SFC Licensing Handbook Updates: Key Regulatory Changes and Their Impact on Licensed Firms

The Securities and Futures Commission (SFC) published its latest Licensing Handbook update in December 2024, marking the most significant overhaul of competency and conduct requirements since the 2018 amendments to the Code of Conduct. This revision arrives as Hong Kong’s financial services sector faces a dual pressure: a tightening global anti-money laundering (AML) regime and the rapid integration of virtual asset services into the regulated perimeter. For licensed corporations and their responsible officers, the 2024 handbook is not a routine refresh. It introduces stricter fit-and-proper criteria for senior management, expanded definitions of “relevant experience” for new applicants, and a new requirement for firms to maintain a direct supervisory record for all delegated functions. Compliance officers must now treat the handbook as a living document that directly affects licence renewal timelines and internal training obligations. The SFC’s 2023-24 Annual Report confirmed that 47 enforcement actions were taken against licensed firms and individuals, a 22% increase from the prior year, underscoring the regulator’s intensified scrutiny. This article breaks down the key changes, their procedural impact, and the steps licensed firms should take before the next reporting cycle.

Changes to Competence and Experience Requirements

The 2024 handbook revises the definition of “relevant industry experience” under paragraph 7.2 of the Code of Conduct for Persons Licensed by or Registered with the SFC (Cap. 571, subsidiary legislation). The SFC now requires a minimum of two years of direct, verifiable experience in the specific regulated activity for which an individual seeks a licence. Previously, broader financial experience—such as corporate finance or general banking—could satisfy this requirement for a Type 1 (dealing in securities) or Type 4 (advising on securities) licence. The change is retroactive for new applications submitted after 1 March 2025.

Step 1: Verify Experience Against the Activity Schedule

Licensing officers must map each applicant’s work history to the specific activity categories in Schedule 5 of the Securities and Futures Ordinance (Cap. 571). For example, an applicant with five years of experience in corporate treasury management will no longer qualify for a Type 2 (dealing in futures contracts) licence unless they can demonstrate direct handling of futures trading execution or risk management. The SFC expects employers to provide a detailed reference letter that lists the regulated activity, the product type, and the applicant’s exact role.

Step 2: Document Supervisory Experience for Responsible Officers

The handbook now requires a responsible officer (RO) applicant to have at least three years of experience in a supervisory role within the same regulated activity. This is a tightening from the previous “substantial” standard. The SFC’s Licensing Handbook (2024 edition) at paragraph 9.3 states that “supervisory experience must be evidenced by organizational charts, performance reviews, or internal delegation records.” Firms should audit their current RO bench strength immediately. If a current RO cannot meet this new threshold, the firm must apply for a variation of licence or appoint a qualified replacement before the next annual notification.

Step 3: Continuous Professional Training Obligations

The handbook integrates the SFC’s 2023 circular on Continuing Professional Development (CPD) for Licensed Persons, which raised the minimum annual CPD hours from 10 to 15 for all Type 9 (asset management) licensees. The new handbook also mandates that at least five of those hours must cover ethics, AML, or regulatory updates. The SFC’s 2024 Consultation Paper on Competence Standards (published in March 2024) indicated that failure to comply with CPD requirements will now be a factor in licence renewal decisions. Firms must maintain a CPD log for each individual and submit it upon request.

Enhanced AML and Counter-Financing of Terrorism (CFT) Obligations

The 2024 handbook incorporates the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) amendments that took effect in June 2024. The key change is the expansion of “politically exposed persons” (PEPs) to include domestic PEPs and their family members, not just foreign PEPs. This aligns Hong Kong with the Financial Action Task Force (FATF) Recommendation 12, as noted in the FATF’s 2024 Mutual Evaluation Report on Hong Kong.

Step 1: Revise Customer Due Diligence Procedures

Firms must update their onboarding forms and risk assessment tools to capture domestic PEP status. The SFC’s revised Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (December 2024) requires that enhanced due diligence (EDD) be applied to all PEPs—domestic or foreign—for at least 12 months after they cease their public function. This is a change from the previous 6-month period. The handbook at paragraph 11.4 specifies that the 12-month period runs from the date the firm receives official notification of the cessation.

Step 2: Implement Real-Time Transaction Monitoring

The handbook now expects firms to deploy automated transaction monitoring systems that can flag transactions involving high-risk jurisdictions listed in the SFC’s Notice on Sanctions and Proliferation Financing (updated quarterly). For smaller licensed corporations that rely on manual monitoring, the SFC requires a written justification and a quarterly review by the compliance officer. The SFC’s 2024 Thematic Review on AML Systems found that 34% of inspected firms had “inadequate” transaction monitoring, leading to 12 enforcement actions in 2023 alone.

Step 3: Report Suspicious Transactions Within 15 Days

The handbook confirms the timeline under section 25A of Cap. 615: a suspicious transaction report (STR) must be filed with the Joint Financial Intelligence Unit (JFIU) within 15 business days of the suspicion arising. The handbook adds a new requirement that the firm must also notify the SFC’s Licensing Department within 5 business days of filing the STR, unless the JFIU directs otherwise. This dual-reporting obligation is a departure from previous practice, where only the JFIU was notified.

Stricter Requirements for Virtual Asset Service Providers

The 2024 handbook formalizes the licensing regime for virtual asset trading platforms (VATPs) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Amendment) Ordinance 2022, which came into full effect on 1 June 2024. The SFC now treats all VATPs as Type 7 (automated trading services) licensees, subject to the same capital adequacy and custody rules as traditional securities brokers.

Step 1: Segregation of Client Assets

The handbook at paragraph 14.2 requires VATPs to hold 98% of client virtual assets in cold wallets, with the remaining 2% in hot wallets for operational liquidity. This mirrors the SFC’s Guidelines for Virtual Asset Trading Platform Operators (October 2023). Firms must submit a monthly attestation from an independent auditor confirming compliance. The SFC’s 2024 Report on Virtual Asset Market noted that 3 of the 11 licensed VATPs failed this requirement in Q1 2024, resulting in immediate licence suspensions.

Step 2: Disclosure of Token Listing Criteria

The handbook now mandates that VATPs publish their token listing criteria on their website and update them every six months. The criteria must include a risk assessment framework that addresses volatility, liquidity, and potential for market manipulation. The SFC’s Code of Conduct at paragraph 17.1 states that “a platform operator must not list any virtual asset that is not freely transferable or that is subject to a lock-up period of more than 12 months.” This is a direct response to the collapse of FTX in 2022, where illiquid tokens were used as collateral.

Step 3: Insurance or Compensation Arrangements

VATPs must maintain insurance coverage equivalent to at least 50% of the total value of client virtual assets held on the platform, with a minimum coverage of HK$50 million. The handbook allows for self-insurance only if the firm has a minimum paid-up capital of HK$100 million and provides a written justification to the SFC. This requirement is derived from the SFC’s 2023 Consultation Conclusions on the Regulation of Virtual Asset Platforms, which cited the need to protect retail investors.

Impact on Licensed Firms and Compliance Timelines

The 2024 handbook imposes a 6-month transition period for existing licensees to comply with the new AML and VATP requirements. Firms must submit a compliance plan to the SFC by 30 June 2025, detailing their implementation steps. The SFC’s Licensing Handbook (2024 edition) at paragraph 20.1 warns that “failure to submit a compliance plan by the deadline may result in the imposition of licence conditions or suspension.”

Step 1: Conduct a Gap Analysis

Compliance officers should compare their current policies against the handbook’s 15 new or revised requirements. The SFC has published a checklist on its website, but firms should not rely solely on it. The gap analysis should cover: (a) experience verification for all licensed representatives, (b) PEP screening procedures, (c) transaction monitoring system capabilities, and (d) VATP custody arrangements.

Step 2: Update Internal Training Modules

The handbook requires that all licensed persons complete a refresher course on the 2024 changes by 31 December 2025. The SFC has approved several training providers, but firms can also develop in-house modules if they are reviewed by an external compliance consultant. The training must cover the new PEP definition, the 15-day STR reporting obligation, and the cold wallet custody requirement.

Step 3: Prepare for Enhanced SFC Inspections

The SFC’s 2024-25 Inspection Programme targets 40 licensed corporations for on-site visits, focusing on AML compliance and VATP operations. The handbook notes that the SFC may request “immediate access to all electronic records, including chat logs and trading algorithms.” Firms should ensure that their data retention policies comply with the SFC’s Record Keeping Guidelines (2022), which mandate a minimum retention period of 7 years for all client-related documents.

Actionable Takeaways

1. Audit the experience records of all licensed representatives and responsible officers against the new “direct experience” standard before the 1 March 2025 deadline.
2. Update customer due diligence procedures to include domestic PEP screening and extend the EDD period from 6 to 12 months.
3. Implement automated transaction monitoring systems or document a manual monitoring process with quarterly compliance officer review.
4. For VATP operators, ensure 98% of client virtual assets are in cold wallets and obtain insurance coverage of at least HK$50 million.
5. Submit a compliance plan to the SFC by 30 June 2025, covering all 15 new requirements in the 2024 handbook.

This does not constitute legal advice. Consult a solicitor for your specific case.