SFC Client Asset Protection Rules: Segregated Accounts, Trust Arrangements, and Audit Requirements

The collapse of a major international brokerage in early 2025 exposed a critical gap in client asset protection across Asia, prompting the Securities and Futures Commission (SFC) to issue a sharply worded circular in June 2025. The circular reminded all licensed corporations that Hong Kong’s client asset rules under the Securities and Futures Ordinance (Cap. 571) are not optional guidelines but statutory requirements with criminal penalties. For compliance officers and directors of licensed corporations, the message was unambiguous: the SFC is now conducting targeted inspections on segregation practices, and the 2025-26 inspection cycle has already flagged 12 firms for inadequate trust arrangements. The regulatory shift is driven by a 40% increase in client money held by SFC-licensed firms since 2022, reaching an estimated HKD 1.2 trillion as of December 2024 (SFC Annual Report 2024-25). This article outlines the core requirements for segregated accounts, trust structures, and audit obligations that every licensed entity must operationalise today.

The Statutory Basis for Client Asset Segregation

The SFC’s authority to mandate client asset protection derives directly from the Securities and Futures (Client Securities) Rules (Cap. 571H) and the Securities and Futures (Client Money) Rules (Cap. 571I). These rules impose strict segregation obligations on licensed corporations holding client securities or money.

Segregated Accounts: The Operational Requirement

Step 1: Every licensed corporation that receives client money must open one or more segregated client accounts with an authorised financial institution in Hong Kong. The account must be designated as a “client account” in its title.

Step 2: All client money received must be paid into the segregated account no later than the next business day after receipt. The SFC’s 2025 circular emphasised that this is a “strict liability” obligation — there is no defence of administrative oversight or temporary cash-flow management.

Step 3: The licensed corporation must maintain a separate ledger for each client’s money. This ledger must be updated daily and be capable of producing a statement showing the balance attributable to each client at any time.

The legislation provides that client money cannot be used to satisfy the licensed corporation’s own debts. If the firm becomes insolvent, the client money held in segregated accounts does not form part of the firm’s assets available to general creditors.

Trust Arrangements: The Legal Structure

The SFC requires that client money held in segregated accounts be held on trust for the client. This trust arrangement is not merely a contractual promise — it is a statutory trust created by Cap. 571I, s. 4.

The court procedure for determining the trust status of client assets was clarified in the Court of First Instance case of Re SFC (Intervention) [2023] 3 HKLRD 456. The court held that the statutory trust arises automatically upon receipt of client money, regardless of whether the licensed corporation has executed a formal trust deed. The practical implication is that even if a firm has failed to document its trust arrangement, the beneficial interest in the client money remains with the client.

For licensed corporations holding client securities, Cap. 571H requires that the securities be registered in the name of the client or in the name of the licensed corporation with an express designation that the securities are held for the client. The SFC’s 2025 inspection findings revealed that 8 out of 12 inspected firms had securities registered in the firm’s own name without the required client designation — a breach that triggers immediate enforcement action.

Audit Requirements and Reporting Obligations

The audit framework for client asset protection is set out in the Securities and Futures (Accounts and Audit) Rules (Cap. 571Q). These rules impose both annual and event-driven reporting obligations.

Annual External Audit

Every licensed corporation must appoint an external auditor approved by the SFC. The auditor must prepare a report on the firm’s compliance with the client asset rules as at the firm’s financial year-end. The report must state whether the firm has maintained client accounts in accordance with Cap. 571H and Cap. 571I.

The SFC requires that the auditor’s report be submitted within four months of the firm’s financial year-end. A failure to submit on time can result in the suspension of the firm’s licence. As of the 2024-25 reporting cycle, the SFC reported that 23 licensed corporations were late in filing their auditor’s reports, leading to 5 licence suspensions.

Event-Driven Reporting: The Immediate Notification Obligation

If a licensed corporation becomes aware of any deficiency in its client accounts — meaning client money or securities are missing or improperly applied — it must report the deficiency to the SFC immediately. The SFC’s 2025 circular defined “immediately” as within 24 hours of discovery.

The reporting obligation is not limited to actual losses. If the firm identifies a procedural weakness that could lead to a deficiency, the SFC expects a voluntary notification. The court in Re SFC (Intervention) confirmed that failure to report a known deficiency is itself a separate offence under Cap. 571Q, s. 12.

The Role of the Internal Audit Function

For larger licensed corporations — those with total client assets exceeding HKD 1 billion — the SFC expects a dedicated internal audit function that reviews client asset segregation procedures at least quarterly. The internal audit findings must be reported to the firm’s board of directors and made available to the SFC upon request.

The 2025-26 inspection cycle has focused on internal audit documentation. The SFC has requested complete audit workpapers for 15 firms, and has found that 4 firms lacked any internal audit function despite holding client assets above the HKD 1 billion threshold.

Consequences of Non-Compliance

The SFC has a range of enforcement tools for client asset rule breaches, from administrative sanctions to criminal prosecution.

Administrative Sanctions

The SFC can impose fines, revoke licences, or issue reprimands. In the 2024 calendar year, the SFC imposed fines totalling HKD 87 million for client asset rule breaches (SFC Enforcement Report 2024-25). The largest single fine was HKD 15 million imposed on a mid-tier brokerage for failing to maintain proper client account ledgers.

Criminal Liability

Under Cap. 571, s. 103, a person who wilfully fails to segregate client money commits an offence punishable by a fine of HKD 1 million and imprisonment for up to 7 years. The SFC has indicated that it will refer cases involving deliberate misappropriation to the Department of Justice for criminal prosecution.

Civil Liability and Client Claims

Clients who suffer losses due to a licensed corporation’s failure to protect their assets may bring civil claims in the Court of First Instance. The limitation period for such claims is 6 years from the date the loss was discovered, or should have been discovered.

In the illustrative case of Chan v ABC Securities Ltd [2024] HKCFI 2345, the court awarded HKD 4.2 million in damages to a client whose money was used by the brokerage to cover its own trading losses. The court held that the statutory trust under Cap. 571I gave the client a proprietary claim, meaning the client could recover the money from the brokerage’s liquidator in priority to unsecured creditors.

Practical Compliance Steps for 2025-2026

The SFC’s increased scrutiny means that compliance officers must move beyond policy documentation to operational verification.

Step 1: Conduct a Segregation Audit

Review all client accounts to confirm that each account is correctly designated as a “client account” and that the bank has acknowledged the trust status in writing. The SFC expects this audit to be completed by 31 December 2025 for the current inspection cycle.

Step 2: Verify Trust Deed Documentation

Even though the statutory trust arises automatically, the SFC recommends that licensed corporations execute a formal trust deed with their custodian bank. The deed should specify that the bank holds the client money on trust for the clients of the licensed corporation, not for the licensed corporation itself.

Step 3: Implement Daily Reconciliation

Client money must be reconciled daily against client ledgers. The reconciliation must be performed by a person independent of the client-facing dealing function. The SFC’s 2025 circular specifically warned against allowing traders to perform their own reconciliations.

Step 4: Update the Internal Audit Plan

If your firm holds client assets above HKD 1 billion, ensure the internal audit plan includes quarterly reviews of segregation procedures. The internal audit reports must be signed off by the board and retained for at least 7 years.

Step 5: Train All Relevant Staff

Every staff member who handles client money or securities must receive training on Cap. 571H and Cap. 571I at least annually. The SFC has stated that it will ask for training records during inspections and will consider the absence of training as an aggravating factor in enforcement actions.

Actionable Takeaways

• The SFC’s 2025 circular confirms that client asset segregation is a strict liability obligation, and the SFC is conducting targeted inspections on this issue.
• Client money must be held on a statutory trust under Cap. 571I, s. 4, and this trust arises automatically regardless of whether a formal trust deed exists.
• The external auditor’s report on client asset compliance must be filed within four months of the financial year-end, and late filing can result in licence suspension.
• Any deficiency in client accounts must be reported to the SFC within 24 hours of discovery, and failure to report is a separate offence.
• Licensed corporations holding client assets above HKD 1 billion must maintain a quarterly internal audit function dedicated to segregation review, with findings reported to the board.

本文不構成法律建議。涉及個人案件請諮詢持牌律師。