The legal status of the SFC Credit Rating Agencies Code

A regulatory code can be important without being the same thing as an Act or a subsidiary regulation. The SFC's Credit Rating Agencies Code (CRA Code) illustrates that distinction for firms providing Type 10 credit rating services.

What the CRA Code does

The CRA Code sets conduct standards for persons providing credit rating services in Hong Kong. Its requirements address how a credit rating agency manages conflicts, protects the quality and integrity of ratings, handles confidential information, maintains independence, and communicates its methodology and rating actions. It complements the SFO licensing regime and applicable subsidiary legislation; it does not replace them.

A code is not automatically a separate offence

Section 399 of the SFO addresses codes and guidelines issued by the SFC. A failure to observe a code does not of itself make a person liable to civil or criminal proceedings. That does not make the code optional in a practical regulatory sense. The SFC can consider compliance with a code when assessing conduct, fitness and propriety, internal controls, or whether other statutory or licensing obligations were breached.

Section 399 also allows a code or guideline to be admissible in evidence in proceedings under the Ordinance. A court or tribunal may consider it when deciding a question relevant to the proceeding. The code can therefore be persuasive or evidential without automatically creating a standalone cause of action.

How to analyze a scenario

1. Identify the regulated person and the relevant activity, such as Type 10 credit rating services.
2. Identify whether the requirement comes from the SFO, subsidiary legislation, a licence condition, a code, or an internal policy.
3. If a code requirement was not followed, do not immediately call it a criminal offence.
4. Ask whether the same facts also indicate breach of a statutory duty, licence condition, or fit-and-proper obligation.
5. Consider the code's evidential or regulatory relevance, then state the legal consequence with care.

This distinction appears across SFC codes, not only the CRA Code. A code may express expected standards and help the regulator assess conduct; the legal consequence of a particular failure still depends on the Ordinance, rules, licence conditions, and facts.

The hierarchy of regulatory requirements

A credit rating agency providing Type 10 services may be subject to the SFO, subsidiary legislation, licence conditions, SFC codes and guidelines, and its own policies. These instruments do not all have the same legal status. The CRA Code states standards for rating-service providers, while the Ordinance and rules create binding statutory obligations. A single set of facts can engage more than one layer, so identify the source of each alleged requirement.

What section 399 says

Section 399 provides for SFC codes and guidelines and clarifies that failure to observe one does not of itself make a person liable to civil or criminal proceedings. It also allows a code or guideline to be admissible in proceedings under the Ordinance and considered on a relevant question. Thus “not a standalone offence” does not mean “irrelevant” or “optional.” The SFC can consider code compliance in supervision and discipline, while liability must rest on an applicable statutory or other legal basis.

How the CRA Code informs conduct

The CRA Code addresses the quality and integrity of ratings, conflicts, independence, confidential information, methodology and disclosure. A departure can reveal weak controls or conduct inconsistent with fitness and properness, depending on the facts. The regulator may ask whether the agency identified a conflict, separated analytical judgment from commercial pressure, documented a rating committee decision and disclosed a material methodology limitation. A code standard can supply evidence about expected practice without automatically being an offence provision.

Scenario analysis

Suppose an agency fails to update a rating after a material event. First ask whether a specific SFO provision, rule or licence condition was breached. Then consider what the CRA Code required concerning surveillance, review and communication, and whether the departure is evidence of inadequate controls or misconduct. Do not stop at “the Code was breached, so a crime occurred”; do not stop at “section 399 means there are no consequences.” The statutory basis and regulatory context determine the result.

A concise exam answer

State that section 399 prevents a code failure, by itself, from creating civil or criminal liability; it permits evidential use and regulatory consideration. Then explain that the same conduct may breach a separate statutory duty, rule or licence condition and may affect fitness and properness. This balanced answer captures both the legal limit and the practical force of the code.

Keep legal consequences precise

Use careful language: a code departure may be evidence, inform an assessment or contribute to a finding under another obligation; the exact outcome depends on the SFO and facts. Avoid calling every breach “illegal” without identifying a binding provision, and avoid saying the code can be ignored. For a credit rating agency, the SFC may examine whether conduct meets licensing and fitness-and-properness standards alongside the Code. The practical exam skill is to identify both the source of the standard and the source of the consequence.

Apply the distinction beyond the CRA Code

The same section 399 analysis applies to other SFC codes and guidelines: identify the code standard, then separately determine whether the conduct breaches a statutory requirement or informs a regulatory judgment. A firm should not treat “not a separate offence” as permission to disregard supervisory guidance. Equally, an exam answer should not convert a guidance departure into strict criminal liability without a legal basis.

Exam takeaway

Remember the two-part answer: a code sets standards and matters to regulatory supervision; breach alone is not automatically a civil or criminal offence under section 399. Then check whether the underlying conduct separately violates a binding requirement.