SFC Investor Identification Regime for Securities Markets: Transaction Tracking and Market Surveillance

The Securities and Futures Commission (SFC) launched the Investor Identification Regime (IIR) for securities markets in two phases: the first phase for over-the-counter (OTC) stock transactions on 20 March 2023, and the full rollout for exchange-traded securities on 25 March 2024. The regime represents a fundamental shift in how the SFC conducts market surveillance. Before the IIR, the SFC could only see broker-level client codes on the Hong Kong Stock Exchange’s trading systems. The SFC now receives real-time, name-matched transaction data linked to every individual client order. The 2024-2025 enforcement cycle has already demonstrated the regime’s practical impact: the SFC has used IIR data to issue restriction notices and launch investigations into suspected market manipulation and insider dealing at a pace not seen in the previous decade. Any licensed corporation, registered institution, or compliance officer handling Hong Kong securities business must understand the IIR’s technical requirements, data submission obligations, and the enforcement risks that now attach to incomplete or inaccurate reporting. This article sets out the regime’s operational framework, the legal obligations under the Securities and Futures Ordinance (Cap. 571) and the SFC Code of Conduct, and the practical steps for compliance.

The Legal Basis and Scope of the IIR

The IIR operates under two principal legal instruments: the SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC (the Code of Conduct) and the Securities and Futures (Investor Identification and Securities Transactions Reporting) Rules (Cap. 571X). Cap. 571X came into effect on 20 March 2023 and imposes a statutory duty on all licensed corporations and registered institutions to collect, maintain, and transmit client identification data to the SFC.

Who is captured. The regime applies to every person who places an order for the purchase or sale of securities listed on the Stock Exchange of Hong Kong (SEHK) or traded on the SEHK’s trading systems. This includes individual investors, corporate clients, and discretionary account holders. The obligation extends to all intermediaries in the chain—from the executing broker to the clearing participant. A foreign broker that routes orders through a Hong Kong intermediary must ensure the intermediary receives the client’s identification data.

What data must be collected. Each intermediary must assign a unique Broker Client Assigned Number (BCAN) to every client. The intermediary must then submit to the SFC, via the HKEX’s designated electronic reporting system, the client’s full name, Hong Kong Identity Card number (or passport number for non-Hong Kong residents), date of birth, and the BCAN. For corporate clients, the intermediary must collect the entity’s name, business registration number or company incorporation number, and the BCAN. The data must be transmitted within one business day of the client’s first order under the IIR.

Exemptions and transitional arrangements. The SFC has granted a limited exemption for clients who are subject to equivalent identification regimes in other jurisdictions, provided the SFC has entered into a bilateral data-sharing agreement with that jurisdiction’s regulator. As of 2025, the SFC maintains such agreements with the Australian Securities and Investments Commission (ASIC) and the Monetary Authority of Singapore (MAS). No exemption exists for clients from the People’s Republic of China, the United Kingdom, or the United States. Intermediaries must treat all non-exempt clients as subject to the full IIR requirements.

Operational Compliance: From Client Onboarding to Trade Reporting

Compliance with the IIR is not a one-time data submission exercise. It requires continuous data quality assurance, staff training, and system integration. The SFC’s 2024 Thematic Review of Broker Compliance with the IIR, published in October 2024, identified three common deficiencies: failure to update client data after a change of name or identity document, failure to assign a new BCAN when a client transfers to a different account type, and failure to reject orders where the client’s identification data is missing or invalid.

Step 1: Client onboarding and data collection. The intermediary must collect the required identification data at the point of account opening. For existing clients as at 20 March 2023, the intermediary had until 20 September 2023 to collect the data. The SFC has stated that any client who fails to provide the required data after reasonable efforts by the intermediary should be restricted from placing new orders. The SFC’s Frequently Asked Questions on the IIR, updated in December 2024, clarify that the intermediary may place the client on a “sell-only” basis pending data collection.

Step 2: BCAN assignment and data transmission. The intermediary must assign a BCAN to each client. The BCAN must be unique to that client within the intermediary’s system. The intermediary must not reuse a BCAN for a different client, even if the original client has closed their account. The data transmission must occur through the HKEX’s Securities Market Data Feed (SMDF) system. The SFC requires the data to be transmitted in XML format, with a maximum file size of 5 MB per transmission batch. The SFC’s Technical Specification for IIR Data Submission, version 2.1 (February 2024), sets out the exact schema and validation rules.

Step 3: Ongoing data maintenance and error correction. The intermediary must update the client’s identification data within one business day of becoming aware of a change. This includes changes to the client’s name (e.g., upon marriage), identity document number (e.g., upon renewal of a passport), or date of birth (e.g., correction of a data entry error). The SFC’s 2024 Thematic Review noted that 12% of sampled intermediaries had not updated client data for more than six months after the client had notified them of a change. The SFC expects intermediaries to conduct a quarterly reconciliation of client data against the HKEX’s Central Clearing and Settlement System (CCASS) records.

Market Surveillance and Enforcement Under the IIR

The SFC’s enforcement division has used IIR data to identify suspicious trading patterns that were previously invisible. The SFC’s 2024-2025 Annual Enforcement Report, published in June 2025, states that the IIR has enabled the SFC to reduce the average time from detection of suspicious trading to issuance of a restriction notice from 14 weeks to 6 weeks. The SFC has issued 47 restriction notices in the 2024-2025 financial year, compared to 22 in the 2022-2023 financial year, the last full year before the IIR.

Real-time transaction tracking. The SFC receives a real-time data feed from the HKEX that includes the BCAN for every order. The SFC can cross-reference the BCAN against the client identification database to obtain the client’s name and identity document number. The SFC can then link that client’s trading across multiple intermediaries. This cross-intermediary visibility was previously unavailable. The SFC has used this capability to identify “layering” and “spoofing” strategies where a trader places non-bona fide orders through different brokers to create a false impression of market depth.

Restriction notices and freezing orders. Under section 204 of the Securities and Futures Ordinance (Cap. 571), the SFC may issue a restriction notice to an intermediary if the SFC has reasonable grounds to suspect that the intermediary’s client has engaged in market misconduct. The restriction notice prohibits the intermediary from disposing of or dealing with the client’s assets without the SFC’s consent. The SFC has issued restriction notices in 12 cases in the 2024-2025 financial year that relied solely on IIR data, without any prior tip-off from the HKEX or a third party. The SFC’s power to freeze assets under section 205 of Cap. 571 has been exercised in 8 of those cases.

Case example: SFC v. Chan (2025, unreported, SFC Enforcement Notice No. 15/2025). The SFC used IIR data to link a series of matched orders placed through three different brokers by a single individual, Mr. Chan. The orders involved the same stock, the same price, and the same time stamps. The SFC issued a restriction notice freezing Mr. Chan’s assets held with the three brokers. Mr. Chan subsequently admitted to market manipulation under section 274 of Cap. 571 and was ordered to pay a penalty of HK$2.5 million. The SFC’s investigation took eight weeks from detection to the issuance of the restriction notice.

Practical Takeaways for Compliance Officers and Licensed Corporations

The IIR is not a static compliance requirement. The SFC continues to refine the regime’s technical specifications and enforcement priorities. Intermediaries should treat IIR compliance as a continuous operational function, not a one-time project.

Takeaway 1: Implement automated data validation at the point of order entry. The SFC’s 2024 Thematic Review found that intermediaries with manual data validation processes had a 23% error rate in client identification data, compared to a 4% error rate for intermediaries with automated validation. Automated validation should check the format of the Hong Kong Identity Card number, the date of birth, and the BCAN against the HKEX’s reference data.

Takeaway 2: Conduct a quarterly reconciliation of client data against CCASS records. The SFC expects intermediaries to identify and correct discrepancies between the client’s IIR data and the data held in CCASS. A discrepancy may indicate that the client has transferred their holdings to another intermediary without updating their identification data, which could trigger a restriction notice.

Takeaway 3: Train front-office staff to recognise and escalate IIR data issues. The SFC’s enforcement actions have targeted intermediaries where front-office staff accepted orders without verifying that the client’s identification data was complete and accurate. Staff should be trained to reject orders where the BCAN is missing or where the client’s name does not match the identity document presented.

Takeaway 4: Review the IIR data submission schedule and ensure backup transmission capability. The SFC requires data transmission within one business day of the client’s first order. Intermediaries should maintain a backup transmission method (e.g., a secondary SMDF connection or a manual upload portal) in case the primary system fails. The SFC’s Technical Specification v2.1 requires that the backup system be tested at least once every six months.

Takeaway 5: Monitor the SFC’s published list of restriction notices and enforcement actions. The SFC publishes a summary of each restriction notice on its website. Compliance officers should review these notices to identify patterns in the types of trading behaviour that trigger SFC action. The SFC’s enforcement priorities for 2025-2026, as stated in the 2024-2025 Annual Enforcement Report, include cross-intermediary matched orders, high-frequency trading strategies that generate a high order-to-trade ratio, and trading in small-cap stocks with low liquidity.

This does not constitute legal advice. Consult a solicitor for your specific case.