SFC Licensed Corporation Ongoing Obligations: Financial Reporting, Auditing, and Record-Keeping

The SFC’s latest Annual Report, published in April 2025, recorded 3,244 licensed corporations and 47,637 licensed individuals as of 31 December 2024. These numbers reflect a sustained pipeline of new entrants, particularly from virtual asset and fintech firms. The 2024-25 financial year also saw the SFC issue 415 licences to corporations — a 12% increase over the prior year. For every new licence granted, the SFC simultaneously imposes a set of ongoing obligations under the Securities and Futures Ordinance (Cap. 571). These obligations are not optional. They are the price of admission to Hong Kong’s regulated markets. Failure to comply with financial reporting, auditing, and record-keeping requirements can result in licence suspension, public reprimand, or criminal prosecution. This article sets out the core ongoing obligations for SFC-licensed corporations, with a focus on the 2025-26 regulatory cycle. It does not constitute legal advice. Consult a solicitor for your specific case.

Financial Reporting Obligations

Annual Audited Accounts: Filing Deadline and Content

Every licensed corporation must lodge its audited financial statements with the SFC within four months of its financial year-end. This requirement is set out in section 156 of the Securities and Futures Ordinance (Cap. 571) and the SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC. The financial statements must be prepared in accordance with Hong Kong Financial Reporting Standards (HKFRS) or equivalent international standards.

The SFC expects the accounts to include a balance sheet, income statement, cash flow statement, and notes to the accounts. The auditor’s report must be unqualified. A qualified or disclaimed opinion triggers automatic SFC scrutiny and may require a remedial plan. The SFC also requires a separate report on the licensed corporation’s compliance with the Financial Resources Rules (Cap. 571N).

Monthly and Quarterly Financial Returns

Licensed corporations must submit monthly financial returns to the SFC within 15 business days after the end of each calendar month. The return must show the corporation’s liquid capital, total assets, and total liabilities. The SFC uses these returns to monitor compliance with the minimum liquid capital requirement under the Securities and Futures (Financial Resources) Rules (Cap. 571N).

For corporations that hold client assets, the SFC also requires a quarterly return detailing the segregation and custody of client money and client securities. The quarterly return must be filed within 30 business days of the quarter end. The SFC’s 2024 Annual Report noted that 97% of licensed corporations filed their monthly returns on time. Late filers face a warning letter for the first offence and a potential fine for repeated non-compliance.

Liquid Capital Requirement: The 5% Rule

The Financial Resources Rules require every licensed corporation to maintain liquid capital of at least 5% of its total liabilities, or a fixed minimum of HK$3 million for Type 1 (dealing in securities) and Type 2 (dealing in futures contracts) licences. The SFC calculates liquid capital as adjusted net assets minus prescribed deductions. Common deductions include unsecured loans, illiquid investments, and amounts due from affiliates.

A licensed corporation whose liquid capital falls below the required level must immediately notify the SFC and cease all regulated activities until the deficiency is rectified. The SFC’s 2024-25 enforcement record shows that 12 licensed corporations were suspended for liquid capital shortfalls during the year. The SFC publishes a list of suspended corporations on its website.

Auditing Requirements

Appointment of an Approved Auditor

Every licensed corporation must appoint an auditor approved by the SFC. The SFC maintains a list of approved auditors on its website. The auditor must be independent of the licensed corporation and must have no financial interest in the corporation’s business.

The auditor’s appointment must be confirmed in writing to the SFC within 14 days of appointment. The SFC may reject an auditor if it considers the auditor lacks the necessary experience or independence. In practice, the SFC expects the auditor to have at least three years’ experience auditing licensed corporations.

Scope of the Audit Engagement

The audit must cover the licensed corporation’s financial statements and its compliance with the Financial Resources Rules. The auditor must report on whether the corporation has maintained adequate accounting records and whether the financial statements give a true and fair view of the corporation’s financial position.

The auditor must also report any material weakness in internal controls that could affect the corporation’s ability to comply with the Securities and Futures Ordinance. The SFC’s 2023-24 Annual Report noted that 23% of audit reports identified at least one material weakness in internal controls. Common weaknesses include inadequate segregation of duties, lack of independent reconciliation of client accounts, and insufficient oversight of outsourcing arrangements.

Auditor’s Duty to Report Breaches

Section 157 of the Securities and Futures Ordinance imposes a duty on auditors to report to the SFC any breach of the Ordinance or the Financial Resources Rules that the auditor discovers during the audit. The duty arises regardless of whether the licensed corporation has already reported the breach.

The auditor must submit a written report to the SFC within 14 days of discovering the breach. The report must describe the nature of the breach, the amount involved, and the steps taken or proposed to remedy the breach. Failure to report a breach can result in the auditor being disqualified from auditing licensed corporations.

Record-Keeping Requirements

Minimum Retention Periods

Section 130 of the Securities and Futures Ordinance requires every licensed corporation to keep records for at least seven years after the transaction to which they relate. The records must include all documents relating to client orders, client accounts, and the corporation’s own financial position.

The SFC’s 2024-25 enforcement record shows that three licensed corporations were fined for failing to retain client order records for the required period. The fines ranged from HK$200,000 to HK$800,000. The SFC considers record-keeping failures as serious because they impede the SFC’s ability to investigate client complaints and market misconduct.

Electronic Records and Cloud Storage

The SFC permits licensed corporations to store records electronically, including on cloud-based platforms. The corporation must ensure that the electronic records are accessible, legible, and can be reproduced in hard copy within a reasonable time.

The SFC’s 2024 Guidance Note on Record-Keeping states that cloud storage providers must be located in jurisdictions with data protection laws equivalent to Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486). The corporation must also maintain a backup of all electronic records in a separate location. The backup must be tested at least annually.

Client Order Records: What Must Be Captured

For each client order, the licensed corporation must record the client’s identity, the date and time of the order, the instrument traded, the quantity, the price, and the commission charged. The SFC requires that the time be recorded to the nearest second for orders executed through an electronic trading system.

The corporation must also record the identity of the individual who entered the order and the individual who executed the trade. If the order is placed by telephone, the corporation must record the telephone conversation and retain the recording for at least six months. The SFC’s 2024 Annual Report noted that the SFC inspected 127 licensed corporations in 2024 and found that 8% had inadequate client order records.

Actionable Takeaways

• File your annual audited accounts within four months of your financial year-end; late filing triggers an automatic SFC enquiry and may result in a fine of up to HK$500,000.
• Maintain liquid capital at all times at not less than 5% of total liabilities or the fixed minimum, whichever is higher; a deficiency requires immediate notification to the SFC and cessation of regulated activities.
• Appoint an SFC-approved auditor with at least three years’ experience auditing licensed corporations; the auditor must report any breach of the Securities and Futures Ordinance to the SFC within 14 days.
• Retain all client order records, including telephone recordings, for at least seven years; electronic records must be stored in a jurisdiction with data protection laws equivalent to Hong Kong’s.
• Test your electronic record backup at least annually; failure to produce records during an SFC inspection is treated as a breach of the licensing conditions.

This does not constitute legal advice. Consult a solicitor for your specific case.