Member Article

Hong Kong’s Securities and Futures Commission (SFC) issued a circular last year (the Circular) in recognition of the increasing use of electronic data storage (cloud storage) for record keeping purposes. The Circular was intended to provide licensed corporations with greater flexibility in keeping regulatory records with electronic data service providers (EDSPs), as well as to clarify their general obligations in relation to electronic data.

Record keeping premises must be approved by the SFC, and in the past the SFC practice has been to approve only premises in Hong Kong due to limitations on the SFC’s jurisdiction and powers of enforcement. The Circular was intended to provide a pathway for the approval of premises of EDSPs for cloud storage of intermediaries’ records.

The Circular gave rise to a number of issues, in particular the requirements to secure the cooperation of overseas third party electronic data service providers, which resulted in intensive discussions with various interested industry associations to develop practical solutions.

You can access our previous publications regarding the Circular here:

Use of external electronic data storage by SFC licensed corporations (19 November 2019)

Compliance reminder about SFC requirements on use of external electronic data storage (22 April 2020)

Treatment of cloud computing in IOSCO’s consultation on outsourcing (21 July 2020)

In his opening remarks at the SFC Compliance Forum on 30 October 2020, the SFC’s CEO Ashley Alder announced that the SFCwill adopt the industry’s suggestion that a firm’s Managers-In-Charge be designated to bear primary responsibility for ensuring compliance in this area, in line with the SFC’s broader objective to reinforce the accountability of senior management. The SFC will soon publish a set of frequently asked questions (FAQs) to explain in more detail how this will work.

It is very encouraging that the SFC is giving favourable consideration to the industry’s proposals and we will provide further analysis once the FAQs have been published.