SFC and HKMA Roles for Registered Institutions

Banks occupy a different place in Hong Kong’s intermediary framework from ordinary securities firms. A bank conducting securities business is an authorized institution under the Banking Ordinance and may also need to be registered with the SFC under the Securities and Futures Ordinance. The HKMA then supervises the bank’s regulated activities day to day as frontline regulator, while the SFC retains the broader statutory role for the securities and futures industry.

AI status and SFC registration are separate

An authorized institution is a bank, restricted licence bank, or deposit-taking company authorized under the Banking Ordinance. If an AI carries on one or more relevant regulated activities, it applies to the SFC for registration as an RI under section 119 of the SFO. SFC guidance describes RIs as authorized financial institutions registered to carry on regulated activities, with specific exclusions in the activity list. An AI’s banking authorization alone is not the same thing as permission to conduct every SFO regulated activity.

The order of analysis is useful: identify the legal entity, confirm its status as an AI, determine which regulated activity it proposes to conduct, and check its SFC registration and conditions. The firm should also consider whether a proposed product is actually a regulated activity or falls within an exclusion. A bank group may contain multiple companies; one entity’s authorization or registration does not automatically extend to another.

Who does what

The HKMA’s Supervisory Policy Manual module SB-1 explains that the SFC has ultimate responsibility for regulation of intermediaries in the securities and futures market, while the HKMA is frontline supervisor responsible for day-to-day supervision of RIs’ regulated activities. The SFO permits the SFC, when performing functions in relation to an RI, to rely in whole or in part on the HKMA’s supervision. This is a coordinated model rather than two unrelated licensing systems.

The HKMA reviews an RI’s governance, management oversight, controls, staff competence, conduct, and compliance as part of its ongoing supervisory work. It can engage with the bank on weaknesses and refer or coordinate matters with the SFC as appropriate. The SFC sets the SFO framework, registers the institution, maintains the public register, and retains relevant statutory powers. Both authorities work under the laws and memoranda that govern their cooperation.

Relevant individuals and executive officers

A frequent exam distinction is that people performing regulated functions for an RI are not licensed by or registered with the SFC in the same way as representatives of a licensed corporation. The SFC’s licensing guidance says relevant individuals of RIs are not required to be licensed or registered with the SFC; they are subject to the applicable bank staff regime and appear on HKMA registers. This does not mean individuals are unregulated or that competence checks disappear.

An RI appoints executive officers to directly supervise each regulated activity for which it is registered. The SFC’s guidance and HKMA’s SB-1 describe requirements for at least two executive officers for each activity, with at least one available at all times to supervise the business. Executive-officer status and relevant-individual status should not be confused with an SFC responsible officer role at a licensed corporation.

Changes in business scope

If an AI wants to add a regulated activity or change its registration conditions, the SFC’s registration process applies, with the HKMA involved in the supervisory assessment. HKMA SB-1 advises AIs to notify the HKMA in advance of an intended application. The institution should prepare its staffing, systems, policies, client disclosures, and supervisory arrangements before launch. A bank’s existing securities registration should not be treated as blanket permission for a different activity.

Example

Bank A conducts securities dealing through its Hong Kong banking entity. The entity must be an AI and be appropriately registered with the SFC for Type 1. The HKMA supervises the bank’s Type 1 activity day to day, while the SFC remains the statutory regulator of the intermediary framework. If the bank proposes to offer asset management, it must examine the relevant activity scope and seek the necessary registration variation; it cannot rely on the fact that it already takes deposits or deals in securities.

Exam summary

• AI status comes from the Banking Ordinance; RI registration comes from the SFO.
• Banks carrying on relevant regulated activities register with the SFC as RIs.
• SFC retains ultimate responsibility; HKMA is frontline day-to-day supervisor for RIs.
• Relevant individuals at RIs follow the applicable HKMA framework and are not SFC-licensed representatives.
• Adding an activity requires the proper registration process and supervisory planning.

The division of work in a bank scenario

When a question describes a bank’s securities business, avoid choosing one regulator for every issue. The SFC framework determines the relevant regulated activity and the bank’s registration status. The HKMA is the frontline day-to-day supervisor of the registered institution’s regulated activities and examines how the business is controlled in practice. The authorities coordinate; the split does not mean the bank can choose which set of requirements to follow.

For example, if an authorized institution proposes to begin a new regulated activity, ask whether its existing SFC registration covers that activity and whether a variation is required. Separately consider the HKMA’s supervisory expectations around staffing, systems, risk controls and readiness. The activity should not begin merely because the bank is already authorized to take deposits or is supervised by the HKMA for banking purposes.

Why the individual-status distinction matters

A relevant individual performing regulated functions for a registered institution is not automatically an SFC-licensed representative of a licensed corporation. The employing legal entity determines which personnel regime applies. In a group structure, identify the entity that actually employs the individual and conducts the regulated business; the parent bank’s name or group-wide training does not substitute for the correct entity-level registration and controls.

A useful answer format is: identify the authorized institution; confirm SFC registration for the activity; state the HKMA’s frontline supervisory role; then classify the staff under the relevant-individual framework. This keeps registration, supervision and individual status distinct.