SFC vs HKMA: Which Hong Kong Financial Regulator Governs Your Business?

In March 2025, the Securities and Futures Commission (SFC) and the Hong Kong Monetary Authority (HKMA) published their latest joint circular on the sale of complex products, tightening the suitability obligations for intermediaries distributing structured investment instruments. This update, combined with the ongoing expansion of virtual asset trading platforms under the SFC’s new licensing regime (effective June 2024) and the HKMA’s revised supervisory policy manual for banks engaging in securities business, means that many firms now face a critical threshold question: which regulator has primary authority over their operations? The answer determines which code of conduct applies, which reporting deadlines bind the firm, and which enforcement division will conduct the next on-site inspection. Getting this classification wrong can delay a licence application by six to twelve months or trigger a regulatory enforcement action for unauthorised activity under section 114 of the Securities and Futures Ordinance (Cap. 571). This article sets out the statutory boundaries between the two regulators, the activity-based test that determines jurisdiction, and the practical consequences for a firm’s compliance programme.

The Statutory Mandate: Two Regulators, Two Regimes

The SFC’s Scope Under the Securities and Futures Ordinance

The SFC derives its authority primarily from the Securities and Futures Ordinance (Cap. 571) (SFO). Section 5 of the SFO establishes the SFC as the independent statutory body responsible for regulating the securities and futures markets in Hong Kong. The SFC licenses and supervises corporations that carry on a “regulated activity” as defined in Schedule 5 of the SFO. There are currently 13 types of regulated activities, ranging from dealing in securities (Type 1) to asset management (Type 9) and providing credit rating services (Type 10).

A firm that performs any of these activities “by way of business” in or from Hong Kong must hold an SFC licence unless an exemption applies. The SFC’s 2023-24 Annual Report (published October 2024) records that, as of 31 March 2024, the SFC regulated 3,255 licensed corporations, 45,626 licensed individuals, and 6,932 registered institutions. The SFC’s enforcement division filed 193 criminal and disciplinary cases in that financial year, with total fines and penalties exceeding HKD 400 million.

The HKMA’s Role as Banking Supervisor

The HKMA operates under the Banking Ordinance (Cap. 155). Its primary mandate is to maintain the stability of the banking system and to supervise authorised institutions (AIs) — licensed banks, restricted licence banks, and deposit-taking companies. Section 7 of the Banking Ordinance vests the HKMA with powers to issue guidelines, conduct examinations, and impose sanctions on AIs.

Crucially, the HKMA is not a licensing body for securities activities. However, section 20 of the SFO provides that an AI may carry on regulated activities without an SFC licence if it is “registered” with the SFC as a registered institution. The HKMA remains the front-line regulator for the AI’s overall conduct, while the SFC retains backstop authority over securities-related matters through a memorandum of understanding (MOU) first signed in 2003 and most recently updated in 2021.

The Dividing Line: “By Way of Business” and the Nature of the Entity

The jurisdictional dividing line is not based on the type of product alone. It is based on the status of the entity. If the entity is an AI under the Banking Ordinance, the HKMA is the primary regulator for prudential matters, and the SFC shares jurisdiction for securities-related conduct. If the entity is not an AI — for example, a private fund manager, a brokerage firm, or a virtual asset trading platform — the SFC is the sole licensing and supervisory authority.

This distinction is codified in the SFO’s dual regulatory structure for intermediaries. Part V of the SFO and the Securities and Futures (Licensing and Registration) (Information) Rules (Cap. 571 sub. leg.) set out the registration obligations for AIs and the licensing obligations for non-AIs. The SFC’s 2023 consultation conclusions on the proposed amendments to the Code of Conduct for Persons Licensed by or Registered with the SFC confirmed that the same conduct standards apply to both licensed corporations and registered institutions, but the enforcement pathway differs.

The Activity-Based Test: Which Regulator Has Jurisdiction Over Your Business?

Step 1: Determine Whether Your Entity Is an Authorised Institution

The first step in the jurisdictional analysis is to check whether your entity holds authorisation under the Banking Ordinance. The HKMA maintains a public register of all AIs on its website, updated weekly. As of January 2025, the register lists 160 licensed banks, 17 restricted licence banks, and 12 deposit-taking companies.

If your entity is not on that register, the SFC is the sole regulator for any regulated activity you conduct. If your entity is on the register, you must also register with the SFC under section 20 of the SFO for each regulated activity you intend to carry on. The HKMA’s Supervisory Policy Manual module IR-1 (updated November 2024) states that an AI must notify the HKMA before commencing any new securities-related business, even if the activity is already registered with the SFC.

Step 2: Identify the Regulated Activities You Perform

The SFC’s jurisdiction attaches to specific regulated activities, not to broad business categories. Schedule 5 of the SFO lists each activity with its statutory definition. For example, “dealing in securities” (Type 1) includes making or offering to make an agreement to acquire or dispose of securities, or inducing a person to make such an agreement. “Asset management” (Type 9) covers managing a portfolio of securities or futures contracts on behalf of a client.

The HKMA does not have its own classification of regulated activities. Instead, it relies on the SFO definitions when supervising AIs. The HKMA’s Guideline on the Sale of Investment Products (revised March 2025) cross-references the SFO definitions and adds additional conduct requirements specific to banking customers, such as the requirement to provide a cooling-off period for certain structured products.

Step 3: Check for Exemptions and Safe Harbours

Both regulators provide exemptions from licensing or registration in specific circumstances. Section 60 of the SFO exempts professional investors from certain licensing requirements when dealing with intermediaries. The SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC (paragraph 5.2) exempts transactions executed on a recognised stock exchange from the suitability obligations for professional investors.

For AIs, the HKMA’s Supervisory Policy Manual module SA-2 (revised December 2024) provides a safe harbour for intra-group transactions that do not involve retail clients. The safe harbour applies only if the AI maintains an internal policy approved by its board of directors and files an annual declaration with the HKMA.

Practical Consequences for Compliance Programmes

Internal Controls and Reporting Lines

If the SFC is the primary regulator, the compliance function must report to the SFC under the Management, Supervision and Internal Control Guidelines for Licensed Corporations (published January 2024). The guidelines require a licensed corporation to appoint a responsible officer who is accountable for compliance with the SFO and the SFC’s codes. The responsible officer must be an individual approved by the SFC and must be based in Hong Kong.

If the HKMA is the primary regulator, the compliance function reports to the HKMA through the AI’s designated banking supervisor. The HKMA’s Supervisory Policy Manual module IC-1 (updated October 2024) requires the AI to maintain a compliance function that is independent of the business lines and reports directly to the board of directors. The HKMA does not require a named responsible officer for securities activities, but it does require the AI to designate a senior manager accountable for the securities business.

Licensing Timelines and Application Costs

An SFC licence application for a non-AI typically takes 15 to 20 weeks from the date of a complete submission. The SFC’s 2023-24 Annual Report states that the median processing time for new licence applications was 17.2 weeks. The application fee for a corporation ranges from HKD 4,740 to HKD 14,740 depending on the number of regulated activities applied for, as set out in the Securities and Futures (Fees) Rules (Cap. 571 sub. leg.).

For an AI seeking registration with the SFC, the process is shorter. The SFC’s website states that registration applications for AIs are processed within 8 to 10 weeks. The registration fee is HKD 2,370 per regulated activity. However, the AI must also satisfy the HKMA’s prior notification requirement, which can add 4 to 6 weeks to the overall timeline.

Enforcement Risks and Penalties

The SFC has broader enforcement powers under the SFO than the HKMA has under the Banking Ordinance. Section 194 of the SFO empowers the SFC to revoke or suspend a licence, impose a fine of up to HKD 10 million or three times the profit gained from the contravention, and issue a public reprimand. The SFC may also refer cases to the Department of Justice for criminal prosecution under section 303 of the SFO, which carries a maximum penalty of HKD 10 million and imprisonment for 10 years for insider dealing.

The HKMA’s enforcement powers under the Banking Ordinance are focused on prudential soundness. Section 63 of the Banking Ordinance allows the HKMA to impose a pecuniary penalty of up to HKD 5 million for a contravention of a condition of authorisation. The HKMA may also remove directors or managers under section 72 of the Banking Ordinance. For securities-related misconduct by an AI, the HKMA typically coordinates with the SFC under the 2021 MOU, and the SFC may bring its own enforcement action.

Key Takeaways

• Determine your entity’s status under the Banking Ordinance first: if it is an authorised institution, the HKMA is your primary regulator for prudential matters, and you must register with the SFC for each regulated activity.
• Map each business activity against the 13 regulated activities in Schedule 5 of the SFO to confirm whether an SFC licence or registration is required, and check for exemptions under section 60 of the SFO.
• Budget for a licensing timeline of 15 to 20 weeks for a non-AI SFC licence application, or 8 to 10 weeks for an AI registration, and factor in the HKMA’s prior notification requirement for AIs.
• Ensure your compliance function’s reporting line matches the regulator’s expectation: a responsible officer for SFC-licensed corporations, or a senior manager accountable to the board for HKMA-supervised AIs.
• Monitor the joint SFC-HKMA circulars published quarterly on the SFC’s website, as the conduct standards for complex products and virtual assets continue to converge between the two regimes through 2025 and 2026.

本文不構成法律建議。涉及個人案件請諮詢持牌律師。