Investor identification regime at the trading level for the securities market in Hong Kong

Currently, for securities orders placed by intermediaries for their clients, the trading system of The Stock Exchange of Hong Kong Limited (SEHK) only captures information of the intermediaries, but not of its clients which instruct the orders.  When suspicious trading activities arise, the Securities and Futures Commission of Hong Kong (SFC) has to issue notices to the intermediaries to identify the underlying clients, and may not be able to deal with such activities as promptly as the regulator would like to. From the perspective of the intermediaries (including SFC licensed corporations and registered institutions), they have to incur substantial compliance costs in handling with SFC’s enquiries. Thus, the SFC determined to introduce a new investor identification regime for the securities market in Hong Kong so that securities trading orders can be traced to those who give instructions.

Personal data privacy of clients

An intermediary has to collect each individual client’s CID, including name and identity document number, type, and place of issue. If the client has a Hong Kong identity card but uses different identity documents to open securities accounts, the intermediary should follow up with the client to update the CID with his/her Hong Kong identity card information. 

To comply with the Personal Data (Privacy) Ordinance of Hong Kong, intermediaries have to obtain their clients’ consents before submitting their CID to the SEHK. Clients who do not give consents will not be able to purchase securities through the intermediaries but will still be able to sell their securities. Also, the BCAN should not be generated, assigned or handled in a way which would identify any individual client, compromise the confidentiality of the client’s identity, or give rise to non-compliance with the applicable privacy laws. 

With reference to the industry standards and practices, the SFC and SEHK have considered appropriate measures to ensure the security and confidentiality of CID in aspects including data transmission/storage, access to CID, incident management and cybersecurity.

Practical impacts

When taking steps to comply with the investor identification regime, intermediaries are enhancing data security for their clients. Some of them are taking this opportunity to make additional investments in financial technology at the same time, in order to further develop online and mobile clientele and businesses.

The new regime is also described as a “real-name system” for Hong Kong securities trading. In the past, there were incidents where different investors used the same securities account to participate in Hong Kong securities trading. This practice may cease because orders placed by persons other than the securities account holder will be tagged with the BCAN of the account holder who may no longer be willing to let other persons’ orders be taken by the regulators as his/her own orders.

(The author would like to thank Ms. Mandy Kong (paralegal) for her contribution in this article.)