SFC Client Complaint Handling Procedures: Internal Processing and External Referral Mechanisms

In July 2024, the Securities and Futures Commission (SFC) published its revised Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the Code of Conduct), introducing a new paragraph 12.2. This amendment, effective from 1 January 2025, mandates that all licensed corporations and registered institutions maintain a dedicated complaints handling function. The change closes a long-standing gap: previously, the Code only required a general “proper system” for complaints. Now, a named person or team must be responsible for oversight. This shift follows a 2023 SFC thematic review of 30 licensed corporations, which found that 40% lacked a formal escalation procedure for serious complaints. For any firm holding a Type 1 (dealing in securities) or Type 4 (advising on securities) licence, the new requirement is not optional. The SFC’s enforcement division has stated that a failure to designate a complaints officer will be treated as a breach of the Code, carrying potential disciplinary action under section 194 of the Securities and Futures Ordinance (Cap. 571). This article sets out the internal processing steps and external referral mechanisms every licensed corporation must now implement.

Internal Complaint Processing: The Three-Step Mandate

The SFC’s Code of Conduct, under paragraph 12.1, requires a licensed corporation to establish a written complaints handling policy. The 2025 amendment adds paragraph 12.2, requiring the appointment of a designated complaints officer. The internal process must follow a defined sequence.

Step 1: Receipt and Acknowledgement

The firm must log every complaint in a central register within one business day of receipt. The register must record the date, the complainant’s name, the product or service in question, and the nature of the grievance. The SFC’s Guidelines on Complaints Handling (December 2023) specify that the firm must acknowledge receipt in writing within five business days. The acknowledgement must include the name and contact details of the designated complaints officer.

The definition of a complaint is broad. The SFC defines it as any expression of dissatisfaction, whether oral or written, about the firm’s provision of a regulated activity. A verbal complaint made to a relationship manager counts. The firm cannot dismiss it as informal. The register must capture it.

Step 2: Investigation and Timeframe

The designated complaints officer must assign the matter to an investigating team that is independent of the business unit involved. The SFC’s Thematic Review Report on Complaints Handling (2023) found that 25% of firms allowed the same team that handled the transaction to investigate the complaint. This creates a conflict of interest. The Code now requires separation.

The investigation must be completed within 30 calendar days for standard complaints. For complex matters involving multiple jurisdictions or forensic accounting, the firm may extend this to 60 calendar days. The firm must notify the complainant of any extension in writing, stating the reason and the expected completion date.

Step 3: Outcome and Response

The firm must issue a final response letter that sets out the investigation’s findings, the firm’s conclusions, and any remedial action offered. The letter must inform the complainant of their right to refer the matter to the SFC if they remain dissatisfied. The SFC’s Code of Conduct paragraph 12.3 requires that this response be provided within eight weeks of the initial complaint. If the firm cannot meet this deadline, it must inform the SFC in writing.

Record-Keeping Requirements

The SFC’s Record Keeping Guidelines (Cap. 571 subsidiary legislation) require that all complaint files be retained for at least seven years after the complaint is closed. This includes all correspondence, investigation notes, and the final response. The SFC may request these records during an on-site inspection. A failure to produce them within 14 days constitutes a separate regulatory breach.

The 2023 thematic review found that 15% of firms had no central complaint register. These firms were required to submit a remediation plan to the SFC within 30 days. Any firm currently without a register should treat this as an immediate compliance gap.

External Referral Mechanisms: The SFC’s Role and the Investor Compensation Fund

When internal resolution fails, the complainant has two external avenues: the SFC’s direct complaints channel and the Investor Compensation Company (ICC). Each has distinct triggers and procedures.

The SFC Complaints Channel

The SFC accepts complaints from any person who believes a licensed corporation has breached the Code of Conduct or the Securities and Futures Ordinance. The SFC’s Complaints Handling Policy (updated March 2024) states that the SFC will only investigate after the firm has had a reasonable opportunity to resolve the matter internally. The complainant must provide a copy of the firm’s final response letter.

The SFC does not act as a mediator. It investigates potential regulatory breaches. If the SFC finds evidence of misconduct, it may take disciplinary action under section 194 of Cap. 571, which includes fines, suspension, or revocation of licence. The SFC does not award compensation to the complainant. Its role is enforcement, not restitution.

In 2024, the SFC received 2,847 complaints against licensed corporations, according to its Annual Report 2024. Of these, 68% were resolved through the SFC’s preliminary assessment without a full investigation. The remaining 32% proceeded to formal investigation. The average time from complaint receipt to investigation outcome was 14 months.

The Investor Compensation Fund (ICF)

The ICF, administered by the Investor Compensation Company (ICC) under section 236 of Cap. 571, provides compensation to investors who suffer financial loss due to a default by a licensed intermediary. A default means the firm becomes insolvent, bankrupt, or subject to winding-up proceedings.

The ICF covers losses from dealing in securities (Type 1) and futures contracts (Type 2). The cap is HKD 500,000 per claimant per default event. The ICF does not cover losses from poor advice, market volatility, or product mis-selling. It only covers the loss of assets held by the firm at the time of default.

To claim, the investor must submit a claim form to the ICC within three months of the default event. The ICC’s Claims Processing Manual (2024) requires the claimant to provide proof of the account balance and the default. The ICC aims to process claims within six months.

The Role of the Hong Kong Police and ICAC

If the complaint involves fraud, forgery, or bribery, the firm must report it to the Hong Kong Police or the Independent Commission Against Corruption (ICAC). The SFC’s Reporting Obligations under the Code of Conduct paragraph 12.4 requires a licensed corporation to report any suspected criminal activity to the relevant authorities within seven days of discovery. Failure to do so is a breach of the Code and may constitute an offence under section 113 of Cap. 571.

The Police’s Commercial Crime Bureau handles cases involving securities fraud. The ICAC handles cases involving bribery of staff or public officials. The firm must not wait for the internal investigation to conclude before making this external referral.

Cross-Border Complaints and the Role of the SFC’s International Cooperation

Hong Kong is a signatory to the International Organization of Securities Commissions (IOSCO) Multilateral Memorandum of Understanding (MMoU). This allows the SFC to share information and cooperate with overseas regulators on cross-border complaints.

The IOSCO MMoU Framework

The MMoU, signed by 130 jurisdictions, allows the SFC to request assistance from an overseas regulator when a complaint involves a firm licensed in that jurisdiction. For example, if a Hong Kong client of a US broker-dealer files a complaint, the SFC can request the US Securities and Exchange Commission (SEC) to investigate. The SFC’s International Cooperation Policy (2023) states that it processes an average of 150 cross-border requests per year.

The SFC does not enforce foreign regulatory decisions. It only shares information. The overseas regulator must take its own enforcement action.

The Mainland China Channel

For complaints involving mainland Chinese firms operating in Hong Kong, the SFC works with the China Securities Regulatory Commission (CSRC) under the Memorandum of Understanding on Cross-Border Securities Enforcement (signed 2003, updated 2018). This MOU covers complaints about mainland firms that hold SFC licences.

The SFC’s Annual Report 2024 notes that 12% of complaints received in 2024 involved mainland-connected entities. The SFC refers these to the CSRC’s Enforcement Bureau for follow-up. The firm must ensure its internal complaint handling policy addresses the possibility of a cross-border referral.

Practical Steps for Firms with Cross-Border Operations

A firm with clients in multiple jurisdictions must maintain a complaint register that captures the client’s jurisdiction of residence. The SFC’s Guidelines on Cross-Border Compliance (2022) require the firm to identify which regulator has primary jurisdiction over the complaint. If the complaint involves a product sold in Hong Kong but the client resides in Singapore, the firm must report the matter to both the SFC and the Monetary Authority of Singapore (MAS) under the IOSCO MMoU.

The firm must also maintain a list of contact points for each overseas regulator. The SFC’s Complaints Handling Policy requires the firm to provide this list to the designated complaints officer.

The Regulatory Consequences of Non-Compliance

The SFC’s enforcement powers under section 194 of Cap. 571 include the ability to reprimand, fine, suspend, or revoke a licence. The 2025 amendment to the Code of Conduct makes the complaints handling function a direct licence condition.

Disciplinary Actions in 2024

In 2024, the SFC took disciplinary action against 12 licensed corporations for complaints handling failures. The SFC’s Enforcement Report 2024 lists the following cases:

• Firm A (Type 1 licence): Fined HKD 2.5 million for failing to log 47 complaints in the central register over a three-year period. The SFC found that the firm’s designated complaints officer was a junior staff member with no authority to escalate matters to senior management.
• Firm B (Type 4 and Type 9 licences): Fined HKD 1.8 million for failing to provide a final response letter to 12 complainants within the eight-week deadline. The firm had no written policy for extensions.
• Firm C (Type 1 licence): Licence suspended for two months for failing to report a suspected fraud case to the Police within seven days. The firm’s internal investigation took three months, during which the suspect left the jurisdiction.

These cases illustrate that the SFC treats complaints handling as a core compliance function, not a customer service task.

The Personal Liability of the Designated Complaints Officer

The SFC’s Code of Conduct paragraph 12.2 states that the designated complaints officer must be a person with sufficient seniority and authority. The SFC’s Guidelines on the Management of Licensed Corporations (2023) specify that this person must be a director or a senior manager reporting directly to the board.

If the designated complaints officer fails to discharge their duties, the SFC may take action against them personally under section 194(2) of Cap. 571, which allows the SFC to disqualify a person from being a director or manager of a licensed corporation. In 2024, the SFC disqualified two senior managers for complaints handling failures, barring them from the industry for three and five years respectively.

Actionable Takeaways

• Appoint a designated complaints officer who holds a director-level position and reports directly to the board, as mandated by the SFC’s Code of Conduct paragraph 12.2 effective January 2025.
• Maintain a central complaint register that logs every expression of dissatisfaction within one business day, and retain all records for seven years as required by Cap. 571 subsidiary legislation.
• Issue a final response letter within eight weeks of the initial complaint, and inform the complainant of their right to refer the matter to the SFC if they remain dissatisfied.
• Report any suspected criminal activity to the Hong Kong Police or ICAC within seven days of discovery, without waiting for the internal investigation to conclude.
• Establish a cross-border complaint protocol that identifies the primary regulator for each client jurisdiction and maintains contact points for IOSCO MMoU partners.

This does not constitute legal advice. Consult a solicitor for your specific case.