Operational Resilience / Outsourcing in Hong Kong

Key dates

2026-10-16

SFC welcomed HKEX’s consultation conclusions on the proposed transition from T+2 to T+1; HKEX published the consultation conclusions on the same date.

2028-09-01

September 2028 is identified as HKEX’s target month for implementation within the broader second-half-of-2028 timetable, subject to market readiness, regulatory approval and final rule and procedure amendments.

Suggested considerations

• Firms should map all Hong Kong cash-market products, trading venues, settlement locations and transaction types that may fall within the final T+1 scope, including stock-option physical settlement where relevant.
• Compliance and operations teams may wish to perform an end-to-end impact assessment covering trade capture, allocation, confirmation, affirmation, settlement-instruction creation and matching, funding, stock borrowing, corporate actions, reconciliations, fails management and client reporting.
• Firms should assess whether overseas time zones, foreign-exchange funding, cross-border custody arrangements and client approval processes will effectively create a T+0 operating deadline for US- and European-based investors.
• Broker-dealers, custodians and investment managers should review service-level agreements, settlement cut-offs, standing settlement instructions, client documentation, fail-allocation terms and contractual responsibility for late or failed settlement.
• Technology teams may wish to test automation, real-time or near-real-time status updates, API connectivity, matching, exception queues, reconciliation and management information against the compressed timetable.
• Firms should engage HKEX, HKSCC, executing brokers, custodians, prime brokers, fund administrators and other vendors on technical specifications, testing windows, training and readiness assessments as they become available.
• Risk and treasury functions may wish to reassess intraday liquidity, pre-funding, collateral, stock-borrow availability, overdraft capacity, settlement-fail exposure and related client-margin assumptions.
• Compliance teams should monitor the consequential amendments to HKEX and HKSCC rules and procedures, SFC communications, regulatory approvals and any final scope, cut-off, penalty or fail-management provisions before treating the September 2028 date as firm.

What changed

HKEX proposes to settle in-scope Hong Kong cash-market transactions one business day after trade date rather than two business days. The transition is subject to market readiness, regulatory approval and consequential amendments to applicable HKEX and settlement-system rules and procedures; the SFC says it will work with HKEX on those amendments and implementation arrangements.

Key dates

19 September 2022 – 7 October 2022

- Approximate three‑week period during which LFSHK’s systems were restored in phases and clients could not trade via mobile app or internet platform, relying only on account executives to place orders

19 September 2022

- Ransomware attack on LFSHK’s critical IT infrastructure, affecting servers and core trading‑related systems

7 October 2022

- Completion of LFSHK’s system restoration following the ransomware attack

TBD (post‑incident)

- LFSHK conducted internal reviews and appointed an independent reviewer at the SFC’s request to assess the incident and cybersecurity internal controls; exact dates are not specified but occurred after the attack and prior to enforcement

TBD (enforcement publication date)

- SFC issues public disciplinary action reprimanding and fining LFSHK HK$2.1 million for misconduct relating to inadequate cybersecurity controls; the reference number indicates 2026 publication but the precise calendar date is not specified in the excerpt

Suggested considerations

• Conduct a comprehensive cybersecurity risk assessment and control gap analysis across all critical systems, including trading platforms, email servers, domain controllers, file servers, and accounting systems.
• Implement and regularly review firewall configurations and network monitoring tools to ensure effective protection and detection capabilities for internal and external network traffic.
• Upgrade all operating systems and antivirus software to supported, fully patched versions and establish formal patch and vulnerability management procedures with defined timelines and testing steps.
• Establish and enforce robust user access management policies, including least‑privilege access, periodic recertification of user and privileged accounts, and logging and monitoring of admin activities.
• Implement secure password management solutions and technical controls, eliminating unencrypted storage of credentials and enforcing strong password complexity, rotation, and multi‑factor authentication where applicable.

What changed

• - Licensed corporations must ensure that firewall protection and network monitoring are implemented and effective across critical infrastructure, including file servers, domain controllers, email...
• Licensed corporations must maintain up‑to‑date operating systems and antivirus software, avoiding end‑of‑life or unpatched environments that materially increase vulnerability to ransomware and other...
• Firms must enforce strong user access and privileged account controls, including robust administration of system admin accounts, least‑privilege access models, periodic reviews of access rights, and...
• Firms must implement secure password management practices, prohibiting the storage of credentials in unencrypted files and enforcing strong password policies and technical controls for credential...
• Remote access must be subject to strict controls, including secure configuration of VPN or other remote access solutions, need‑to‑have access principles, and monitoring for unusual or unauthorized...

Key dates

February 2019

- Start of period during which XHK failed to promptly transfer non‑client money (commissions and interest) out of client segregated accounts, contrary to the CMR

January 2020

- Start of period during which XHK submitted financial returns with accounting errors under the FRR, leading to misstated liquid capital

March 2021

- Start of period in which XHK transferred client money from segregated accounts to overseas brokers’ accounts without written client direction or standing authority, in breach of the CMR

April 2021

- End of period of unauthorised transfers of client money from segregated accounts to overseas brokers’ accounts

June 2021 Deadline

- End of period during which XHK’s FRR financial returns contained accounting errors and its actual required liquid capital was in deficit for four months, with deficits ranging from HK$3.6 million to HK$32.3 million

Suggested considerations

• Review and, where necessary, update internal policies and procedures to ensure continuous compliance with the Securities and Futures (Financial Resources) Rules, including robust controls over capital monitoring and financial return preparation.
• Implement or enhance daily (or more frequent, as appropriate) capital monitoring processes that detect and escalate any actual or potential liquid capital deficits before they arise and ensure timely remedial action.
• Conduct a comprehensive review of all external service providers involved in financial reporting, prudential calculations, and FRR returns to verify and document their competence, relevant experience, and FRR knowledge, and update outsourcing due diligence criteria accordingly.
• Establish or strengthen formal governance and oversight frameworks for outsourced finance functions, including clear accountability, documented review of work performed, periodic quality assessments, and rights of audit.
• Provide targeted FRR training to finance, compliance, and relevant front‑office staff so they understand FRR calculations, common error types, and their responsibilities in reviewing and approving FRR returns before submission.

What changed

• - The SFC reiterates that licensed corporations must maintain required liquid capital at all times under the Securities and Futures (Financial Resources) Rules (FRR), and any deficit (even if later...
• The enforcement confirms that firms are strictly accountable for the accuracy of financial returns submitted under the FRR, including where preparation and compilation are outsourced to external...
• The SFC clarifies that external service providers involved in financial returns and FRR compliance must be demonstrably competent and possess relevant FRR knowledge and experience, and that licensed...
• The case reinforces that internal staff responsible for FRR reporting must be adequately trained and familiar with FRR requirements, with effective review and challenge processes before submissions...
• The SFC confirms that transferring client money from segregated client accounts to overseas brokers’ accounts requires a valid written direction or standing authority from the client in accordance...

Suggested considerations

• Pre-Application Engagement: Contact SFC immediately for discussions on VA custodian licensing, especially for existing VATPs/banks holding keys.
• License Applications: Prepare applications for VA dealer/custodian licenses once regimes commence; appoint responsible officers/managers-in-charge meeting fit-and-proper criteria, implement cold wallet infrastructure, private key controls, insurance, audits, and business continuity plans.
• Custody Segregation: Existing intermediaries/VA dealers must transition client VA custody to SFC-licensed VA custodians; cease use of non-compliant overseas providers.
• Compliance Mapping: Review operations against Type 1/Type 13 financial resources, core function authorizations, and exemptions; assess staking/MPC services for custody capture.
• Monitor Further Consults: Track incoming VA advisory/management regimes and adjust for no deeming provisions.

What changed

• - VA Dealer Regime: Introduces licensing for VA dealing activities (e.g., VA conversions, broker-dealer services at physical outlets or otherwise), excluding tokenized securities/derivatives...
• VA Custodian Regime: Targets entities safeguarding private keys or enabling unilateral VA transfers (e.g., capturing staking providers but exempting non-custodial wallets or delegating top-layer...
• Exemptions Under Consideration: Aligns partially with Type 1 exemptions, including principal/intra-group transactions, VA use as payment for goods/services, chaperone via SFC-regulated dealers, VA...
• Further Consultations: New regimes for VA advisory (aligned with Type 4) and asset management (aligned with Type 9), without deeming provisions for pre-existing entities; VA managers may face custody...