SFC Concludes on Hong Kong Investor Identification Regime and OTC Securities Transactions Reporting Regime

On 10 August 2021, the Hong Kong Securities and Futures Commission (“SFC”) published its Consultation Conclusions¹ on its proposals to introduce (1) an investor identification regime for the Hong Kong securities market (“HKIDR”) and (2) an over-the-counter securities transactions reporting regime (“OTCR”) for shares listed on the Stock Exchange of Hong Kong (“HKEX”). The introduction of these systems aims to make it easier for the SFC to identify investors who make suspicious orders or trades and enhance its surveillance function.

The Consultation Conclusions were published after receiving feedback regarding the SFC’s Consultation Paper² issued on 4 December 2020. For further information on the Consultation Paper, please see our December 2020 newsletter.³ After having considered the market feedback and with respondents broadly agreeing with the proposals, the SFC will proceed to implement both regimes with minor modifications. The Hong Kong investor identification regime is expected to launch in the second half of 2022 and the over-the-counter securities transactions reporting regime in the first half of 2023.

Trading Level Investor Identification Regime for the Hong Kong Securities Market

Investor identification regime key proposals

A problem identified by the SFC in the Consultation Paper was that it is only able to identify exchange participants (i.e. brokers) which place securities orders directly through the HKEX trading system. When it detects suspicious trading activities, it needs to obtain information from brokers to the identity of the actual investors behind the trades.

The SFC therefore proposed in the Consultation Paper that SFC-licensed corporations and registered institutions would need to:

1. assign a unique identification code – the Broker-to-Client Assigned Number (“BCAN”) to Relevant Clients who place: (i) an on-exchange order or (ii) an off-exchange order reportable to HKEX under its rules, in securities listed, or traded on HKEX’s trading system (except for odd lots traded on HKEX’s odd lot/special lot market). A Relevant Client (referred to as a “client” in proposed paragraph 5.6(m) of the SFC’s Code of Conduct) is a direct client of the relevant licensed or registered person, except that:
   1. in the case of a proprietary trade, client refers to the relevant licensed or registered person itself which should assign a BCAN to itself;
   2. where an on-exchange or off-exchange order is carried out through a chain of Regulated Intermediaries, the BCAN should be assigned to the first person which is not a Regulated Intermediary in the chain;
   3. when a trading account is held jointly, the client refers to each of the holders of the joint securities account; and
   4. in the case of a collective investment scheme or discretionary account, a client is the collective investment scheme, discretionary account holder, or asset management company that has opened a trading account through which an order is placed or proposed to be placed;
2. ensure that up-to-date client identification data (“CID”) is collected from each Relevant Client and is submitted together with the client’s BCAN (by putting the BCAN and client identification data into a “BCAN-CID Mapping File”) to a data repository to be maintained by the HKEX;
3. ensure that the Relevant Client’s BCAN is included in the order information for an on-exchange or off-exchange order and included in all reporting of off-exchange trades to HKEX, and obtain HKEX’s prior approval where a BCAN needs to be revised in exceptional circumstances; and
4. adopt relevant data privacy and security measures to safeguard the data collected, transmitted and stored, including obtaining express consent from clients for the collection and handling of their data in compliance with data privacy laws.

SFC Consultation Conclusions’ key changes to the investor identification regime

In response to market feedback, the SFC will make the following adjustments to the HKIDR:

1. The scope of “Relevant Client” will no longer include an investor who is a client of an Exchange Participant’s overseas affiliate;
2. The term “Relevant Regulated Intermediaries” will be used instead of “Regulated Intermediaries” to clarify that SFC-licensed corporations and registered institutions are only subject to these obligations if they:
   1. carry out proprietary trading, or
   2. provide securities brokerage services for another person in respect of orders placed through an account opened and maintained for that person;
3. Any BCAN tagged to an order should be the BCAN of the person whose securities trading account is used for placing the order;
4. Voluntary tagging of BCANs for odd lots in on-exchange orders and off-exchange trade reporting⁴ (“OE Trade Reporting”) will be allowed under the identification regime. If a board lot and odd lot is matched, a BCAN must be tagged to the whole order; and
5. Prior approval from HKEX for a change of a BCAN will not be required. However, if an order is placed and the BCAN is changed after the placing of the order but before its execution, the order will need to be cancelled and re-inputted with the correct BCAN. If the BCAN needs to be changed after an order is executed, the Relevant Regulated Intermediary should file a notification with the HKEX as soon as possible.

The Hong Kong investor identification regime

BCAN Assignment

The SFC’s new investor identification regime will make it mandatory for Relevant Registered Intermediaries to assign a unique BCAN to Relevant Clients who have placed or propose to place an order to HKEX trading for execution or an off-exchange order for an off-exchange trade that is reportable to the HKEX.⁵ The BCAN will consist of up to 10 digits and Relevant Regulated Intermediaries will insert their central entity number (as assigned by the SFC) as a prefix before the BCAN on the trading system and in the BCAN-CID Mapping File.

The investor identification regime will not apply to odd lots traded on HKEX’s odd lot or special lot market. Nor will it apply to IPO offerings, primary market share placings or corporate event distributions which only involve the issue of new shares. Voluntary tagging of BCANs will be allowed for odd lots in on-exchange orders and off-exchange trade reporting.

The responsibility for generating and assigning the BCAN to each Relevant Client and including it in the order information for each on-exchange and off-exchange order and in off-exchange trade reporting lies with the Relevant Regulated Intermediary. The BCAN should identify a specific client of the Relevant Regulated Intermediary, but should not bear any obvious link to a client’s identity and must remain confidential. Relevant Regulated Intermediaries would be expected to put in place automated order management systems to ensure correct and valid BCANs are tagged to relevant orders. Where a BCAN is not provided or is invalid, the on-exchange order or OE Trade Reporting will be rejected. If a BCAN tagged to an on-exchange order needs to be amended before the order is matched and executed, the order will need to be cancelled and re-inputted with the correct BCAN. However, where a BCAN needs amending after the order is executed, the erroneous BCAN must be reported to the HKEX as soon as possible. The executed order will not be cancelled or become invalid due to an amendment to the BCAN.

Client identification data

Relevant Regulated Intermediaries will also be required to ensure that up-to-date client identification data has been collected from each Relevant Client and that it is submitted together with the client’s BCAN (in the form of a BCAN-CID Mapping File) to a data repositary maintained by the HKEX by a prescribed time.

Relevant Regulated Intermediaries will need to obtain clients’ written or other express consent for the collection and handling of their personal data in compliance with data privacy laws. The SFC will issue guidance on the requirements to be followed by Relevant Regulated Intermediaries when obtaining client consent. Adequate security measures will also need to be adopted to safeguard client data. The SFC and HKEX will also put in place privacy protection and security measures to safeguard the collected data. Trading information would only be made available to limited, designated staff of the SFC and HKEX.

Chains of Relevant Regulated Intermediaries

Where an order is routed through a chain of Relevant Regulated Intermediaries, the BCAN should be assigned to, and client identification data should be collected from, the first person in the chain which is not a Relevant Regulated Intermediary. Responsibility for the BCAN assignment and collection of identification data will lie with the Relevant Regulated Intermediary whose direct client is not a Regulated Intermediary.

Each Relevent Regulated Intermediary along the intermediating chain will need to include the Relevant Client’s BCAN in the order information for each on-exchange and off-exchange order conducted through another Relevant Regulated Intermediary (directly or indirectly) and in all off-exchange trade reporting.

The Relevant Client to be Assigned a BCAN

The Relevant Client to be assigned a BCAN is the direct client of the Relevant Regulated Intermediary, subject to the following provisos:

A single unique BCAN would be assigned to each Relevant Client and a separate BCAN would be assigned to identify each joint account. If a client has multiple accounts with a Relevant Regulated Intermediary, the Relevant Regulated Intermediary would assign only one unique BCAN to identify that client. The BCAN would remain unchanged and could not be reused for other clients once assigned.

Collection and Submission of Client Identification Information

The following Client Identification Data (or CID) will need to be collected from Relevant Clients and submitted to the HKEX’s central data repository:

1. The client’s full name as shown on the client’ identity document;
2. The identity document’s issuing country or jurisdiction;
3. The type of identity document, being:
   • in the case of an individual client, in order of priority, his or her: (1) HKID card⁶, (2) national identification document, or (3) passport;
   • in the case of a corporate client, in order of priority, its: (1) legal entity identifier registration document, (2) certificate of incorporation, (3) business registration certificate, or (4) other equivalent document; and
4. The identity document number.

In the case of a client that is a trust, the CID of the trustee will need to be collected. However, in the case of a trust which is an investment fund, the CID of the asset management company or the individual fund which had opened a trading account with the Relevant Regulated Intermediary should be collected. For clients of a joint account, the CID of all holders of the joint account would be required to be provided under the same BCAN assigned to that account.

Logistics of the Collection and Submission of Client Identification Information

The Relevant Regulated Intermediary which assigns the BCAN to the Relevant Client will be required to collect the client identification information from that client. The Relevant Regulated Intermediary will put the client identification information and the BCAN into a BCAN-CID Mapping File which it will submit directly to the HKEX’s central data repository if it is an Exchange Participant. A non-Exchange Participant would either make the submission to the HKEX via a designated web portal or submit the file indirectly to the HKEX by providing the file to another Relevant Regulated Intermediary in the same way it routes on-exchange orders or off-exchange orders. Measures should be taken to ensure that the client’s BCAN-CID Mapping File is submitted to the central data repository by the prescribed time.

Where on-exchange orders or off-exchange orders will be routed through an affiliate of the Exchange Participant which executes them, the Exchange Participant must ensure that the affiliate will collect the CID from the client, prepare the BCAN-CID Mapping File, and provide the file to it. The Exchange Participant would then submit the file to the central data repository.

Relevant Regulated Intermediaries will be required to take all reasonable steps to ensure that the client information they collect and submit to HKEX’s data repository is accurate and kept up-to-date. The standard should be the same as paragraph 5.1 under the Code of Conduct with regards to the “know your client” requirements. Relevant Regulated Intermediaries should put in place procedures to require clients to notify them of changes to their client identification information. If a Relevent Regulated Intermediary has notice of a change in a client’s CID, or any update needed to the BCAN-CID Mapping File, (e.g. the addition or closure of a client account, or a change in CID information for existing clients) a complete file with the CID of all Relevant Clients should be uploaded to the data repository on the day an update has been made rather than only when the client’s next trade is executed. For a new client assigned a BCAN on the trade day, the BCAN-CID Mapping File containing the new client’s CID can be submitted to HKEX’s data repository either before or after the order is submitted, but in any event before the cut-off time on the trading day.

Newly on-boarded clients can trade on the day of the account opening and dormant clients can trade on the day when their accounts become re-activated. A BCAN can be assigned by a Relevant Regulated Intermediary upon account opening (for a newly on-boarded client) or in preparation for the implementation of the regime (for all existing clients, regardless of whether they are dormant clients). When a Relevant Regulated Intermediary inputs a securities order for newly on-boarded or dormant clients, the order must be tagged with BCANs accordingly.

The CID of clients which have already opened an account with a Relevant Regulated Intermediary and have conducted trades via that account should generally be submitted within a specified period before the proposed implementation date of the investor identification regime and at the latest, by the day before the trading day (the day on which the client places the on-exchange or off-exchange order or the day on which the off-exchange trade is executed). It is expected that a period of nine months will be provided to the industry for the submission of clients’ CID prior to the launch of the regime. This aims to ensure that the majority of investors’ CID has been submitted before an investor conducts a trade after the launch of the regime.

In the case of an aggregated order, a Relevant Regulated Intermediary will be required to submit the BCAN-CID Mapping File for each Relevant Client of the aggregated order to the HKEX subsequent to the trade by the prescribed time. The Relevant Regulated Intermediary would assign a specific code to the aggregated order as prescribed by the HKEX and tag the code to the order when it is submitted as an on-exchange order or as part of off-exchange trade reporting. This must be submitted within three days after the trade date (T+3).

The submission of the BCAN-CID Mapping File to HKEX is expected to be a one-off exercise and updates will only be necessary where there is a change in the Relevant Clients’ CID information. It would not be necessary for the BCAN-CID Mapping File to be submitted each time an order is placed with the Relevant Regulated Intermediary. Failure to submit the BCAN-CID Mapping File to HKEX by the prescribed time will not invalidate an order or trade but it may constitute a breach of the SFC Code of Conduct and may contravene the relevant Rules of the Exchange.

Implications of the Proposed Hong Kong Investor Identification Regime for Data Privacy Laws and Investor Consent

When the proposed regime is adopted, Relevant Regulated Intermediaries will be required to extend the current data privacy and security measures they have in place to the personal data collected and used under the proposed Hong Kong investor identification regime.

The SFC considers that the client identification information and BCANs of individual clients are likely to constitute personal data as defined in the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”). All Relevant Regulated Intermediaries would therefore be required to review the adequacy of the existing measures they have in place to ensure compliance with the applicable requirements under the PDPO and any other applicable data privacy laws, for example, the data privacy laws of other jurisdictions that may be applicable depending on the client’s place of residence or the Relevant Regulated Intermediary’s place of business in relation to the collection, use, storage, disclosure, and transfer of CID, BCANs and BCAN-CID Mapping Files.

Where a Relevant Regulated Intermediary intends to use a client’s personal data (which it has already collected) for a new purpose not previously notified to the client, the Relevant Regulated Intermediary is required to obtain the client’s prescribed consent (i.e., express and voluntarily given consent) under the PDPO. The use of a client’s personal data already collected by the Relevant Regulated Intermediary prior to the introduction of the proposed regime, would trigger the requirement to obtain prescribed consent under the PDPO.

BCANs and BCAN-Mapping information should be retained by a Relevant Regulated Intermediary for as long as the client remains its client. The records should be kept for no less than two years after a person ceases to be a client.

Obtaining written or other express consent from the Relevant Clients

Under the proposed regime, Relevant Regulated Intermediaries will be required to obtain written or other express consent from their Relevant Clients (both new and existing clients) for the transfer of their personal data to the HKEX and/or SFC providing that the data shall not be used for a new purpose. The consent must be obtained on or before the collection of CID from or submission of CID for an individual client. In particular, consent must be obtained in relation to:

• disclosure and transfer of personal data (including CID and BCANs) to the HKEX and/or the SFC;
• allowing the HKEX to:
  • collect, store, process and use their personal data (including CID and BCANs) for market surveillance and monitoring purposes and enforcement of the HKEX’s Rules of the Exchange;
  • disclose and transfer such information to the relevant regulators and law enforcement agencies in Hong Kong to facilitate the performance of their statutory functions with respect to the Hong Kong financial markets; and
  • use the information for conducting analysis for the purposes of market oversight.
• allowing the SFC to
  • collect, store, process, and use their personal data (including CID and BCANs) for the performance of its statutory functions including monitoring, surveillance and enforcement functions with respect to the Hong Kong financial markets; and
  • disclose and transfer such information to the relevant regulators and law enforcement agencies in Hong Kong in accordance with applicable laws or regulatory requirements.

Transmission of data and data protection

The submission of CID by Relevant Regulated Intermediaries to HKEX will be conducted through HKEX’s closed network and all CID kept in the central data repository will be encrypted. Once the relevant trade information is captured by HKEX, the information (with BCAN tagged) will be transmitted to the SFC’s surveillance system via a dedicated, secure data line. The SFC and HKEX will work together to establish a mechanism for data sharing or synchronisation. Access to the central data repository will be restricted to designated staff of HKEX and the SFC and approvals will be granted by senior executives on an as-needed basis based on job duties. Detailed audit trails will be maintained of any access made and failed login attempts and unauthorised access will be logged and investigated. As the proposed operator of the central data repository, HKEX will be required to put in place adequate resources to ensure its data security measures and access controls are kept up-to-date and that the policies and procedures are reviewed and updated on a regular basis. The data collected will be kept only for as long as necessary to perform their statutory functions, in compliance with the PDPO. It is not anticipated that it would be disclosed to law enforcement agencies in other jurisdictions.

After the identification regime is launched, the SFC’s power to issue Section 181 notices to enquire into the identity of an investor would remain in place and could be used where an investor falls outside the Hong Kong investor identification regime and suspected market misconduct is involved.

Over-the-counter securities transactions reporting regime (“OTCR”) for shares listed on the Stock Exchange of Hong Kong

SFC Consultation Paper proposals for the OTCR

The December 2020 SFC Consultation Paper had proposed that Relevant Regulated Intermediaries would be required to report to the SFC certain dealings in ordinary shares and real estate investment trusts (“REITs”) listed on the HKEX when:

1. a Relevant Regulated Intermediary (whether as principal or agent) makes a transfer of shares which is effected by a transaction not recorded by HKEX as an on-exchange order nor required to be reported to HKEX as an off-exchange trade (“OTC Securities Transaction”) in respect of which stamp duty is chargeable in Hong Kong; or
2. there is a deposit to or withdrawal from the Relevant Regulated Intermediary (whether as principal or agent) of physical certifiable shares; and
3. both the delivering and receiving Relevant Regulated Intermediaries need to report by one Hong Kong trading day after the transfer / deposit / withdrawal day (Hong Kong time).

Key changes in the SFC Consultation Conclusions for the OTCR

The SFC adopted the following modifications in the Consultation Conclusions:

1. The time to report is extended to within three Hong Kong trading days after the day of transfer, deposit or withdrawal;
2. A transfer of shares in connection with an OTC Securities Transaction in respect of which stamp duty is chargeable in Hong Kong will not need to be reported if:
   1. the transaction is granted stamp duty relief (whether in full or in part) from the Inland Revenue Department (IRD), or
   2. the transfer of shares is made in accordance with the terms of a structured product or a derivative, or for the conversion of a depository receipt into shares or vice versa.

The OTC Securities Transactions Reporting Regime for shares listed on the Stock Exchange of Hong Kong

The OTC securities transactions reporting regime for ordinary shares and real estate investment trusts listed on HKEX aims to enhance transparency for transactions which are not required to be recorded by the HKEX as on-exchange orders nor reported to the HKEX as off-exchange trades. The SFC noted in the Consultation Paper that over-the-counter securities transactions were used in many of the market manipulation schemes it investigated.

The regime will impose reporting obligations on Relevant Regulated Intermediaries when:

• the Relevant Regulated Intermediary, whether acting as principal or agent, makes a transfer of shares (ordinary shares or REITs listed on the HKEX) that is effected by an OTC Securities Transaction in respect of which stamp duty is chargeable unless (i) it is granted stamp duty relief (whether in full or in part) from the Inland Revenue Department or (ii) the transfer of shares is made in accordance with the terms of a structured product or a derivative in Hong Kong; and
• there is a deposit to or withdrawal from the Relevant Regulated Intermediary, whether acting as principal or agent, of physical certificates of shares.

Transactions falling outside the OTC Securities Transactions Reporting Regime would include for example, share transfers between two Exchange Participants for the same individual and share transfers between two accounts held by the same individual in the same Exchange Participant. A transfer of shares effected by a transaction which has been conducted on-exchange or is required to be reported to HKEX in accordance with the Rules of the Exchange will also not be subject to the reporting obligation under the OTC Securities Transactions Reporting Regime.

The reporting is required to be done by within three Hong Kong trading days after the day (in Hong Kong time) of the share transfer, deposit, or withdrawal. In relation to the reporting of share transfers between two Relevant Regulated Intermediaries, both the delivering Relevant Regulated Intermediary and the receiving Relevant Regulated Intermediary would be required to report the transaction to the SFC. However, in the event that the delivering Relevant Regulated Intermediary and the receiving Relevant Regulated Intermediary are the same Relevant Regulated Intermediary, the transaction would only need to be reported once.

The SFC will build the system for the submission of information and will provide the format of reporting in due course and prior to the implementation of the proposed regime. The submission portal will provide for both manual and automated data transfer functionalities.

The following information would be required to be submitted to the SFC for each share transfer:

• the stock name and code of the shares transferred;
• transaction price per share;
• quantity of shares transferred by the reporting Relevant Regulated Intermediary;
• quantity of shares of the transactions;⁷
• share transfer date;
• transaction date;
• CE number⁸ of the reporting Relevant Regulated Intermediary and the role of the reporting Relevant Regulated Intermediary in the transfer (transferee/transferor/agent for transferee or transferor or both);
• where the counterparty corporation to the reporting Relevant Regulated Intermediary is also a licensed or registered person, the CE number of the counterparty corporation; and
• CID of the transferee/transferor (where the transferee/transferor is a client of the reporting Relevant Regulated Intermediary).

The following information will be required to be submitted to the SFC for a physical share certificate deposit or withdrawal:

• the stock name and stock code;
• quantity of shares referenced in the physical share certificates;
• the deposit or withdrawal date;
• CE number and role of the reporting Relevant Regulated Intermediary (i.e. whether it acts as principal or agent); and
• CID of the client on whose behalf the physical share certificate(s) are held by the Relevant Regulated Intermediary.

Data privacy and investors’ consent

Relevant Regulated Intermediaries will need to comply with the requirements of the PDPO in relation to the collection, use, storage, disclosure and transfer of clients’ personal data where clients are individuals. This will require that Relevant Regulated Intermediaries make their individual clients aware of the purposes for which their personal data will be used under the over-the-counter securities transactions reporting regime.

Relevant Regulated Intermediaries will be required to obtain written or other express consent from their clients for the transfer of their personal data to the SFC under the new regime on or before the collection or submission of client identification information for individual clients. If a client fails to provide the consent required, the Relevant Regulated Intermediary must not accept a transfer of shares into the client’s account, or a deposit of physical certificates into its account. However, clients who do not consent to the transfer of their personal data may continue to transfer shares out of their account or withdraw physical share certificates. When a client refuses to provide consent for submission of his or her CID under the HKIDR, a specific type of BCAN will need to be used⁹ when submitting a sale order of this kind.

The SFC will issue an information paper on the technical details for the OTCR including file specifications, reporting templates and submission channels by the end of 2021.

The HKIDR is expected to be launched in the second half of 2022 and the OTCR in the first half of 2023.