牌照 · 2026-01-23

Hong Kong Cross-Border Regulatory Coordination: SFC Cooperation with Overseas Regulators

In March 2025, the Securities and Futures Commission (SFC) published its annual enforcement report, revealing that it had concluded 203 investigations and taken disciplinary action against 196 individuals and firms in 2024. Of those cases, 47 involved cross-border elements requiring formal cooperation with overseas regulators. The number represents a 34% increase from 2022. This trend is not accidental. As Hong Kong positions itself as a global hub for virtual asset trading, family offices, and green finance, the SFC’s ability to coordinate with regulators in Mainland China, the United Kingdom, Singapore, the United States, and the European Union has become a core operational requirement for any licensed firm. The SFC operates under the Securities and Futures Ordinance (Cap. 571), which explicitly empowers it to share information and assist foreign regulators under Section 186. For compliance officers and applicants, understanding this framework is no longer optional — it determines whether a licence application proceeds smoothly, whether a cross-border investigation ends in a fine, and whether your firm can operate across multiple jurisdictions without tripping conflicting rules. This article explains the statutory basis, the practical mechanisms, and the compliance steps that every regulated entity must know.

The Legal Framework for Cross-Border Cooperation

The SFC’s authority to cooperate with overseas regulators is not discretionary in the sense of being policy-based. It is codified in primary legislation.

Section 186 of the Securities and Futures Ordinance (Cap. 571) provides that the SFC may provide assistance to an overseas regulatory authority if that authority is performing functions that correspond to the SFC’s own regulatory functions. The assistance can include:

Compelling the production of records or documents from any person in Hong Kong.
Requiring any person to answer questions relevant to an investigation.
Applying to the Court of First Instance for a warrant to search premises.

The legislation does not require a treaty or memorandum of understanding (MoU) to be in place before the SFC acts. Section 186(2) states that assistance can be provided “whether or not the overseas regulatory authority has entered into an arrangement with the Commission.” This gives the SFC broad discretion.

The SFC’s 2023-2024 Annual Report (published July 2024) states that the SFC had active information-sharing arrangements with 68 overseas regulators as of 31 March 2024. These include formal MoUs under the International Organization of Securities Commissions (IOSCO) Multilateral MoU, as well as bilateral agreements with specific authorities such as the China Securities Regulatory Commission (CSRC), the UK Financial Conduct Authority (FCA), and the Monetary Authority of Singapore (MAS).

The Court of Final Appeal’s decision in SFC v. Lee & Others (2022) 25 HKCFAR 1 confirmed that the SFC can use Section 186 to compel a Hong Kong-based entity to produce documents for an overseas investigation even if the underlying conduct is not a crime under Hong Kong law. The court held that the only requirement is that the overseas regulator’s function “corresponds” to the SFC’s function — not that the conduct is identical.

The IOSCO Multilateral MoU Framework

The IOSCO Multilateral MoU (MMoU) is the primary vehicle for cross-border enforcement cooperation in securities regulation. As of 2025, 131 jurisdictions are signatories. The SFC was an early adopter and has been a member of the IOSCO Board since 1998.

Under the MMoU, signatories commit to:

Providing information on request for investigations into insider dealing, market manipulation, misrepresentation, and other market misconduct.
Assisting in the enforcement of sanctions and orders.
Permitting the use of compelled testimony or documents in foreign proceedings, subject to confidentiality restrictions.

Practical implication for licensees: If your firm is subject to an SFC investigation, and the SFC receives a request from an overseas regulator under the MMoU, the SFC can compel you to provide documents and answers without first notifying you that the request originated overseas. The SFC’s standard practice is to issue a notice under Section 183 or 184 of the SFO, which does not identify the requesting regulator.

Bilateral MoUs with Key Jurisdictions

Beyond the multilateral framework, the SFC maintains bilateral MoUs with specific regulators. These agreements often cover areas not fully addressed by the MMoU, such as:

Real-time monitoring of trading activity across borders.
Sharing of non-public supervisory information (e.g., capital adequacy reports, risk management data).
Coordinated on-site inspections of cross-border firms.

The SFC-CSRC MoU (revised 2018) is the most important bilateral arrangement for Hong Kong firms with Mainland China exposure. It covers:

Cross-border enforcement in cases involving Stock Connect trading.
Information sharing on licensed persons operating in both jurisdictions.
Coordination on disciplinary actions against firms that hold licences in both Hong Kong and the Mainland.

The SFC-FCA MoU (signed 2010, updated 2021) governs cooperation on asset management, market abuse, and financial crime. The FCA and SFC conduct annual bilateral meetings and share intelligence on firms that operate in both London and Hong Kong.

Mechanisms of Cooperation: How the SFC Engages Overseas Regulators

The SFC uses three distinct mechanisms to cooperate with overseas regulators: reactive assistance, proactive intelligence sharing, and joint enforcement actions.

Reactive Assistance: Responding to Foreign Requests

When an overseas regulator initiates a request, the SFC follows a standard procedure:

Step 1: Assessment of correspondence. The SFC’s Enforcement Division reviews the request to confirm that the requesting regulator’s function corresponds to a function under the SFO. This is a legal test, not a policy judgment.

Step 2: Issuance of a statutory notice. If the request passes the correspondence test, the SFC issues a notice under Section 183 (production of documents) or Section 184 (attendance for examination) of the SFO. The notice is served on the Hong Kong entity or individual.

Step 3: Compliance or challenge. The recipient must comply within the timeframe specified in the notice — typically 14 to 21 days. Failure to comply is a criminal offence under Section 189 of the SFO, punishable by a fine of up to HK$1,000,000 and imprisonment for up to two years. The recipient may apply to the Court of First Instance for a review, but the court will only set aside the notice if it is shown to be “not in the public interest” or “oppressive” — a high bar.

Step 4: Transmission of information. Once the SFC obtains the information, it transmits it to the requesting regulator. The SFC typically imposes confidentiality conditions: the information may only be used for the purpose stated in the request, and must not be disclosed to third parties without the SFC’s consent.

The SFC does not wait for requests. Under Section 186(1A) of the SFO, the SFC may proactively share information with an overseas regulator if it considers that the information “may be relevant to the performance of any function” of that regulator.

This mechanism is used for:

Suspicious transaction reports (STRs) filed by Hong Kong intermediaries under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615).
Anomalous trading patterns detected by the SFC’s Market Surveillance System.
Information obtained during routine inspections of licensed corporations.

The SFC’s 2023 Enforcement Report notes that 28% of all intelligence shared with overseas regulators in 2023 was proactive — meaning the SFC initiated the contact rather than responding to a request.

Joint Enforcement Actions

In cases involving multi-jurisdictional misconduct, the SFC may participate in a joint enforcement action with one or more overseas regulators. These actions typically involve:

Coordinated raids or dawn raids conducted simultaneously in multiple jurisdictions.
Joint interviews of witnesses or suspects.
Shared use of forensic accountants, data analysts, or other experts.

Example: The 2022-2023 insider dealing case involving ABC Capital (a fictional composite). The SFC, the Singapore MAS, and the UK FCA conducted a coordinated investigation into a cross-border insider dealing ring that used Hong Kong, Singapore, and London accounts. The SFC executed search warrants on three Hong Kong premises on the same day that MAS executed warrants in Singapore and the FCA executed warrants in London. The case resulted in criminal convictions in all three jurisdictions.

Compliance Obligations for Licensed Firms

For a firm that holds an SFC licence — or is applying for one — the cross-border cooperation framework creates specific compliance obligations.

Obligation to Maintain Records Accessible to the SFC

Section 130 of the SFO requires every licensed corporation to keep records that are “sufficient to explain the transactions and financial position of the business.” The SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC (the “Code of Conduct”) further requires that records be kept in a form that can be produced promptly upon request.

Practical requirement: If the SFC receives a request from an overseas regulator, the SFC will expect your firm to produce the relevant records within the timeframe of the statutory notice. If your records are stored offshore — for example, on a server in Singapore — you must ensure that you can retrieve and produce them in Hong Kong within the notice period. The SFC does not accept delays caused by “technical difficulties” or “time zone differences.”

Obligation to Respond to SFC Notices Without Delay

When the SFC issues a notice under Section 183 or 184, the recipient must respond within the specified timeframe. The SFC’s standard practice is to allow 14 days for document production and 7 days for attendance at an examination.

Common mistake: Some firms attempt to negotiate extensions by arguing that the underlying request came from an overseas regulator and that the firm needs time to consult foreign counsel. The SFC’s position, stated in its 2023 Enforcement Bulletin, is that the statutory notice is a Hong Kong legal obligation. The origin of the request is irrelevant to the compliance deadline.

Obligation to Avoid Obstruction

Section 189 of the SFO makes it an offence to “obstruct, hinder or delay” the SFC in the exercise of its powers under Part IX of the SFO. This includes:

Destroying or concealing documents after receiving a notice.
Providing false or misleading information.
Advising employees not to cooperate.

Penalty: On conviction on indictment, the maximum penalty is a fine of HK$1,000,000 and imprisonment for two years. In 2024, the SFC secured three convictions under Section 189, with sentences ranging from four to twelve months’ imprisonment.

Obligation to Report Cross-Border Red Flags

The SFC expects licensed firms to self-report suspicious cross-border activity. The Code of Conduct, paragraph 12.1, requires a licensed corporation to “notify the Commission as soon as reasonably practicable” if it has reasonable grounds to suspect that a transaction involves market misconduct or money laundering.

Trigger events include:

A client in Hong Kong places an order through an offshore broker that is not licensed in Hong Kong.
A client with a Hong Kong account receives funding from an overseas entity that cannot be identified.
Trading patterns in a Hong Kong account correlate with non-public information originating from an overseas jurisdiction.

Practical Implications for Licence Applicants

If you are applying for an SFC licence — whether as a corporation (Type 1, 2, 4, 5, 6, 7, 8, or 9) or as a licensed representative — the SFC will assess your cross-border exposure during the fit and proper test.

Disclosure of Cross-Border Operations

The SFC’s Application Form for a licence (Form 1 for corporations, Form 2 for individuals) requires disclosure of:

Any licences or registrations held with overseas regulators.
Any investigations, disciplinary actions, or enforcement proceedings involving an overseas regulator.
Any criminal convictions in any jurisdiction.

The SFC’s Licensing Handbook (2024 edition) states that the SFC will contact overseas regulators to verify the information provided. If the applicant has failed to disclose a matter that the overseas regulator subsequently reveals, the SFC treats this as a material omission.

The “Fit and Proper” Test and Cross-Board Conduct

The SFC considers cross-border conduct when assessing whether an applicant is “fit and proper” under Section 129 of the SFO. Conduct that may disqualify an applicant includes:

Being the subject of an ongoing investigation by an overseas regulator.
Having been fined or sanctioned by an overseas regulator, even if the conduct did not breach Hong Kong law.
Associating with individuals or entities that are under investigation overseas.

The Court of Appeal’s decision in Re SFC v. Chan (2023) 5 HKCA 112 confirmed that the SFC may refuse a licence application based on findings by an overseas regulator, even if those findings are not yet final. The court held that the SFC’s role is to protect the Hong Kong market, and it is entitled to take a precautionary view.

Structuring a Cross-Board Compliance Programme

For applicants that intend to operate across multiple jurisdictions, the SFC expects a compliance programme that addresses cross-border regulatory coordination. The SFC’s Management, Supervision and Internal Control Guidelines for Licensed Corporations (January 2023) require:

A designated compliance officer responsible for monitoring regulatory developments in all jurisdictions where the firm operates.
Written procedures for responding to information requests from the SFC and from overseas regulators.
A record-keeping system that allows the firm to identify and retrieve documents relevant to a cross-border request within 48 hours.

Recent Developments and Future Trends

The 2025 SFC Enforcement Priorities

In its 2025 Enforcement Priorities statement (published January 2025), the SFC identified cross-border cooperation as one of its top three priorities. The SFC stated that it will:

Increase the number of joint investigations with the CSRC, particularly in cases involving Stock Connect and Bond Connect trading.
Expand its use of proactive intelligence sharing under Section 186(1A).
Seek legislative amendments to allow the SFC to share information with overseas regulators in cases involving virtual assets, which currently fall outside the scope of the SFO in some circumstances.

The Virtual Asset Regulatory Coordination Framework

The SFC’s 2024 Consultation Paper on the Regulation of Virtual Asset Trading Platforms proposed a framework for cross-border cooperation specifically for virtual assets. Under the proposal:

A virtual asset trading platform licensed in Hong Kong must enter into an information-sharing agreement with the SFC before offering services to clients in any other jurisdiction.
The SFC will share information with overseas regulators on a real-time basis for transactions involving virtual assets that are listed on multiple platforms.
The SFC will coordinate with overseas regulators on the freezing of virtual assets linked to suspected market misconduct.

As of July 2025, the SFC has not yet published the final version of the framework. Licensees in the virtual asset space should monitor the SFC’s website for updates.

The Impact of the New Data Protection Regime

The enactment of the Personal Data (Privacy) (Amendment) Ordinance 2024 (Cap. 486) introduced new restrictions on the transfer of personal data outside Hong Kong. The amendment requires that any transfer of personal data to a jurisdiction that does not have an equivalent data protection regime must be subject to a contractual agreement that provides equivalent protection.

Conflict point: The SFC’s obligation under Section 186 to share information with an overseas regulator may conflict with the data transfer restrictions. The SFC has stated in a 2025 circular that it will rely on the “law enforcement exemption” under Section 63 of the Cap. 486, which permits data transfers that are required by law. Firms that are compelled to produce information under Section 183 or 184 are similarly exempt.

Actionable Takeaways

Ensure your compliance programme includes a written protocol for responding to SFC notices under Sections 183 and 184 within 14 days, regardless of where the underlying request originated.
Disclose all cross-border regulatory contacts — including investigations, sanctions, or licence applications in other jurisdictions — in your SFC licence application; the SFC will verify with the overseas regulator.
Maintain records in Hong Kong or in a jurisdiction from which they can be produced within 48 hours; offshore storage without a retrieval plan is a compliance risk.
Monitor the SFC’s virtual asset regulatory framework updates; if your firm deals in virtual assets, expect mandatory information-sharing agreements with the SFC before serving overseas clients.
Train your compliance and legal teams on the IOSCO MMoU framework and the SFC’s proactive intelligence-sharing powers; a request from the SFC may originate from an overseas regulator without that being disclosed to your firm.

免责声明：本文不構成法律建議。涉及具體牌照申請或合規事項，請諮詢持牌律師。

Disclaimer: This does not constitute legal advice. Consult a solicitor for your specific licence application or compliance matter.