The SFC recognises that outsourcing back office functions to third party service providers might involve records or documents being kept by the third party.
If a Platform Operator keeps the records or documents required under the SFO or the AMLO (Regulatory Records) exclusively with a third party service provider, approval under section 130 of the SFO and/or section 53ZRR of the AMLO in respect of the premises of the service provider is required. Approval of the service provider’s premises is not necessary if the Platform Operator keeps the original documents at its approved premises and sends imaged records or data to the service provider for processing (with the processed data also being maintained by the Platform Operator); or identical electronic records or documents are kept contemporaneously at both the premises of the service provider and the approved premises of the Platform Operator.
The same applies regardless of whether the premises of the service provider at which the records or documents are kept are located in Hong Kong or elsewhere. For keeping records and documents at premises outside Hong Kong, please refer to Q3.
Platform Operators are reminded that these outsourcing arrangements do not in any manner alter the obligations of a Platform Operator to keep at all times all Regulatory Records at the premises that have been approved by the SFC under section 130 of the SFO and/or section 53ZRR of the AMLO.
Platform Operators are also reminded of their obligation to notify the SFC of such outsourcing arrangements in compliance with the Securities and Futures (Licensing and Registration) (Information) Rules and/or the VATP Guidelines.
Q1 : If a Platform Operator outsources some of its back office functions, such as data processing, to a third party service provider, does the Platform Operator need to apply for approval under section 130 of the SFO and/or section 53ZRR of the AMLO in respect of the premises of that service provider for keeping records or documents? What if the service provider keeps some of the Platform Operator’s records or documents outside Hong Kong?
Q2 : If a Platform Operator sets up new branches, does it need to apply for approval under section 130 of the SFO and/or section 53ZRR of the AMLO in respect of the premises of each branch?
Q3 : Certain records or documents of a Platform Operator are required to be kept at premises approved by the SFC under section 130 of the SFO and/or section 53ZRR of the AMLO. Will the SFC approve premises outside Hong Kong under section 130 of the SFO and/or section 53ZRR of the AMLO?
The SFC will generally only approve premises that are located in Hong Kong because section 130 of the SFO and/or section 53ZRR of the AMLO must be read in the light of the SFC’s related powers under Parts VI and VIII of the SFO and/or Part 3 of the AMLO, the VATP Guidelines and the related obligations of Platform Operators in respect of the keeping of their records. By way of example, the SFC has the power under Part VIII of the SFO and/or Part 3 of the AMLO to enter premises to inspect the records of a Platform Operator, but would be precluded from exercising this power in the event of the premises being located outside Hong Kong. Further, the Securities and Futures (Keeping of Records) Rules and the VATP Guidelines stipulate the records that must be kept by Platform Operators and that they must be kept in a manner that will enable an audit to be conveniently and properly carried out.
The SFC considers that, in the event of it approving premises outside Hong Kong under section 130 of the SFO and/or section 53ZRR of the AMLO, these types of powers and obligations could be undermined. Accordingly, the SFC insists that all Regulatory Records must be kept at approved premises in Hong Kong unless they are Regulatory Records in electronic form kept by an electronic data storage provider (EDSP) or an affiliate of the Platform Operator.
Data centres at which Platform Operator’s electronic Regulatory Records are exclusively kept are required to be approved by the SFC under section 130 of the SFO and/or section 53ZRR of the AMLO regardless of whether they are located in Hong Kong. This requirement applies to data centres used by an EDSP engaged by a Platform Operator or its affiliate as well as to an affiliate’s own data centres. Approvals may be given subject to any condition imposed under section 403 of the SFO and/or paragraph 14.6 of the VATP Guidelines, including the condition that all physical records or documents are kept in approved premises in Hong Kong.
For details, please refer to the FAQs on the use of external electronic data storage.
If an EDSP does not disclose the addresses of its data centres for security or other reasons, the Platform Operator should at least provide the jurisdictions in which the data centres are located for the SFC’s approval. Similarly, if an affiliate does not disclose the addresses of its data centres or the data centres of the EDSPs engaged by it, the Platform Operator should at least provide the address of the premises used by the affiliate for approval.
Q4 : Does the SFC allow Platform Operators to carry on their businesses in business centres or shared offices, or to change their office locations frequently?
The SFO and its related rules and the AMLO do not prescribe the type of office from which a Platform Operator must operate. However, the business premises that a Platform Operator chooses must be suitable for the business activities that it is licensed to carry on under the SFO and/or the AMLO.
Platform Operators must ensure, at all times, that their office arrangements are suitable. This is a continuing obligation and any failure to comply with it will give rise to concerns on the part of the SFC and might result in the SFC taking regulatory action.
Generally speaking, the SFC expects Platform Operators to carry on business from a “fixed abode” and discourages frequent changes of office location.
As a matter of principle, a Platform Operator should satisfy itself that the business premises occupied by it are appropriately secured and that confidential or non-public information (such as price sensitive information) and client privacy will be sufficiently safeguarded against unauthorised access or leakage.
The SFC does not distinguish business centres or shared offices from other types of business accommodation. However, the following factors would suggest that the premises are likely to be unsuitable:
- where there is no secured and properly segregated office area, which is able to be locked and which is designated for the Platform Operator’s own and exclusive use, and in which its business records, particularly those relating to clients, are able to be securely held;
- where essential office equipment and telecommunication systems are installed in such a way that they are not situated within an enclosed area that is secure and accessible only by the corporation’s staff and authorised personnel;
- where no or insufficient measures are taken to prevent confusion that might be caused to clients by the existence of other business entities occupying the same premises;
- where the nature of the Platform Operator’s business demands frequent face-to-face dealings or meetings with clients at the Platform Operator’s premises, during which client information and instructions are likely to be exchanged, and practical difficulties exist for the Platform Operator to ensure confidentiality during such meetings; or
- where the Platform Operator has not ensured that its office premises will always be accessible for all formal regulatory visits, including investigations and inspections.
Although the above factors are considered by the SFC to be of principal concern in respect of the appropriateness or otherwise of business premises occupied by Platform Operators, they should not be considered to constitute an exhaustive list because circumstances might exist in certain situations that give rise to particular accommodation needs or requirements.
Platform Operators have an ongoing obligation to anticipate such matters and to ensure that their business premises are, at all times, suitable for the purposes for which they are being used.
Last update: 31 May 2023