SFC Consults on Investor Identification Regime and OTC Securities Transactions Reporting Regime

On 4 December 2020, the Hong Kong Securities and Futures Commission (SFC) launched a consultation on proposals to introduce (1) an investor identification regime for the securities market in Hong Kong at the trading level (the Proposed Investor Identification Regime) and (2) an OTC securities transactions reporting regime for shares listed on the Hong Kong Stock Exchange (the Proposed OTC Securities Transactions Reporting Regime) (the Consultation Paper).

The proposed investor identification regime would apply to the SFC-licensed corporations and registered institutions (Regulated Intermediaries) which submit for execution on-exchange orders, or which carry out off-exchange orders, which are required to be reported to the Hong Kong Stock Exchange (the HKEx) (OE Trade Reporting), subject to certain exclusions at the initial stage. Regulated Intermediaries would be required to ensure that a unique identification code has been assigned to each Relevant Client and included in the order information submitted to the HKEx for on-exchange orders as well as off-exchange orders for off-exchange trades reportable to the HKEx. This regime would be independent of the investor identification regime for northbound trading under Stock Connect, which was implemented in August 2018.

The SFC further proposes to introduce an OTC Securities Transactions Reporting Regime for shares listed on the HKEx, which will impose reporting obligations on Regulated Intermediaries when a Regulated Intermediary (whether as principal or agent) makes a transfer of shares that is effected by an OTC Securities Transaction (i.e. a transaction which is not recorded by the HKEx as an on-exchange order nor is required to be reported to the HKEx as an off-exchange trade) in respect of which stamp duty is chargeable in Hong Kong or when there is a deposit to or withdrawal from the Regulated Intermediary of physical certificates of shares.

The proposals aim to enhance Hong Kong’s market surveillance practices, which are currently limited, a fact which was recognised in the SFC’s 2018-2019 Annual Report. The proposals also intend to foster more timely and effective market surveillance and reduce compliance costs for Regulated Intermediaries.

If adopted, the SFC expects to implement the investor identification regime by Q1 2022 at the earliest and the OTC securities transactions reporting regime by around Q3 2022.

The consultation closes on 4 March 2021.

1. SFC Proposed Investor Identification Regime

   1. Hong Kong’s Current Market Surveillance Practices

      Hong Kong’s current market surveillance is limited. The HKEx trading system only captures information of an Exchange Participant (a corporation who may trade on or through the HKEx and is licensed under the SFO to carry on securities/futures/options dealing activity) which inputs a securities order and does not capture information on its underlying client which instructed the order. In order for the SFC to obtain information about the order or trade, including the identity of the underlying clients, the SFC must issue a Section 181 notice under the Securities and Futures Ordinance (SFO) (Cap.571) to the relevant Exchange Participant. The SFC states that typically, in a simple surveillance inquiry, two rounds of Section 181 notices need to be issued. This is both costly and time-consuming for the SFC and Regulated Intermediaries.

      The SFC further considers that the current framework does not provide sufficient transparency in respect of investors’ identities to facilitate the SFC’s market surveillance function. For example, investors can open multiple accounts with different brokers in Hong Kong, and owing to the lack of an expedient measure for the disclosure of investor identities, it makes it challenging for the SFC to establish on a timely basis whether the irregular orders or trades are initiated from the same investor. 

      The SFC also states that the existing framework makes it difficult to identify suspicious trading activities owing to a lack of identification information which makes the isolation of investors’ trading activities from those of other investors difficult. The SFC therefore consider that they are unable to quickly deter potential market misconduct.

   2. Overview of Proposed Investor Identification Regime

      The SFC proposes that when an order is submitted or arranged to be submitted to the HKEx trading for execution (i.e. an on-exchange order) or where an off-exchange trade is reported to the HKEx (i.e. OE Trade Reporting) according to its rules for securities listed and/or traded on the HKEx (the Rules of the Exchange), the Regulated Intermediary submitting the order or reporting the trade would be required to include a unique identification code (the Broker-to-Client Assigned Number or the BCAN) assigned to the Relevant Client. Trades conducted on the odd-lot and special lot market are to be excluded at this stage due to their relatively low turnover. The reporting of manual trades conducted by Exchange Participants outside the HKEx’s trading system and share placings would be conducted on a trade-by-trade basis with both the BCANs of the buyer and seller included. The Exchange Participants of both the buyer client and seller client would be required to report the trade to the HKEx.

      It would be the responsibility of the Regulated Intermediary to ensure that the BCAN has been generated and assigned to each Relevant Client (as defined in (i) below) and included in the order information for each on-exchange order and off-exchange order and included in all OE Trade Reporting. The BCAN should be able to identify a specific client of the Regulated Intermediary, but should not bear any obvious links to a client’s identity and must remain confidential.

      Regulated Intermediaries would be expected to put in place automated order management systems to ensure correct and valid BCANs are tagged to the relevant orders. Where a BCAN is not provided or is invalid, the on-exchange order or OE Trade Reporting will be rejected. A Regulated Intermediary would not be able to correct a BCAN which has already been submitted or reported without the HKEx’s approval.

      Regulated Intermediaries would also be required to ensure that up-to-date client identification data has been collected from each Relevant Client and that it is submitted together with the client’s BCAN (in the form of a BCAN-CID Mapping File) to a central depositary to be maintained by the HKEx by a prescribed time. Where an order is routed through a chain of Regulated Intermediaries, each Regulated Intermediary along the intermediating chain has the responsibility to ensure that the order information for each on-exchange order and off-exchange order, conducted directly or indirectly through another Regulated Intermediary, includes the BCAN assigned to the Relevant Client and that the BCAN is included in all OE Trade Reporting.

      Regulated Intermediaries will be responsible for ensuring that a relevant data privacy policy and adequate security measures to safeguard the data are adopted. Express consent (in the form of a signed hard copy form, electronic or telephone consent) from the clients for the collection and handling of their personal data would be required, in line with Hong Kong’s data privacy laws. The SFC and HKEx will also put in place privacy protection and security measures to safeguard the collected data and the information would only be made available to limited, designated staff of the SFC and the HKEx.

      If the proposed regime is adopted, the SFC’s power to issue Section 181 notices to enquire into the identity of an investor would remain in place and could be used where an investor falls outside the Hong Kong investor identification regime and suspected market misconduct is involved.

      While the investor identification regime is initially proposed to be implemented for the securities market, the SFC ultimately aims to extend the regime to the exchange-traded derivatives market also. This will be the subject of a separate consultation.

      1. The Relevant Client of a Regulated Intermediary to be Assigned a BCAN

         The SFC proposes that the Relevant Client to be assigned a BCAN is the direct client of the Regulated Intermediary, subject to the following provisos:

         In the case of a proprietary trade	the BCAN should be assigned to the Regulated Intermediary itself when it conducts a proprietary trade.
         Where an order is routed through a chain of Regulated Intermediaries	the Relevant Client would be the first non-Regulated Intermediary client in the chain.
         Where an affiliate (or series of affiliates) of an Exchange Participant places an order with that Exchange Participant who executes the order	the Relevant Client would be the first non-affiliate in the subsequent chain. where the entire chain consists solely of affiliates of the Exchange Participant executing the order, the Relevant Client would be the last affiliate in the chain (starting with the last Exchange Participant and working backwards) who places the order.
         In the case of discretionary accounts	the Relevant Client would be the legal entity that opens the trading account with the Regulated Intermediary.
         In the case of investment funds	the Relevant Client would be the asset management company or the individual fund which has opened the securities trading account with the Regulated Intermediary.
         In the case of an aggregated order (an order which comprises two or more purchase and/or sell orders of the same security placed by different clients by a Regulated Intermediary for an on-exchange order or off-exchange order)	the Regulated Intermediary would assign a specific code to the aggregated order as prescribed by the HKEx and tag the code to the order when it is submitted as an on-exchange order or as part of OE Trade Reporting. The Regulated Intermediary would subsequently be required to submit information on each underlying order (including the relevant BCAN for each Relevant Client) of the aggregated order to the HKEx by a prescribed time

         A single unique BCAN would be assigned to each Relevant Client and a separate BCAN would be assigned to identify each joint account. If a client has multiple accounts with a Regulated Intermediary, the Regulated Intermediary would assign only one unique BCAN to identify that client. The BCAN would remain unchanged and could not be reused for other clients once assigned. Prior approval from the HKEx would be required if the BCAN needs to be revised.

      2. Collection and Submission of Client Identification Information

         Information Required to be Collected as Client Identification Information

         Under the proposed regime, Regulated Intermediaries would be required to ensure that the following information has been collected as Client Identification Information (known as Client Identification Data or CID) from the Relevant Client and ensure that up-to-date CID is submitted to the central data repository, which is to be maintained by the HKEx in respect of an on-exchange order or OE Trade Reporting, by a prescribed time:

         • full name as shown on the identity document;

         • identity document’s issuing country or jurisdiction;

         • type of identity document;

           • in the case of an individual client, the order of priority would be: (1) HKID card, (2) national identification document, (3) passport;

           • in the case of a corporate client, the order of priority would be: (1) Legal Entity Identifier (LEI) registration document, (2) certificate of incorporation, (3) business registration certificate, (4) other equivalent documents; and

         • identity document number.

         In the case of a client that is a trust, the CID of the trustee would be collected, however in the case of a trust which is an investment fund, the CID of the asset management company or the individual fund which opened a trading account with the Regulated Intermediary would be collected.

         For clients of a joint account, the CID of all clients named for a joint account would be required to be provided under the same BCAN assigned to that account.

         Logistics of the Collection and Submission of Client Identification Information

         The Regulated Intermediary which assigns the BCAN to the Relevant Client would be the Regulated Intermediary which is required to collect the CID from that client. After collection, the CID and BCAN information should be entered into a file (the BCAN-CID Mapping File) and the BCAN-CID Mapping File would be submitted directly to the central data repository if it is an Exchange Participant. A non-Exchange Participant would either make the submission to the HKEx via a designated web portal or submit the file indirectly to the HKEx by providing the file to another Regulated Intermediary in same way it routes on-exchange orders or off-exchange orders. Measures must be in place to ensure that the client’s BCAN-CID Mapping File is submitted to the central data repository by a prescribed time.

         Where on-exchange orders or off-exchange orders will be routed through an affiliate of the Exchange Participant which executes them, the Exchange Participant must ensure that the affiliate will collect the CID from the client, prepare the BCAN-CID Mapping File and provide the file to it. The Exchange Participant would then submit the file to the central data repository.

         The CID of clients which have already opened an account with a Regulated Intermediary and have conducted trades via that account should generally be submitted within a specified period before the implementation date of the proposed investor identification regime and at the latest, by the day before the trading day (the day on which the client places the on-exchange or off-exchange order or the day on which the off-exchange trade is executed). If the proposed regime is adopted, it is expected that a period of nine months will be provided to the industry for the submission of clients’ CID prior to the launch of the regime. This aims to ensure that the majority of investors’ CID have been submitted before an investor conducts a trade after the launch of the regime.

         The SFC seek views on whether the requirement that the CID of (i) new clients who wish to trade on the day of account opening, and (ii) clients whose accounts have remained dormant since account opening, be submitted by T-1 could be problematic. If feedback suggests it may be a problem, the SFC suggests that the CID of such clients could instead be submitted on the trading day when the client places an order.

         In the case of an aggregated order, the SFC proposes that a Regulated Intermediary be required to submit the BCAN-CID Mapping File for each Relevant Client of the aggregated order to the HKEx subsequent to the trade by a prescribed time.

         In any event, the submission of the BCAN-CID Mapping File to the HKEx is expected to be a one-off exercise and updates will only be necessary where there is a change in the Relevant Clients’ CID information. It would not be necessary for the BCAN-CID Mapping File to be submitted each time an order is placed with the Regulated Intermediary. Where the order is placed by an affiliate of the Exchange Participant which executes the order, the Exchange Participant should ensure that the affiliate provides it with updated CID information in respect of the Relevant Client.

         Failure to submit the BCAN-CID Mapping File to the HKEx by the prescribed time will not invalidate the order or trade but it may constitute a breach of the SFC Code of Conduct and may contravene the relevant Rules of the Exchange.

   3. Implications of the Proposed Investor Identification Regime for Data Privacy Laws and Investor Consent

      If the proposed regime is adopted, Regulated Intermediaries would be required to extend the current data privacy and security measures that are in place to the personal data collected and used under the proposed investor identification regime.

      The SFC states that the CID and BCANs of individual clients are likely to constitute personal data as defined in the Personal Data (Privacy) Ordinance (PDPO) (Cap.486). All Regulated Intermediaries would therefore be required to review the adequacy of the existing measures they have in place to ensure compliance with the applicable requirements under the PDPO and any other applicable data privacy laws, for example, the data privacy laws of other jurisdictions that may be applicable depending on the client’s place of residence or the Regulated Intermediary’s place of business, in relation to the collection, use, storage, disclosure and transfer of CID, BCANs and BCAN-CID Mapping Files.

      Where a Regulated Intermediary intends to use a client’s personal data (which it has already collected) for a new purpose, not previously notified to the client, the Regulated Intermediary is required to obtain the client’s prescribed consent (i.e., express and voluntarily given consent) under the PDPO. The use of a client’s personal data already collected by the Regulated Intermediary prior to the introduction of the proposed regime, would trigger the requirement to obtain prescribed consent under the PDPO.

      1. Obtaining written or other express consent from the Relevant Clients

         Under the proposed regime, Regulated Intermediaries would be required to obtain written or other express consent from their Relevant Clients (both new and existing clients) for the transfer of their personal data to the HKEx and the SFC. The consent must be obtained on or before the collection of CID from or submission of CID for an individual client. In particular, consent must be obtained in relation to:

         • disclosure and transfer of personal data (including CID and BCANs) to the HKEx and/or the SFC;

         • allowing the HKEx to:

           • collect, store, process and use their personal data (including CID and BCANs) for market surveillance and monitoring purposes and enforcement of the Rules of the Exchange;

           • disclose and transfer such information to the relevant regulators and law enforcement agencies in Hong Kong to facilitate the performance of their statutory functions with respect to the Hong Kong financial markets; and

           • use such information for conducting analysis for the purposes of market oversight.

         • allowing the SFC to:

           • collect, store, process and use their personal data (including CID and BCANs) for the performance of its statutory functions including monitoring, surveillance and enforcement functions with respect to the Hong Kong financial markets; and

           • disclose and transfer such information to the relevant regulators and law enforcement agencies in Hong Kong in accordance with applicable laws or regulatory requirements.

         The SFC proposes that consent may be obtained by a written and signed acknowledgment, by electronic means or by phone, provided that the relevant requirements are satisfied. The SFC states that further guidance will be provided in due course on the requirements to be observed where consent is obtained by alternative means.

      2. Transmission of data and data protection

         The submission of CID by Regulated Intermediaries to the HKEx will be conducted through the HKEx’s closed network and all CID kept in the central data repository will be encrypted. Once the relevant trade information is captured by the HKEx, the information (with BCAN tagged) will be transmitted to the SFC’s surveillance system via a dedicated, secure data line. The SFC and the HKEx will work together to establish a mechanism for data sharing or synchronization.

         Access to the central data repository will be restricted to designated staff of the HKEx and the SFC and approvals will be granted by senior executives on an as-needed basis based on job duties. Detailed audit trails will be maintained of any access made and failed login attempts and unauthorised access will be logged and investigated.

         The HKEx, as the proposed operator of the central data repository, will be required to put in place adequate resources to ensure its data security measures and access controls are kept up-to-date and that the policies and procedures are reviewed and updated on a regular basis.

   4. Amendments to the SFC Code of Conduct

      The SFC proposes to amend the SFC Code of Conduct to implement the proposed regime. The HKEx will also be required to amend its Rules to implement the proposed regime in relation to Exchange Participants. If the proposed regime is implemented, non-Exchange Participant Regulated Intermediaries assigning BCANs and preparing and submitting BCAN-CID Mapping Files would be required to follow the rules and procedures set out in the Rules of the Exchange and this requirement will be set out in the amendments to the SFC Code of Conduct.

   5. Implementation Timeline

      If the regime is adopted, the SFC expects to launch the new regime by Q1 2022 at the earliest. This is in view of the necessary preparations Regulated Intermediaries will be required to undertake, including: operational enhancements, obtaining clients’ consent, and preparing for the initial CID submission. The HKEx will publish a timeline for the submission of the full and updated CID in due course. The SFC proposes to give Regulated Intermediaries a period of nine months to complete the preparation process.

2. SFC Proposed OTC Securities Transactions Reporting Regime

   In addition to the proposed investor identification regime outlined above, the SFC further proposes to introduce an OTC securities transactions reporting regime for shares (ordinary shares and REITs) listed on the HKEx. The proposed regime aims to enhance transparency in relation to transactions which are not required to be recorded by the HKEx as on-exchange orders nor are required to be reported to the HKEx as off-exchange trades (OTC Securities Transactions) in view of the SFC’s findings that OTC securities transactions have been used in many manipulation schemes investigated by the SFC.

   1. Overview of the Proposed OTC Securities Transactions Reporting Regime

      The proposed regime would impose reporting obligations on Regulated Intermediaries when:

      • the Regulated Intermediary, whether acting as principal or agent, makes a transfer of shares (ordinary shares or REITs listed on the HKEx) that is effected by an OTC Securities Transaction in respect of which stamp duty is chargeable in Hong Kong; and

      • there is a deposit to or withdrawal from the Regulated Intermediary, whether acting as principal or agent, of physical certificates of shares.

      Transactions falling outside the OTC Securities Transactions Reporting Regime would include for example, share transfers between two Exchange Participants for the same individual and share transfers between two accounts held by the same individual in the same Exchange Participant. A transfer of shares effected by a transaction which has been conducted on-exchange or is required to be reported to the HKEx in accordance with the Rules of the Exchange will also not be subject to the reporting obligation under the proposed OTC Securities Transactions Reporting Regime.

      The SFC proposes that the reporting will be required to be done by one Hong Kong trading day after the day (in Hong Kong time) of the share transfer, deposit or withdrawal. In relation to the reporting of share transfers between two Regulated Intermediaries, the SFC proposes that both the delivering Regulated Intermediary and the receiving Regulated Intermediary would be required to report the transaction to the SFC. However, in the event that the delivering Regulated Intermediary and the receiving Regulated Intermediary are the same Regulated Intermediary, the transaction would only need to be reported once.

      The SFC will build the system for the submission of information and will provide the format of reporting in due course and prior to the implementation of the proposed regime.

      The following information would be required to be submitted to the SFC for each share transfer:

      • stock name and code of the shares transferred;

      • transaction price per share;

      • quantity of shares transfer handled by the reporting Regulated Intermediary;

      • quantity of shares of the transactions;

      • share transfer date;

      • transaction date;

      • CE number of the reporting Regulated Intermediary and the role of the reporting Regulated Intermediary in the transfer (transferee/transferor/agent for transferee or transferor or both);

      • CE number of the counterparty corporation to the reporting Regulated Intermediary;

      • full name of the counterparty corporation to the reporting Regulated Intermediary; and

      • CID of the transferee/transferor (where the transferee/transferor is a client of the reporting Regulated Intermediary).

      The following information would be required to be submitted to the SFC for a physical share certificate deposit or withdrawal:

      • stock name and stock code of the shares to which the physical share certificate relates;

      • quantity of shares referenced in the physical share certificates;

      • deposit or withdrawal date;

      • CE number and role of the reporting Regulated Intermediary; and

      • CID of the client on whose behalf the physical share certificate(s) are held by the Regulated Intermediary.

   2. Implications of the Proposed Investor Identification Regime for Data Privacy Laws and Investor Consent

      The SFC states that the information required to be reported by Regulated Intermediaries to the SFC in relation to a share transfer, deposit or withdrawal under the OTC Securities Transactions Reporting Regime is likely to contain personal data of individuals and so Regulated Intermediaries would be required to comply with all applicable requirements under the PDPO in relation to the collection, use, storage, disclosure and transfer of such personal data.

      In that regard, Regulated Intermediaries would be required to obtain written or other express consent from clients (both new and existing) for the transfer of their personal data to the SFC under the proposed regime. Consent must be obtained on or before the collection of CID from or submission of CID for an individual client. Consent may be obtained through various means, provided the relevant requirements are met. Client consent may be obtained together with the client consent required under the proposed investor identification regime in one go provided that the client consent is broad enough to cover personal data submitted under both regimes.

      If a client fails to provide the required consent, the Regulated Intermediary must not accept a transfer of shares into the client’s account or a deposit of physical certificates of shares into the client’s account, or a deposit of physical certificates of shares into the client’s account. Doing so will constitute a regulatory breach, which is subject to disciplinary action, however the underlying transaction will not be invalidated. The client will however be able to transfer shares out of their account with the Regulated Intermediary or withdraw physical certificates of shares out of the client’s account with the Regulated Intermediary.

   3. Amendments to the SFC Code of Conduct

      If the OTC Securities Transactions Reporting Regime is adopted, the SFC proposes to amend the SFC Code of Conduct to implement the regime. The proposed amendments would be introduced as a new paragraph 5.7.

   4. Implementation Timeline

      If the proposed OTC Securities Transactions Regime is adopted, the SFC anticipates launching the regime approximately 6 months after implementation of the proposed investor identification regime (around Q3 2022 at the earliest). This timeline is in view of the preparations Regulated Intermediaries will be required to undertake.