Operational Resilience / Outsourcing in Hong Kong

Key dates

19 September 2022 – 7 October 2022

- Approximate three‑week period during which LFSHK’s systems were restored in phases and clients could not trade via mobile app or internet platform, relying only on account executives to place orders

19 September 2022

- Ransomware attack on LFSHK’s critical IT infrastructure, affecting servers and core trading‑related systems

7 October 2022

- Completion of LFSHK’s system restoration following the ransomware attack

TBD (post‑incident)

- LFSHK conducted internal reviews and appointed an independent reviewer at the SFC’s request to assess the incident and cybersecurity internal controls; exact dates are not specified but occurred after the attack and prior to enforcement

TBD (enforcement publication date)

- SFC issues public disciplinary action reprimanding and fining LFSHK HK$2.1 million for misconduct relating to inadequate cybersecurity controls; the reference number indicates 2026 publication but the precise calendar date is not specified in the excerpt

Suggested considerations

• Conduct a comprehensive cybersecurity risk assessment and control gap analysis across all critical systems, including trading platforms, email servers, domain controllers, file servers, and accounting systems.
• Implement and regularly review firewall configurations and network monitoring tools to ensure effective protection and detection capabilities for internal and external network traffic.
• Upgrade all operating systems and antivirus software to supported, fully patched versions and establish formal patch and vulnerability management procedures with defined timelines and testing steps.
• Establish and enforce robust user access management policies, including least‑privilege access, periodic recertification of user and privileged accounts, and logging and monitoring of admin activities.
• Implement secure password management solutions and technical controls, eliminating unencrypted storage of credentials and enforcing strong password complexity, rotation, and multi‑factor authentication where applicable.

What changed

• - Licensed corporations must ensure that firewall protection and network monitoring are implemented and effective across critical infrastructure, including file servers, domain controllers, email...
• Licensed corporations must maintain up‑to‑date operating systems and antivirus software, avoiding end‑of‑life or unpatched environments that materially increase vulnerability to ransomware and other...
• Firms must enforce strong user access and privileged account controls, including robust administration of system admin accounts, least‑privilege access models, periodic reviews of access rights, and...
• Firms must implement secure password management practices, prohibiting the storage of credentials in unencrypted files and enforcing strong password policies and technical controls for credential...
• Remote access must be subject to strict controls, including secure configuration of VPN or other remote access solutions, need‑to‑have access principles, and monitoring for unusual or unauthorized...

Key dates

February 2019

- Start of period during which XHK failed to promptly transfer non‑client money (commissions and interest) out of client segregated accounts, contrary to the CMR

January 2020

- Start of period during which XHK submitted financial returns with accounting errors under the FRR, leading to misstated liquid capital

March 2021

- Start of period in which XHK transferred client money from segregated accounts to overseas brokers’ accounts without written client direction or standing authority, in breach of the CMR

April 2021

- End of period of unauthorised transfers of client money from segregated accounts to overseas brokers’ accounts

June 2021 Deadline

- End of period during which XHK’s FRR financial returns contained accounting errors and its actual required liquid capital was in deficit for four months, with deficits ranging from HK$3.6 million to HK$32.3 million

Suggested considerations

• Review and, where necessary, update internal policies and procedures to ensure continuous compliance with the Securities and Futures (Financial Resources) Rules, including robust controls over capital monitoring and financial return preparation.
• Implement or enhance daily (or more frequent, as appropriate) capital monitoring processes that detect and escalate any actual or potential liquid capital deficits before they arise and ensure timely remedial action.
• Conduct a comprehensive review of all external service providers involved in financial reporting, prudential calculations, and FRR returns to verify and document their competence, relevant experience, and FRR knowledge, and update outsourcing due diligence criteria accordingly.
• Establish or strengthen formal governance and oversight frameworks for outsourced finance functions, including clear accountability, documented review of work performed, periodic quality assessments, and rights of audit.
• Provide targeted FRR training to finance, compliance, and relevant front‑office staff so they understand FRR calculations, common error types, and their responsibilities in reviewing and approving FRR returns before submission.

What changed

• - The SFC reiterates that licensed corporations must maintain required liquid capital at all times under the Securities and Futures (Financial Resources) Rules (FRR), and any deficit (even if later...
• The enforcement confirms that firms are strictly accountable for the accuracy of financial returns submitted under the FRR, including where preparation and compilation are outsourced to external...
• The SFC clarifies that external service providers involved in financial returns and FRR compliance must be demonstrably competent and possess relevant FRR knowledge and experience, and that licensed...
• The case reinforces that internal staff responsible for FRR reporting must be adequately trained and familiar with FRR requirements, with effective review and challenge processes before submissions...
• The SFC confirms that transferring client money from segregated client accounts to overseas brokers’ accounts requires a valid written direction or standing authority from the client in accordance...

Suggested considerations

• Pre-Application Engagement: Contact SFC immediately for discussions on VA custodian licensing, especially for existing VATPs/banks holding keys.
• License Applications: Prepare applications for VA dealer/custodian licenses once regimes commence; appoint responsible officers/managers-in-charge meeting fit-and-proper criteria, implement cold wallet infrastructure, private key controls, insurance, audits, and business continuity plans.
• Custody Segregation: Existing intermediaries/VA dealers must transition client VA custody to SFC-licensed VA custodians; cease use of non-compliant overseas providers.
• Compliance Mapping: Review operations against Type 1/Type 13 financial resources, core function authorizations, and exemptions; assess staking/MPC services for custody capture.
• Monitor Further Consults: Track incoming VA advisory/management regimes and adjust for no deeming provisions.

What changed

• - VA Dealer Regime: Introduces licensing for VA dealing activities (e.g., VA conversions, broker-dealer services at physical outlets or otherwise), excluding tokenized securities/derivatives...
• VA Custodian Regime: Targets entities safeguarding private keys or enabling unilateral VA transfers (e.g., capturing staking providers but exempting non-custodial wallets or delegating top-layer...
• Exemptions Under Consideration: Aligns partially with Type 1 exemptions, including principal/intra-group transactions, VA use as payment for goods/services, chaperone via SFC-regulated dealers, VA...
• Further Consultations: New regimes for VA advisory (aligned with Type 4) and asset management (aligned with Type 9), without deeming provisions for pre-existing entities; VA managers may face custody...