SFC and CSRC Cross-Border Regulatory Cooperation: Stock Connect Compliance Requirements

On 1 January 2025, the China Securities Regulatory Commission (CSRC) published its revised Administrative Measures for the Pilot Program of Cross-Border Securities Investment by Securities Companies (the “Pilot Measures”), effective immediately. This revision expands the scope of eligible cross-border trading activities under the Stock Connect schemes, but it simultaneously tightens the compliance obligations for Hong Kong-licensed intermediaries that facilitate these trades. For the first time, the CSRC explicitly requires Hong Kong brokers operating under Stock Connect to maintain a “continuous and effective” internal control framework that must be notified to both the CSRC and the Securities and Futures Commission (SFC) in Hong Kong. The SFC responded on 15 January 2025 with a circular reminding all licensed corporations (LCs) that their obligations under the SFC’s Code of Conduct (the “Code”) and the Securities and Futures Ordinance (Cap. 571) are not displaced by the PRC rules. This article sets out the current regulatory architecture, the specific compliance requirements for Hong Kong intermediaries, and the practical steps firms must take to avoid enforcement action.

The Regulatory Architecture of Stock Connect

The Stock Connect programmes — Shanghai-Hong Kong Stock Connect, Shenzhen-Hong Kong Stock Connect, and Bond Connect — operate under a dual-regulatory framework. The SFC regulates the Hong Kong leg of the trades under the Securities and Futures Ordinance (Cap. 571) and the SFC’s Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the “Code”). The CSRC regulates the Mainland leg under the Securities Law of the People’s Republic of China and the Measures for the Administration of Securities and Futures Investment by Qualified Foreign Institutional Investors (QFII/RQFII rules). The 2025 Pilot Measures add a third layer: direct CSRC oversight of Hong Kong intermediaries that solicit or execute cross-border orders on behalf of PRC clients.

The SFC’s Position on Cross-Border Activities

The SFC’s Circular to Licensed Corporations on Cross-Border Securities Activities (January 2025) states that any Hong Kong-licensed corporation that “solicits, markets, or executes orders for securities listed on a PRC exchange through Stock Connect” must comply with both Hong Kong law and the PRC rules. The SFC does not recognise any “safe harbour” for non-compliance with the Pilot Measures. The circular specifically references section 103 of the Securities and Futures Ordinance (Cap. 571), which prohibits the issue of advertisements or invitations to the public unless an exemption applies. The SFC’s position is that a Hong Kong intermediary that markets Stock Connect products to PRC residents without a proper exemption under the PRC rules commits an offence under Hong Kong law, because the act of marketing itself constitutes a regulated activity under Cap. 571.

The CSRC’s Pilot Measures (2025 Revision)

The revised Pilot Measures, published on 1 January 2025, contain three key changes. First, Article 7 now requires Hong Kong intermediaries to file a “Cross-Border Securities Business Plan” with the CSRC within 10 business days of commencing any solicitation activity directed at PRC residents. Second, Article 12 requires the Hong Kong intermediary to maintain a “client suitability assessment system” that is consistent with the CSRC’s Provisions on the Suitability Management of Securities and Futures Investors (2023). Third, Article 19 imposes a reporting obligation: the Hong Kong intermediary must notify the CSRC within 24 hours of any “material compliance incident” — defined as any event that could reasonably lead to a regulatory investigation by the SFC or the CSRC.

Step-by-Step Compliance Requirements for Hong Kong Intermediaries

Hong Kong-licensed corporations that handle Stock Connect orders must implement a three-step compliance framework that addresses both the SFC’s Code and the CSRC’s Pilot Measures.

Step 1: Register the Cross-Border Business Plan

The first step is to file the Cross-Border Business Plan with the CSRC. The plan must include: (a) a description of the target client base in the PRC; (b) the types of securities that will be marketed; (c) the internal control procedures for client suitability assessment; and (d) the identity of the responsible officer in Hong Kong who will serve as the primary contact for CSRC inquiries. The SFC’s January 2025 circular confirms that the SFC will accept a copy of this filing as satisfying the SFC’s own notification requirement under paragraph 12.1 of the Code.

Step 2: Align Client Suitability Procedures

The CSRC’s Provisions on the Suitability Management of Securities and Futures Investors (2023) require that a “professional investor” in the PRC context is defined differently from the Hong Kong definition under the Securities and Futures Ordinance (Cap. 571). In Hong Kong, a professional investor is an individual with a portfolio of at least HKD 8 million (Schedule 1, Part 1, Cap. 571). In the PRC, the threshold is RMB 5 million in financial assets (Article 8 of the 2023 Provisions). A Hong Kong intermediary that treats a PRC client as a professional investor based on the Hong Kong threshold alone may be in breach of the CSRC rules. The SFC’s circular advises that LCs should apply the higher threshold — RMB 5 million — when dealing with PRC-resident clients.

Step 3: Establish a 24-Hour Incident Reporting Mechanism

The CSRC’s Article 19 requires notification within 24 hours of a “material compliance incident”. The SFC’s own reporting requirement under paragraph 12.2 of the Code is 7 business days for “any material breach of any law, rule or regulation”. The SFC’s January 2025 circular clarifies that the 24-hour CSRC deadline does not replace the 7-business-day SFC deadline. A Hong Kong intermediary must report to both regulators separately. The SFC will treat a failure to report to the CSRC within 24 hours as a “material breach” of the SFC’s own Code, triggering the 7-business-day reporting obligation under paragraph 12.2.

Enforcement Risks and Recent Case Studies

The SFC and CSRC have signalled a coordinated enforcement approach. In December 2024, the SFC issued a reprimand and fined a Hong Kong broker HKD 4.5 million for failing to maintain proper client records for Stock Connect orders (SFC Enforcement News, December 2024). The SFC found that the broker had not segregated PRC client orders from Hong Kong client orders, and had not applied the correct suitability thresholds. The CSRC simultaneously issued an administrative warning to the same broker’s Mainland affiliate for “failure to supervise its Hong Kong subsidiary’s compliance with the Pilot Measures”.

The “Double Enforcement” Risk

The SFC and CSRC have entered into a Memorandum of Understanding on Regulatory Cooperation in Securities and Futures Matters (the “MOU”), signed in 2023. The MOU provides for the exchange of enforcement information and the coordination of penalty actions. A Hong Kong intermediary that is investigated by the SFC can expect the CSRC to be notified within 14 days. The CSRC may then impose its own penalties under the PRC Securities Law, which include fines of up to RMB 10 million for a “serious violation” (Article 193). The SFC may impose a fine of up to HKD 10 million for the same conduct under section 303 of Cap. 571. The total potential liability for a single compliance failure can therefore exceed HKD 20 million.

Practical Example: The “Dual Client Onboarding” Trap

A Hong Kong broker that onboards a PRC resident as a client through an online platform must verify the client’s identity under both the SFC’s Anti-Money Laundering and Counter-Terrorist Financing Guidelines (2023) and the CSRC’s Measures for the Administration of Securities and Futures Investor Identity Verification (2024). The CSRC requires the collection of a PRC national identity number and a Mainland mobile phone number. The SFC requires the collection of a Hong Kong address or a travel document if the client is not a Hong Kong resident. The SFC’s December 2024 reprimand specifically cited a broker that had collected only the PRC national identity number and had not obtained the client’s Hong Kong address. The SFC held that this constituted a breach of paragraph 5.1 of the Code, which requires “reasonable steps” to establish a client’s identity and address.

Actionable Takeaways for Compliance Officers

1. File the Cross-Border Business Plan with the CSRC within 10 business days of commencing any solicitation activity directed at PRC residents, and send a copy to the SFC’s Licensing Department.
2. Apply the PRC professional investor threshold of RMB 5 million in financial assets for all PRC-resident clients, regardless of the Hong Kong HKD 8 million threshold.
3. Establish a 24-hour incident reporting mechanism that notifies both the CSRC and the SFC separately, with a designated responsible officer for each regulator.
4. Collect both the PRC national identity number and the Hong Kong address for every PRC-resident client onboarded through Stock Connect channels.
5. Review the SFC’s January 2025 circular and the CSRC’s revised Pilot Measures at least quarterly, as both regulators have signalled further revisions in the second half of 2025.

本文不構成法律建議。涉及個人案件請諮詢持牌律師。 / This does not constitute legal advice. Consult a solicitor for your specific case.