If a licensed corporation outsources some of its back office functions to a third party service provider such as data processing function, does it need to apply for approval under section 130 of the SFO in respect of the premises of that service provider for keeping records or documents? What if some of the records or documents of the licensed corporation are kept outside Hong Kong by that service provider?
The SFC recognises that outsourcing back office functions to third party service providers might involve records or documents of the licensed corporations being kept by the service providers.
If the licensed corporation keeps its records or documents exclusively with the third party service provider, approval under section 130 of the SFO in respect of the premises of the service provider is required. Approval of the service provider’s premises is not necessary if the licensed corporation keeps the original documents at its approved premises and sends imaged records or data to the service provider for processing (with the processed data also being maintained by the licensed corporation); or identical electronic records or documents are being contemporaneously kept both at the premises of the service provider and the approved premises of the licensed corporation.
The same applies regardless of whether the premises of the service provider at which the records or documents are kept are located in Hong Kong or elsewhere. For keeping of records and documents at premises outside Hong Kong, please refer to Q3.
Licensed corporations are reminded that these outsourcing arrangements do not in any manner alter the obligations of a licensed corporation to keep at all times all required records or documents at the premises that have been approved by the SFC under section 130 of the SFO.
Licensed corporations are also reminded of their obligation to notify the SFC of such outsourcing arrangements in compliance with the Securities and Futures (Licensing and Registration)(Information) Rules.
If a licensed corporation sets up new branches, does it need to apply for approval under section 130 of the SFO in respect of the premises of each branch?
You will need to seek approval for the premises of each branch office in Hong Kong if records or documents are being kept at, or can be accessed from, such premises. This is so even for those licensed corporations which transfer all their records from the branches to the head office because it is likely that at some points in time, there may be records kept by the branch but not in the head office.
Certain records or documents of a licensed corporation are required to be kept at the premises approved by the SFC under section 130 of the SFO. Will the SFC approve premises outside Hong Kong under section 130 of the SFO?
It is not the SFC’s practice to approve premises outside Hong Kong for the keeping of records or documents under section 130 of the SFO.
The reason why the SFC will only approve premises that are located in Hong Kong is that section 130 of the SFO must be read in the light of the SFC’s related powers under Parts VI and VIII of the SFO and the related obligations of licensed corporations in respect of the keeping of their records. The SFC, by way of example, has the power under Part VIII of the SFO to enter premises to inspect the records of an intermediary, but would be precluded from exercising this power in the event of the premises being located outside Hong Kong. By way of further example, the Securities and Futures (Keeping of Records) Rules stipulate the records that must be kept by intermediaries and that they must be kept in a manner that will enable an audit to be conveniently and properly carried out.
The SFC considers that, in the event of it approving premises outside Hong Kong under section 130 of the SFO, these types of powers and obligations could be undermined. Accordingly, the SFC insists that all records and documents required to be kept by a licensed corporation under the SFO must be kept at approved premises in Hong Kong.
However, in the case where a licensed corporation intends to keep regulatory records exclusively with an electronic data storage provider, data centre(s) used by the electronic data storage provider at which the regulatory records of the licensed corporation are kept, regardless of whether it is located in Hong Kong or elsewhere, is required to be approved by the SFC under section 130 of the SFO. For details, please refer to the circular on the Use of external electronic data storage dated 31 October 2019.
Does the SFC allow licensed corporations to carry on their businesses in business centres or shared offices, or to change its office location frequently?
The SFO and its related rules do not prescribe the type of office from which a licensed corporation must operate. However, the business premises that a corporation chooses must be suitable for the business activities that it has been licensed under the SFO to carry on.
Licensed corporations must ensure, at all times, that their office arrangements are suitable. This is a continuing obligation and any failure to comply with it will give rise to concerns on the part of the SFC and might well result in the SFC taking regulatory action.
Generally speaking, the SFC expects licensed corporations to carry on business from a “fixed abode” and discourages frequent changes of office location.
As a matter of principle, a licensed corporation should satisfy itself that the business premises occupied by it are appropriately secured and that confidential or non-public information (such as price sensitive information) and client privacy will be sufficiently safeguarded against unauthorised access or leakage.
The SFC does not distinguish business centres or shared offices from other types of business accommodation. However, the following factors would suggest that the premises are likely to be unsuitable:
where there is no secured and properly segregated office area, which is able to be locked and which is designated for the corporation’s own and exclusive use, and in which its business records, particularly those relating to clients, are able to be securely held;
where essential office equipment and telecommunication systems are installed in such a way that they are not situated within an enclosed area that is secure and accessible only by the corporation’s staff and authorized personnel;
where no or insufficient measures are taken to prevent confusion to clients that might be caused by the existence of other business entities occupying the same premises;
where the nature of the corporation’s business demands frequent face-to-face dealings or meetings with clients at the corporation’s premises, during which client information and instructions are likely to be exchanged, and practical difficulties exist in the corporation being able to ensure confidentiality during such meetings; or
where the corporation has not ensured that its office premises will always be accessible for all formal regulatory visits, including investigations and inspections.
Although the above factors are considered by the SFC to be of principal concern to it in respect of the appropriateness or otherwise of business premises occupied by licensed corporations, they should not be considered to constitute an exhaustive list because circumstances might exist in certain situations that give rise to particular accommodation needs or requirements.
Licensed corporations have an ongoing obligation to anticipate such matters and to ensure that their business premises are, at all times, suitable for the purposes for which they are being used.
Last update: 31 Oct 2019