Search for:

In brief

The Hong Kong Securities and Futures Commission (SFC) recently released additional guidance on external electronic data storage in the form of frequently asked questions (FAQs)1, which elaborate on the requirements for using external electronic data storage providers (EDSPs) under the SFC’s 31 October 2019 circular (“EDSP Circular“)2. The FAQs provide further guidance on the following key aspects: (i) key personnel requirements for the purpose of the EDSP Circular; (ii) the application of the EDSP Circular where electronic regulatory records are kept with affiliates; and (iii) the use of undertakings by designated Manager(s)-in-Charge (MIC(s)) / Responsible Officer (RO) (“MIC/RO Undertaking“) as acceptable alternatives to the undertakings provided by the EDSPs (“EDSP Undertaking“). We discuss the implications in these areas further below. The SFC has also made consequential changes to its Frequently Asked Questions on premises for business and record keeping3.


Key takeaways

Please see below a summary of the key takeaways under the FAQs:

1.  Key personnel requirements

Is it mandatory to have two MICs in Hong Kong for the  purposes of the EDSP Circular? If it is not feasible to have two MICs in Hong Kong, the SFC  may consent to one MIC or one RO ordinarily resident in Hong  Kong on a case-by-case basis:

  • One MIC arrangement: This MIC would ordinarily be expected to be the MIC of the overall management oversight function, unless the SFC is satisfied that another MIC is in a better position to assume this role and has the authority, knowledge and expertise to discharge the relevant duties.
  • One RO arrangement: This would only be considered if the SFC is satisfied that no MIC ordinarily resident in Hong Kong has the authority, knowledge and expertise to discharge the relevant duties.
What would be the criteria for identifying MICs for the  purpose of the EDSP Circular? The key criteria are as follows:

  • Authority: The key consideration is that the person must have authority within the organisation and its corporate group to ensure that the SFC has effective access to the electronic regulatory records upon demand and without delay.
  • Knowledge and expertise: The person should have a general understanding of how electronic regulatory records are stored. There is no need to possess in-depth technical knowledge or expertise.

 

2.  Use of affiliates in keeping regulatory records

Does the EDSP Circular capture the use of affiliates to  keep electronic regulatory records? The EDSP Circular was not initially drawn up with the scenario  where electronic regulatory records are kept exclusively with  non-Hong Kong affiliates in mind. The FAQs have now clarified  the circumstances under which licensed corporations   may do so:

  • Specific requirements: Paragraphs 7(d) to (h) and 8 of the EDSP Circular (including the requirements to obtain approval) will equally apply to the use of affiliates to keep electronic regulatory records exclusively. The same applies regardless of (i) the place of incorporation of such affiliates and (ii) whether such affiliates further engage other EDSPs. The references to “EDSP” in the relevant paragraphs of the EDSP Circular should include such affiliates as applicable.
  • General requirements: In the case where information is kept or processed electronically using EDSPs engaged by affiliates, the general requirements under section E of the EDSP Circular (with the exception of paragraph 21 concerning the need to have a service agreement between the licensed corporation and the EDSP) shall apply.
If electronic regulatory records are kept exclusively with  affiliates, what is the approval requirement? Approval is required for the use of affiliates (whether in Hong  Kong or elsewhere) to keep electronic regulatory records  exclusively:

  • Records kept with non-Hong Kong affiliates exclusively: Approval is required for the premises of the non-Hong Kong affiliate, data centres or other premises used by such affiliate or the EDSPs engaged by such affiliate (as the case may be) for keeping electronic regulatory records. If the records are currently kept electronically and exclusively with an overseas affiliate, the licensed corporation should approach the SFC forthwith to discuss and seek approval.
  • Records kept with Hong Kong affiliates exclusively: Approval is also required. The licensed corporation should approach the SFC to discuss if the electronic regulatory records are currently kept with a local Hong Kong affiliate exclusively, and obtain the necessary approvals.

If the affiliate does not disclose the address of its data centres or the data centres of the EDSPs engaged by it, the licensed corporation should at least provide the address of the premises used by the affiliate for approval.

 

3.  Use of MIC/RO Undertaking

What is an MIC/RO Undertaking?
  • Form: The MIC/RO Undertaking is in the form of the template in Appendix 1 to the FAQs.
  • Person giving the MIC/RO Undertaking: The MIC/RO Undertaking should be given by each of the two MICs appointed under paragraph 7(g) of the EDSP Circular or, if the SFC so consents, one MIC/ RO who is ordinarily resident in Hong Kong for such purposes.
  • Content and coverage: This will cover, amongst other things, an undertaking by the MIC/ RO to ensure accessibility of the regulatory records, maintenance of audit trail by the relevant affiliate or EDSP, operational resilience of the licensed corporation’s arrangements for electronic data storage, and maintenance of accurate and up to date access maps documenting the details on the electronic regulatory records (including their types and physical locations).
In what circumstances is an MIC/ RO Undertaking needed?
  • Records kept with non-Hong Kong affiliates: The electronic regulatory records are kept exclusively with non-Hong Kong affiliates (whether or not such affiliates engage any EDSPs to keep electronic regulatory records).
  • Records kept with Hong Kong affiliates: The electronic regulatory records are kept exclusively with Hong Kong affiliates, which in turn use EDSPs or other non-Hong Kong affiliates to keep electronic regulatory records.
In what circumstances can an MIC/RO Undertaking be used as an alternative?
  • Alternative to the EDSP Undertaking: An EDSP Undertaking is applicable if the electronic regulatory records are kept exclusively with non-Hong Kong EDSPs. The SFC will accept an MIC/RO Undertaking as an alternative provided that the conditions set out in Q10 of the FAQs are complied with.
  • Alternative to the Notice with the Hong Kong EDSP’s Countersignature: A Notice with the Hong Kong EDSP’s Countersignature is applicable if the electronic regulatory records are kept exclusively with Hong Kong EDSPs. The SFC will accept an MIC/RO Undertaking as an alternative provided that the conditions set out in Q10 of the FAQs are complied with.

Licensed corporations may also approach the SFC to propose or discuss other alternatives that may satisfy their regulatory objectives and requirements.

Next steps

If licensed corporations have kept their electronic regulatory records exclusively with an EDSP or an affiliate before the date of the FAQs without prior approval from the SFC in respect of the relevant premises, they should:

  • without delay notify the SFC’s Licensing Department
  • apply for approval for the relevant premises as soon as practicable

Licensed corporations are recommended to take immediate actions, including the below:

  • assess if their regulatory records are stored exclusively with an EDSP or an affiliate, and whether approval from the SFC is required
  • if approval is required and has not yet been sought:
    • assess the key personnel arrangements, and if after assessment, it is determined that it is not feasible to have two MICs in Hong Kong, engage in discussion with the SFC regarding the possibility of having one MIC or one RO only
    • assess if the MIC/RO Undertaking is required or will be used as an alternative to the EDSP Undertaking/Notice with the Hong Kong EDSP’s Countersignature, and in doing so, assess if the conditions for using such mechanism can be met (such as putting in place access maps, ensuring cross-border information transfer, operational resilience, etc.)
    • discuss with the concerned MIC/RO the terms of the MIC/RO Undertaking (and applicable insurance coverage)
  • approach the SFC and promptly discuss the situation with them

Should you have any questions in relation to the matters that we have highlighted above, please liaise with your usual contact at Baker McKenzie or the lawyers listed in this client alert.


https://www.sfc.hk/en/faqs/intermediaries/supervision/Use-of-External-Electronic-Data-Storage/Use-of-External-Electronic-Data-Storage
https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/intermediaries/supervision/doc?refNo=19EC59
https://www.sfc.hk/en/faqs/intermediaries/licensing/Premises-for-business-and-record-keeping

Author

Karen Man is a partner in Baker McKenzie’s Financial Services group, leading the non-contentious Financial Services Regulatory practice. Her clients include global, Chinese and local banks, fund managers, brokers/dealers, money service operators and fintech firms. Karen is admitted to practice in Hong Kong, the UK, and Australia.

Author

Grace Fung is a partner in Baker McKenzie’s Financial Services group.

Author

Samantha Lai is a Special Counsel in Baker McKenzie, Hong Kong office.

Author

Aaron Dauber is a Registered Foreign Lawyer and the Knowledge Lawyer for Baker McKenzie's non-contentious Financial Services Regulatory practice. He is responsible for monitoring and training on regulatory change, legal content projects and other knowledge initiatives to support the firm and our clients. Aaron's experience includes over 13 years' as an in-house counsel responsible for legal support to businesses across the Asia Pacific region including Japan and Australia with a global systemically important bank.