Why SFC License Applications Get Rejected: Common Pitfalls and How to Avoid Them

The Securities and Futures Commission (SFC) rejected 131 licence applications in the 2023-24 financial year, according to its annual report published in June 2024. This represents a rejection rate of approximately 3.7% of all applications processed during that period. The SFC’s Licensing Department has publicly stated that it expects to maintain or increase scrutiny in 2025-2026, particularly for applications involving virtual asset services, cross-border business models, and firms with complex group structures. The revised Code of Conduct for Persons Licensed by or Registered with the SFC (effective June 2024) introduced stricter requirements on governance, risk management, and internal controls. Applicants who fail to align their submissions with these updated standards face a materially higher risk of rejection or prolonged processing delays. Understanding the specific grounds for refusal is the first step toward building an application that withstands regulatory scrutiny.

Reason 1: Incomplete or Inaccurate Disclosure on Key Individuals

The SFC’s Licensing Handbook (2023 edition) states that the commission assesses the “fitness and properness” of every proposed responsible officer (RO), executive director, and substantial shareholder. The assessment is not a box-checking exercise. The SFC reviews the candidate’s past conduct, financial soundness, and industry experience against the criteria in the Guidelines on the Fitness and Propriety of Applicants and Licensees (Cap. 571, subsidiary legislation).

Failure to Disclose Adverse Regulatory History

The most common reason for rejection under this head is incomplete disclosure of previous disciplinary actions, regulatory investigations, or criminal convictions. The SFC’s application form (Form 1 for corporations, Form 2 for individuals) requires disclosure of any regulatory action taken against the applicant in any jurisdiction. Leaving a field blank or providing a vague answer triggers a mandatory inquiry.

The SFC cross-references its own database with records from the Hong Kong Police, the Independent Commission Against Corruption, and overseas regulators through the International Organization of Securities Commissions (IOSCO) multilateral memorandum of understanding. A discrepancy between the applicant’s disclosure and the SFC’s findings is treated as a breach of good faith. The Code of Conduct General Principle 1 requires a licensed person to act with integrity. An omission, even if unintentional, can lead to a finding that the individual is not fit and proper.

Insufficient Local Industry Experience

The SFC expects each Type of licence to have at least one RO who has relevant Hong Kong market experience. For Type 1 (dealing in securities), the SFC typically looks for at least three years of relevant experience in Hong Kong or a comparable jurisdiction. The SFC’s Licensing Information Booklet (2024) clarifies that experience in a non-comparable regulatory regime (e.g., a jurisdiction with no securities law or a purely proprietary trading background) may not be accepted.

Applicants should prepare a detailed experience statement for each proposed RO. The statement must show the specific products, markets, and regulatory obligations the candidate has handled. A generic CV listing job titles and dates is insufficient. The SFC’s Licensing Department has, in recent enforcement cases, rejected applications where the proposed RO’s experience was limited to back-office functions or non-regulated activities.

Reason 2: Inadequate Business Plan and Risk Assessment

The SFC requires every applicant to submit a business plan that demonstrates a genuine and viable business operation in Hong Kong. The plan must address the applicant’s target clients, revenue model, operational structure, and risk management framework. The SFC’s Guidelines on Licensing (2023) state that the commission may refuse an application if the business plan is “unrealistic, speculative, or lacks sufficient detail.”

Unrealistic Financial Projections

A business plan projecting profitability within the first 12 months without a clear revenue pipeline raises a red flag. The SFC knows that most new licensees require 18 to 36 months to break even. An applicant that projects rapid growth without supporting evidence — such as signed client agreements, letters of intent, or a detailed marketing strategy — invites further scrutiny.

The SFC’s Licensing Department has, in recent years, asked for bank statements, capital commitment letters, and audited financial statements of the parent company to verify the applicant’s financial resources. The Securities and Futures (Financial Resources) Rules (Cap. 571N) impose minimum liquid capital requirements for each licence type. An applicant that cannot demonstrate the ability to meet these requirements from the start of operations is likely to be rejected.

Vague or Missing Risk Controls

The business plan must describe the applicant’s internal control systems, including client onboarding procedures, anti-money laundering (AML) checks, trade surveillance, and data security measures. The SFC’s Guidelines on Anti-Money Laundering and Counter-Financing of Terrorism (July 2023) require licensed corporations to implement risk-based policies and procedures.

A business plan that states “we will comply with all AML requirements” without specifying the actual controls — such as the use of a named AML screening tool, the frequency of transaction monitoring, or the escalation process for suspicious transactions — is insufficient. The SFC expects to see a written AML policy, a risk assessment document, and an organisational chart showing who is responsible for compliance. The SFC has rejected applications where the proposed compliance officer had no prior AML experience in a regulated environment.

Reason 3: Deficiencies in Corporate Governance and Ultimate Ownership

The SFC scrutinises the ownership structure of every applicant. The Securities and Futures Ordinance (Cap. 571) requires the SFC to be satisfied that every substantial shareholder, director, and RO is fit and proper. The SFC’s Guidelines on the Fitness and Propriety of Applicants and Licensees (2024) state that the commission may refuse a licence if the ownership structure “obscures the identity of the ultimate beneficial owner” or raises concerns about the source of funds.

Opaque Ownership Structures

An applicant with a multi-layered corporate structure, particularly one involving shell companies, trusts, or entities in jurisdictions with low regulatory oversight, must provide a clear explanation of the commercial rationale for each layer. The SFC’s Licensing Department has, in recent years, requested a full chain of ownership from the applicant entity up to the ultimate natural persons or listed companies.

If the ultimate beneficial owner is a trust, the SFC requires the trust deed, a list of beneficiaries, and a confirmation that the trustee is regulated in a recognised jurisdiction. Failure to provide this information within the stipulated timeframe (usually 30 days) results in an automatic rejection. The SFC’s Licensing Handbook (2023) warns that “the commission will not grant a licence to an applicant whose ownership structure is designed to conceal the true controller.”

Inadequate Board Composition

The SFC expects the board of directors of a licensed corporation to include at least two individuals who are independent of the management. The Code of Conduct (2024 revision) requires the board to have a majority of non-executive directors if the corporation is part of a group with complex operations. The SFC has rejected applications where all directors were also ROs or employees of the same corporate group.

The board must also demonstrate a collective understanding of the regulatory obligations applicable to the licence types being sought. An applicant that proposes a board with no experience in securities regulation, AML compliance, or financial reporting is unlikely to pass the fitness and propriety test.

Closing: Five Actionable Takeaways

1. Disclose everything — the SFC’s cross-referencing capabilities mean that any omission, even from a minor jurisdiction, will be discovered and treated as a breach of integrity.
2. Prepare a detailed business plan that includes a realistic financial projection, a named AML screening tool, and a written risk assessment document, not generic compliance statements.
3. Verify the local experience of every proposed RO against the SFC’s specific requirements for each licence type, and prepare a detailed experience statement for each candidate.
4. Map the ultimate ownership of the applicant entity up to the natural persons or listed companies, and be prepared to provide trust deeds and source-of-funds documentation within 30 days.
5. Review the board composition to ensure at least two independent non-executive directors are proposed, and that the board collectively holds relevant regulatory experience.

This does not constitute legal advice. Consult a solicitor for your specific case.