Section 399 and the Status of SFC Codes and Guidelines

A reference to an SFC guideline does not automatically mean the text is a regulation. The Securities and Futures Ordinance gives the Commission authority to issue guidance while keeping the legal status of that guidance distinct from legislation.

The section 399 authority

Section 399 of the SFO permits the Commission to publish codes and guidelines to provide guidance on the operation of the Ordinance and any rules made under it. The SFC identifies its Management, Supervision and Internal Control Guidelines as issued under section 399. The guidelines address systems and controls expected of persons licensed by or registered with the Commission.

Guidance is not the same as a rule

The statute distinguishes codes and guidelines from subsidiary legislation. A guideline does not become a binding regulation merely because the SFC publishes it under section 399. But it is not irrelevant: the Commission may consider relevant guidance when assessing whether conduct meets legal or regulatory standards, and a departure may call for explanation depending on the facts and other applicable requirements.

How to answer a question

If the question asks under which SFO provision the Internal Control Guidelines are published, answer section 399. If it asks whether the guidelines are themselves subsidiary legislation, answer no. If it asks whether they can affect a regulatory assessment, they can provide relevant guidance and context.

What section 399 authorizes

Section 399 of the Securities and Futures Ordinance gives the SFC power to publish codes and guidelines for providing guidance on provisions of the Ordinance or other matters relating to its functions. A code or guideline is not, simply by being published under section 399, subsidiary legislation. Its status is guidance rather than a freestanding statutory rule. This distinction matters when a question asks about legal force, but it does not make the material irrelevant to supervision or conduct.

How the SFC may use guidance

The SFO permits the SFC to have regard to a code or guideline when deciding whether a person has contravened a relevant requirement or engaged in misconduct. A code can therefore provide a practical benchmark for expected systems and behavior. Departure may be evidence considered by the regulator, but it is not automatically a statutory breach without the applicable legal analysis. Likewise, a person cannot safely assume that following a guideline is a complete defense if the underlying statutory duty or facts point the other way.

Do not confuse codes with binding rules

The SFC’s regulatory toolkit includes legislation, subsidiary rules, licence conditions, codes, guidelines, circulars, and individual decisions. These instruments can differ in source and legal effect. A subsidiary rule made under statutory authority may be legally binding; a code may articulate standards and inform supervisory judgment; a circular may explain a regulator’s current expectations or response to a risk. Read the instrument’s enabling provision and its own status statement before calling it “law.”

Example: internal controls

Suppose a licensed firm’s controls fall below a standard described in the Management, Supervision and Internal Control Guidelines. The regulator may consider that departure together with the firm’s statutory obligations, licensing conditions, actual harm, and management’s knowledge. The analytical question is not merely “was the guideline breached?” It is what binding requirement applies, what the guidance indicates about expected conduct, and how the evidence bears on the regulator’s decision. This avoids treating guidance as either irrelevant or automatically enforceable as legislation.

How to answer a status question

State that section 399 authorizes publication of codes and guidelines and that the SFC may have regard to them in performing its functions. Then explain that this does not make every sentence subsidiary legislation. Identify the underlying statutory or rule obligation and the specific relevance of the guidance. If asked about consequences, separate direct statutory penalties from disciplinary consequences arising through a contravention or misconduct finding under the applicable power.

Practical reading checklist

For any SFC publication, check: (1) the legal source or enabling provision; (2) whether the text calls itself a code, guideline, rule, or circular; (3) the statement about its force and intended audience; (4) the underlying requirement it explains; and (5) the regulator’s current version and effective date. Use the current publication rather than relying on a historic consultation draft. An exam question may test precisely the difference between “must” in legislation and a guidance standard that informs what reasonable compliance looks like.

Guidance informs expected practice

A code or guideline may show what the regulator expects from a reasonable compliance system. If a firm departs, the SFC may consider why, what alternative controls existed and whether the statutory duty was met. A documented alternative can be relevant, but compliance with a guideline is not necessarily a complete defense. Guidance is neither automatically legislation nor irrelevant.

Circulars communicate supervisory expectations

A circular may explain an emerging risk or call for steps under existing duties. Publication does not automatically create a new offence; ignoring a clear communication may still matter in supervision or a later controls assessment. Read its legal basis, scope, language and effective date to distinguish new statutory rules from compliance expectations.

Version control matters

Codes and guidelines change. Firms should identify the version for the relevant period, retain update records and assess whether policies need revision. An old consultation draft may describe a proposal that never took effect. For current questions, use the official SFC publication and confirm its date.

Use precise verbs

Legislation “requires”; a code “sets out standards”; the SFC “may have regard to” guidance. Then connect the publication to the underlying statutory duty. This language reflects section 399 more accurately than saying a code is either binding law or optional advice.

Exam takeaway

Section 399 is the publication authority. Keep three ideas separate: the SFO and subsidiary legislation create legal requirements; SFC codes and guidelines offer regulatory guidance; and the Commission may consider that guidance when evaluating conduct.