The 78-year-old and the 7.5% Perpetual

The central failure is the mismatch between the recommendation and the client's circumstances. Under the SFC Code of Conduct, a solicited recommendation must be reasonably suitable having regard to the client's financial situation, investment experience, risk tolerance and investment horizon. Mrs Chan is 78, has limited investment knowledge, needs liquidity and has HKD 1.8 million, or about 72% of her liquid savings, placed in a single unrated perpetual instrument. A balanced profile completed in 2019 is stale and does not reflect her current age, income or capacity to absorb a 35% loss. The firm should have updated KYC and reassessed suitability rather than relying on a signed risk acknowledgment. Paragraph 5.2 suitability is not satisfied by documentation alone; the substance of the advice matters.

The product itself required closer scrutiny: an unrated perpetual with non-call risk, coupon deferral risk and issuer concentration risk is not a simple substitute for deposits. Ken's two-page summary and WhatsApp solicitation did not demonstrate product due diligence or explain key risks. There is no recorded rationale explaining why the recommendation suited Mrs Chan, which is a significant evidentiary gap.

Supervisory failures compound the issue: no pre-trade supervisor review, no escalation for an elderly client, and a records policy that deletes WhatsApp messages after 30 days. Record-keeping failures matter because they prevent the firm from reconstructing advice and defending or remediating the sale. The most serious SFC concerns would be unsuitable solicitation to a vulnerable client, inadequate KYC, weak product governance and ineffective supervision.

Compliance should first protect the client and preserve evidence. It should suspend further recommendations by Ken pending review, place the client's account under enhanced monitoring and ensure she receives an immediate explanation of the product and her options. It should preserve all available records, including server logs, emails, CRM notes, the iPad signature record and any recoverable WhatsApp backups; the 30-day deletion policy should be suspended for this matter and reviewed generally.

Second, Compliance should reconstruct the sales process and assess whether other clients, particularly elderly or low-knowledge clients, received similar recommendations. A sample review of Ken's sales over the past 12 to 24 months is appropriate, together with a review of approvals for unrated perpetual instruments. The firm should assess whether there was a breach of the Code of Conduct and whether the matter is material enough to notify the SFC. There is no automatic reporting threshold for every suitability breach, but the SFC expects prompt notification of material breaches, control failures and client detriment. Legal advice should be taken before any notification, and the notification should be factual and include remediation.

Third, the firm should consider client redress, including compensation or reversal where appropriate, and report to senior management and the board. It should review the complaints-handling process and ensure the daughter's complaint is acknowledged and investigated independently. Root causes include the stale risk profile, absence of a suitability rationale, lack of elderly-client safeguards and poor record retention. Remediation should include mandatory suitability documentation, supervisor sign-off for high-risk or concentrated recommendations, vulnerable-client procedures and a communications-archiving solution that captures WhatsApp.

The complaint should be handled as a formal client complaint, not merely as a relationship issue. The firm should acknowledge it promptly, appoint an independent complaints officer who was not involved in the sale, and set out a clear timeline. The officer should interview Mrs Chan and her daughter, obtain consent for any medical or capacity information if relevant, and explain the firm's complaint and dispute-resolution channels, including the Financial Dispute Resolution Centre if the matter is not resolved.

The decisive evidence will be the contemporaneous record of what was said and why the recommendation was suitable. The firm will need the updated KYC, the 2019 risk profile, the product summary, the signed acknowledgment, the WhatsApp messages if recoverable, call recordings, the supervisor's review records and any notes of the home visit. The absence of a documented suitability rationale and the deletion of messages will weaken the firm's position significantly. The signed risk acknowledgment is unlikely to be decisive because it does not prove that Mrs Chan understood the risks or that the advice was suitable.

The investigation should assess whether Ken explained concentration, illiquidity, coupon deferral and issuer risk, and whether he knew or ought to have known that the investment was unsuitable. The outcome should include a clear finding, reasons, any redress and preventive actions. The firm should also consider whether the matter reveals a systemic issue requiring notification to the SFC or an insurer. Throughout, the firm should avoid admissions of liability without legal advice, but it should not withhold information from the client that she is entitled to receive.