The Hong Kong Securities and Futures Commission (SFC) recently released additional guidance on external electronic data storage in the form of frequently asked questions (FAQs)1, which elaborate on the requirements for using external electronic data storage providers (EDSPs) under the SFC’s 31 October 2019 circular (“EDSP Circular“)2. The FAQs provide further guidance on the following key aspects: (i) key personnel requirements for the purpose of the EDSP Circular; (ii) the application of the EDSP Circular where electronic regulatory records are kept with affiliates; and (iii) the use of undertakings by designated Manager(s)-in-Charge (MIC(s)) / Responsible Officer (RO) (“MIC/RO Undertaking“) as acceptable alternatives to the undertakings provided by the EDSPs (“EDSP Undertaking“). We discuss the implications in these areas further below. The SFC has also made consequential changes to its Frequently Asked Questions on premises for business and record keeping3.
Please see below a summary of the key takeaways under the FAQs:
1. Key personnel requirements
|Is it mandatory to have two MICs in Hong Kong for the purposes of the EDSP Circular?||If it is not feasible to have two MICs in Hong Kong, the SFC may consent to one MIC or one RO ordinarily resident in Hong Kong on a case-by-case basis:
|What would be the criteria for identifying MICs for the purpose of the EDSP Circular?||The key criteria are as follows:
2. Use of affiliates in keeping regulatory records
|Does the EDSP Circular capture the use of affiliates to keep electronic regulatory records?||The EDSP Circular was not initially drawn up with the scenario where electronic regulatory records are kept exclusively with non-Hong Kong affiliates in mind. The FAQs have now clarified the circumstances under which licensed corporations may do so:
|If electronic regulatory records are kept exclusively with affiliates, what is the approval requirement?||Approval is required for the use of affiliates (whether in Hong Kong or elsewhere) to keep electronic regulatory records exclusively:
If the affiliate does not disclose the address of its data centres or the data centres of the EDSPs engaged by it, the licensed corporation should at least provide the address of the premises used by the affiliate for approval.
3. Use of MIC/RO Undertaking
|What is an MIC/RO Undertaking?||
|In what circumstances is an MIC/ RO Undertaking needed?||
|In what circumstances can an MIC/RO Undertaking be used as an alternative?||
Licensed corporations may also approach the SFC to propose or discuss other alternatives that may satisfy their regulatory objectives and requirements.
If licensed corporations have kept their electronic regulatory records exclusively with an EDSP or an affiliate before the date of the FAQs without prior approval from the SFC in respect of the relevant premises, they should:
- without delay notify the SFC’s Licensing Department
- apply for approval for the relevant premises as soon as practicable
Licensed corporations are recommended to take immediate actions, including the below:
- assess if their regulatory records are stored exclusively with an EDSP or an affiliate, and whether approval from the SFC is required
- if approval is required and has not yet been sought:
- assess the key personnel arrangements, and if after assessment, it is determined that it is not feasible to have two MICs in Hong Kong, engage in discussion with the SFC regarding the possibility of having one MIC or one RO only
- assess if the MIC/RO Undertaking is required or will be used as an alternative to the EDSP Undertaking/Notice with the Hong Kong EDSP’s Countersignature, and in doing so, assess if the conditions for using such mechanism can be met (such as putting in place access maps, ensuring cross-border information transfer, operational resilience, etc.)
- discuss with the concerned MIC/RO the terms of the MIC/RO Undertaking (and applicable insurance coverage)
- approach the SFC and promptly discuss the situation with them
Should you have any questions in relation to the matters that we have highlighted above, please liaise with your usual contact at Baker McKenzie or the lawyers listed in this client alert.