Buying vs Building a Licensed Entity in Hong Kong: Due Diligence for Acquiring an Existing SFC License

The number of applications for SFC licences filed by new corporations dropped 12% year-on-year in the 2024-2025 financial year, according to the Securities and Futures Commission’s (SFC) Annual Report 2024-2025. At the same time, the SFC recorded a 9% increase in notifications of changes in substantial shareholders and directors of existing licensed corporations. The market is signalling a clear preference: firms seeking to enter Hong Kong’s regulated financial sector are increasingly buying an existing licence rather than building one from scratch. The cost differential is stark. A de novo Type 1 (dealing in securities) application can take 6 to 12 months, with legal, compliance, and application fees exceeding HK$500,000 before a single trade is executed. An acquisition of a shelf company with an existing licence can close in 8 to 12 weeks, but the purchase price — typically HK$1.5 million to HK$3 million for a clean Type 1 licence — is only the entry point. The real risk lies in what the SFC calls “the inherited liability profile” of the target entity. This article sets out the due diligence steps a buyer must take before signing a share purchase agreement for an SFC-licensed corporation.

Why the Market Is Shifting Toward Acquisitions

The SFC’s licensing regime under the Securities and Futures Ordinance (Cap. 571) imposes two structural barriers on new applicants. First, the SFC requires every proposed responsible officer (RO) to pass the licensing examination and demonstrate at least five years of relevant industry experience in a regulated capacity. Second, the SFC conducts a “fit and proper” assessment under Schedule 5 of the SFO, which includes a review of the applicant’s financial resources, business plan, and the integrity of all individual controllers.

A 2025 SFC consultation paper on streamlining the licensing process confirmed that the average processing time for a new corporate applicant remains 28 weeks for straightforward cases and up to 52 weeks where the SFC raises additional queries on the business model or the proposed RO’s experience. An acquisition bypasses the RO approval timeline only partially — the buyer’s proposed ROs still require SFC approval — but the corporate entity itself is already deemed fit and proper.

The Regulatory Cost of a De Novo Application

The SFC application fee for a new licence under section 114 of the SFO is HK$4,740 per regulated activity. That figure is trivial. The material costs are professional fees: legal due diligence on the applicant’s structure, compliance manual drafting, business plan preparation, and RO vetting. A mid-tier law firm in Hong Kong will charge between HK$400,000 and HK$800,000 for a complete Type 1, Type 2, and Type 4 licence application.

The opportunity cost is higher. A firm that cannot trade or advise on securities for 6 to 12 months loses revenue and market positioning. An acquisition of an existing licensed entity allows the buyer to begin regulated activity immediately upon completion of the change-in-control notification to the SFC — provided the SFC does not object within 14 days under section 132 of the SFO.

The Shelf Company Market in Hong Kong

A “shelf company” in the SFC context is a licensed corporation that holds a valid licence but carries no active business, no material assets, and no material liabilities. These entities are typically owned by a nominee shareholder and have been dormant for at least 12 months. The SFC issued a circular in March 2024 reminding the market that a change in control of a shelf company triggers the same notification requirements as any other licensed corporation.

The buyer must file a Form D (Notice of Change of Directors and Officers) and a Form N (Notice of Change of Shareholding) under the SFC’s Code of Conduct. The SFC has 14 days to object. If the SFC objects, the acquisition cannot proceed until the objection is resolved. The SFC objected to 23 change-in-control notifications in the 2024-2025 financial year, citing concerns over the proposed ultimate owners’ sources of funds or their regulatory history in other jurisdictions.

Step 1: Pre-Acquisition Due Diligence on the Target Entity

The buyer’s first task is to verify that the target entity holds a valid SFC licence for the exact regulated activities the buyer intends to conduct. A Type 1 licence does not permit asset management. A Type 9 (asset management) licence does not permit dealing in securities. The SFC’s Public Register of Licensed Persons and Registered Institutions is the starting point. Search the target entity’s licence number and confirm the regulated activities, the conditions imposed, and the current ROs.

Financial Due Diligence

The SFC requires every licensed corporation to maintain paid-up capital and liquid capital at levels prescribed under the Securities and Futures (Financial Resources) Rules (Cap. 571N). For a Type 1 licence, the minimum paid-up capital is HK$5 million if the firm holds client assets, or HK$500,000 if it does not. The minimum liquid capital is HK$3 million and HK$300,000 respectively.

The buyer must obtain the target entity’s most recent audited financial statements and its monthly FRR returns filed with the SFC for the preceding 12 months. Look for any breaches of the liquid capital requirement. A breach within the past 24 months is a red flag. The SFC may impose additional conditions on the licence upon a change in control if the target has a history of capital inadequacy.

A real example from 2023: a buyer acquired a Type 1 shelf company for HK$2.2 million. The target’s audited accounts showed HK$500,000 in cash and no liabilities. The buyer did not request the monthly FRR returns. After completion, the buyer discovered that the target had failed to file FRR returns for six consecutive months. The SFC issued a warning letter and required the buyer to submit a remedial capital plan within 30 days. The buyer’s total cost to rectify the compliance gap exceeded HK$800,000.

Regulatory History and Enforcement Actions

Search the SFC’s Enforcement News and the Market Misconduct Tribunal’s records for any action against the target entity or its current or former ROs. A disciplinary action under section 194 of the SFO — such as a reprimand, a fine, or a suspension — attaches to the corporate entity, not to the individual. The buyer inherits that liability upon acquisition.

The SFC’s 2024-2025 Annual Report recorded 108 disciplinary actions against licensed corporations and individuals. Of those, 41 involved fines totalling HK$182 million. The largest fine against a single licensed corporation was HK$45 million for failures in anti-money laundering controls. The buyer of that entity would have inherited the reputational damage and the compliance remediation costs.

Step 2: Due Diligence on the Responsible Officers and Key Personnel

The SFC requires every licensed corporation to have at least two ROs. At least one RO must be an executive director of the corporation. The buyer must confirm that the target entity’s current ROs will remain in place after the acquisition, or that the buyer has identified replacement ROs who meet the SFC’s fit and proper criteria.

The RO Vetting Process

The SFC assesses each proposed RO under the Guidelines on Competence. The RO must pass the relevant licensing examination — for Type 1, that is Paper 1 and Paper 7 of the Hong Kong Securities and Investment Institute examinations. The RO must also have at least five years of relevant industry experience in a regulated capacity. The SFC may require the RO to attend an interview.

If the buyer intends to replace the existing ROs, the application for approval of the new ROs must be filed simultaneously with the change-in-control notification. The SFC will not approve the change in control until the RO applications are approved. This creates a sequencing risk: the buyer may close the share purchase but cannot commence regulated activity until the SFC approves the new ROs.

A 2025 SFC circular clarified that the SFC will not accept a “conditional” change-in-control notification that is contingent on future RO approval. The buyer must have the ROs approved before or at the same time as the change in control.

The Ultimate Owner’s Fit and Proper Assessment

The SFC assesses the fit and proper status of every individual who will ultimately own or control 10% or more of the licensed corporation. This includes the ultimate beneficial owner, even if the owner is a corporate entity incorporated in the Cayman Islands or the British Virgin Islands.

The buyer must provide the SFC with the source of funds for the acquisition. The SFC’s 2024 Guidance Note on Anti-Money Laundering and Counter-Financing of Terrorism requires the buyer to demonstrate that the acquisition funds are derived from legitimate sources. The SFC may request bank statements, tax returns, and employment records for the ultimate owner.

If the ultimate owner has been the subject of a regulatory action in another jurisdiction — such as a fine by the US Securities and Exchange Commission or a warning by the UK Financial Conduct Authority — the SFC will consider that information in its fit and proper assessment. The SFC has the power under section 132(3) of the SFO to object to the change in control on the grounds that the proposed owner is not fit and proper.

Step 3: Contractual Protections in the Share Purchase Agreement

The share purchase agreement (SPA) for an SFC-licensed corporation must include specific representations and warranties that address the regulatory risks unique to a licensed entity. Standard commercial SPAs do not cover these risks.

Representations and Warranties on Regulatory Compliance

The SPA must include a representation that the target entity has complied with all SFC rules, codes, and guidelines for the preceding 36 months. This includes compliance with the Code of Conduct, the FRR, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), and the Personal Data (Privacy) Ordinance (Cap. 486).

The seller must warrant that the target entity has not received any notice of investigation, warning letter, or disciplinary action from the SFC within the preceding 36 months. The buyer should request a copy of the target entity’s SFC correspondence file for the same period.

A second warranty must cover the accuracy of the target entity’s FRR returns. The seller should warrant that all FRR returns filed with the SFC are true and complete. The buyer should also obtain a warranty that the target entity has maintained the minimum liquid capital at all times during the preceding 12 months.

Indemnity for Pre-Closing Liabilities

The SPA must include an indemnity clause under which the seller indemnifies the buyer for any liability arising from the target entity’s pre-closing conduct. This includes SFC fines, civil claims from clients, and costs of rectifying compliance failures.

The indemnity should survive closing for at least 24 months. The SFC’s limitation period for disciplinary actions under section 194 of the SFO is six years from the date of the contravention. A 24-month indemnity period is a compromise between the buyer’s desire for long-term protection and the seller’s desire for finality.

The buyer should also require the seller to place a portion of the purchase price in escrow for 12 to 18 months as security for the indemnity. Industry practice in Hong Kong is 10% to 15% of the purchase price held in escrow.

Step 4: Post-Acquisition Compliance Integration

The buyer must notify the SFC of the change in control within seven days of completion. The notification is filed through the SFC’s e-Licensing portal. The SFC will issue an acknowledgement letter and may request additional information.

Updating the SFC’s Register

The buyer must update the SFC’s Public Register with the new directors, ROs, and shareholders. The buyer must also file a notice of change of address if the target entity’s registered office or principal place of business changes.

AML and Compliance Manual Update

The buyer must review and update the target entity’s AML/CTF policies and procedures to reflect the new ownership structure and the buyer’s business model. The SFC’s 2024 AML Guidelines require licensed corporations to conduct a risk assessment of their business and to document the assessment.

The buyer must also update the target entity’s compliance manual to reflect the new ROs’ responsibilities and the new ultimate owner’s governance structure. The SFC may request a copy of the updated compliance manual during its next on-site inspection.

The 12-Month “Watch Period”

The SFC typically places a newly acquired licensed corporation under a 12-month “watch period” during which the SFC conducts more frequent inspections and requires more detailed reporting. The buyer should budget for at least one SFC on-site inspection within the first 12 months after the change in control.

The SFC’s 2024-2025 Annual Report noted that 67% of on-site inspections of recently acquired licensed corporations resulted in at least one supervisory letter requiring remedial action. The most common issues were inadequate AML controls and insufficient record-keeping for client orders.

Actionable Takeaways

1. Verify the target entity’s licence on the SFC Public Register and confirm that the regulated activities match your intended business model before engaging legal counsel.
2. Obtain the target entity’s monthly FRR returns for the preceding 12 months — the audited accounts are not sufficient to assess capital adequacy.
3. File the change-in-control notification and the new RO applications simultaneously to avoid sequencing delays that can halt regulated activity for months.
4. Include a 24-month indemnity for pre-closing regulatory liabilities in the SPA and require 10% to 15% of the purchase price to be held in escrow.
5. Budget for at least one SFC on-site inspection within the first 12 months after acquisition and allocate HK$300,000 to HK$500,000 for compliance remediation costs.

本文不構成法律建議。涉及個人案件請諮詢持牌律師。