the SFC Code, RIs are expected to report to the SFC and the HKMA immediately upon the happening of any one or more of the events, including any actual or suspected material breach, infringement of or non-compliance with any law, rules and codes administered by the SFC, as well as rules or requirements of other regulatory authorities. 5.7 Where there are changes in a RI’s organisation chart or its management principally responsible for its businesses that constitute regulated activities, the RI should report such changes to the HKMA and the SFC within 14 days as further detailed in the

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 63 HKMA’s circular “Management Accountability at Registered Institutions” dated 16.10.2017. 5.8 RIs should have procedures and systems in place to meet the reporting requirements. It is expected that corporate groups should have effective internal systems and controls in place to ensure appropriate dissemination of relevant information to the RI from other group entities, wherever located. Besides, the requirements under subsection 5.5 above should be clearly communicated to all relevant individuals. 6. Disciplinary actions 6.1 Disciplinary actions in respect of RIs, their relevant individuals and persons involved in the management of their regulated activities are set out in Part IX of the Securities and Futures Ordinance and §§58A and 71C of the Banking Ordinance. 6.2 Under Part IX of the Securities and Futures Ordinance, the SFC may exercise any of the following powers where the above persons are or were at any time guilty of misconduct or considered to be not fit and proper:  revocation or suspension of registration for all or part of the regulated activities (only applicable to RIs);  public or private reprimand;  prohibition from applying for licence or registration;  prohibition from applying for approval as an executive officer of a RI or a responsible officer of a licensed corporation (only applicable to individuals);  prohibition from having his name entered in the HKMA Register (only applicable to individuals); and  ordering the paying of a pecuniary penalty. 6.3 §§58A and 71C of the Banking Ordinance empower the MA to impose any of the following disciplinary sanctions on a relevant

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 64 individual (including executive officer) who is or was at any time guilty of misconduct or considered to be not fit and proper, or on an executive officer who is no longer considered to have sufficient authority within a RI to act in such capacity:  removal or suspension of all or part of the relevant individual’s information contained in the HKMA Register. This in effect prohibits the individual from engaging in any regulated function of any regulated activity of the RI, either permanently or temporarily; and  in the case of an executive officer, withdrawal or suspension of the consent given by the MA. 6.4 The SFC and the MA are subject to the following statutory procedural requirements for the exercise of the above powers:  before the exercise of any of such powers, the other regulator will be consulted and the person concerned will be given a reasonable opportunity to be heard; and  where the regulator decides to exercise the relevant power, the person concerned will be informed of the decision by written notice. 6.5 Where the SFC or the MA has exercised the above powers, the SFC or the MA may disclose to the public details of the decision made, the reasons for which the decision was made, and any material facts relating to the case. 6.6 It is essential for the senior management of RIs to draw to the attention of their relevant individuals and persons involved in the management of the regulated activities that they shall be personally and legally liable to these disciplinary sanctions if they are found guilty of misconduct and / or considered to be not fit and proper. 6.7 The Securities and Futures Appeals Tribunal (“SFAT”) has jurisdiction to review all decisions about disciplinary actions made by the MA and the SFC in respect of the regulated activities of RIs and their relevant individuals, upon appeal by the latter. The SFAT shall have at its disposal the full range of disciplinary sanctions

Supervisory Policy Manual SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions V.4 – 12.09.25 65 administered by both regulators in considering an appeal. Being the single appellate body, the SFAT will ensure consistency in the nature and degree of disciplinary sanctions applied by the regulators in similar circumstances. ————————— Contents Glossary Home Introduction