The Securities and Futures Commission (SFC) recognises that outsourcing back office functions to third party service providers might involve records or documents being kept by the third party.

If a licensed corporation keeps the records or documents required under the SFO or the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Regulatory Records) exclusively with a third party service provider, approval under section 130 of the SFO in respect of the premises of the service provider is required. Approval of the service provider’s premises is not necessary if the licensed corporation keeps the original documents at its approved premises and sends imaged records or data to the service provider for processing (with the processed data also being maintained by the licensed corporation); or identical electronic records or documents are kept contemporaneously both at the premises of the service provider and the approved premises of the licensed corporation.

The same applies regardless of whether the premises of the service provider at which the records or documents are kept are located in Hong Kong or elsewhere. For keeping records and documents at premises outside Hong Kong, please refer to Q3.

Licensed corporations are reminded that these outsourcing arrangements do not in any manner alter the obligations of a licensed corporation to keep at all times all Regulatory Records at the premises that have been approved by the SFC under section 130 of the SFO.

Licensed corporations are also reminded of their obligation to notify the SFC of such outsourcing arrangements in compliance with the Securities and Futures (Licensing and Registration)(Information) Rules.

You will need to seek approval for the premises of each branch office in Hong Kong if Regulatory Records are being kept at, or can be accessed from, such premises. This is so even for those licensed corporations which transfer all of their records from branches to the head office because it is likely that at some point in time, there may be records kept by the branch but not by the head office.

It is not the SFC’s usual practice to approve premises outside Hong Kong for the keeping of Regulatory Records under section 130 of the SFO.

The SFC will generally only approve premises that are located in Hong Kong because section 130 of the SFO must be read in the light of the SFC’s related powers under Parts VI and VIII of the SFO and the related obligations of licensed corporations in respect of the keeping of their records. By way of example, the SFC has the power under Part VIII of the SFO to enter premises to inspect the records of an intermediary, but would be precluded from exercising this power in the event of the premises being located outside Hong Kong. Further, the Securities and Futures (Keeping of Records) Rules stipulate the records that must be kept by intermediaries and that they must be kept in a manner that will enable an audit to be conveniently and properly carried out.

The SFC considers that, in the event of it approving premises outside Hong Kong under section 130 of the SFO, these types of powers and obligations could be undermined. Accordingly, the SFC insists that all Regulatory Records must be kept at approved premises in Hong Kong unless they are Regulatory Records in electronic form kept by an electronic data storage provider (EDSP) or an affiliate of the licensed corporation.

Data centres at which licensed corporation’s electronic Regulatory Records are exclusively kept are required to be approved by the SFC under section 130 of the SFO regardless of whether they are located in Hong Kong. This requirement applies to data centres used by an EDSP engaged by a licensed corporation or its affiliate as well as to an affiliate’s own data centres. Approvals may be given subject to any condition imposed under section 403 of the SFO, including the condition that all physical records or documents are kept in approved premises in Hong Kong.

For details, please refer to the Circular on the use of external electronic data storage dated 31 October 2019 and the FAQs on the use of external electronic data storage dated 10 December 2020.

If an EDSP does not disclose the addresses of its data centres for security or other reasons, the licensed corporation should at least provide the jurisdictions in which the data centres are located for the SFC’s approval. Similarly, if an affiliate does not disclose the addresses of its data centres or the data centres of the EDSPs engaged by it, the licensed corporation should at least provide the address of the premises used by the affiliate for approval.

The SFO and its related rules do not prescribe the type of office from which a licensed corporation must operate. However, the business premises that a corporation chooses must be suitable for the business activities that it has been licensed under the SFO to carry on.

Licensed corporations must ensure, at all times, that their office arrangements are suitable. This is a continuing obligation and any failure to comply with it will give rise to concerns on the part of the SFC and might result in the SFC taking regulatory action.

Generally speaking, the SFC expects licensed corporations to carry on business from a “fixed abode” and discourages frequent changes of office location.

As a matter of principle, a licensed corporation should satisfy itself that the business premises occupied by it are appropriately secured and that confidential or non-public information (such as price sensitive information) and client privacy will be sufficiently safeguarded against unauthorised access or leakage.

The SFC does not distinguish business centres or shared offices from other types of business accommodation. However, the following factors would suggest that the premises are likely to be unsuitable:

• where there is no secured and properly segregated office area, which is able to be locked and which is designated for the corporation’s own and exclusive use, and in which its business records, particularly those relating to clients, are able to be securely held;
• where essential office equipment and telecommunication systems are installed in such a way that they are not situated within an enclosed area that is secure and accessible only by the corporation’s staff and authorised personnel;
• where no or insufficient measures are taken to prevent confusion that might be caused to clients by the existence of other business entities occupying the same premises;
• where the nature of the corporation’s business demands frequent face-to-face dealings or meetings with clients at the corporation’s premises, during which client information and instructions are likely to be exchanged, and practical difficulties exist for the corporation to ensure confidentiality during such meetings; or
• where the corporation has not ensured that its office premises will always be accessible for all formal regulatory visits, including investigations and inspections.

Although the above factors are considered by the SFC to be of principal concern in respect of the appropriateness or otherwise of business premises occupied by licensed corporations, they should not be considered to constitute an exhaustive list because circumstances might exist in certain situations that give rise to particular accommodation needs or requirements.

Licensed corporations have an ongoing obligation to anticipate such matters and to ensure that their business premises are, at all times, suitable for the purposes for which they are being used.