HKSI Paper 1 cheat sheet

Securities and Futures Ordinance (Cap. 571) consolidates the old Securities Ordinance, Commodities Trading Ordinance, and related legislation into one statute covering securities, futures, and leveraged foreign exchange trading.

The Securities and Futures Commission (SFC) is a statutory body established under the SFO; it is the front-line regulator of the securities and futures industry and is financed largely by levies and fees rather than by the government.

Hong Kong Exchanges and Clearing Limited (HKEX) is the exchange operator and listed-company owner of the Stock Exchange of Hong Kong (SEHK) and Hong Kong Futures Exchange (HKFE); it is itself regulated by the SFC.

The Stock Exchange of Hong Kong Limited (SEHK) operates the cash market while Hong Kong Futures Exchange Limited (HKFE) operates the derivatives market; both are recognized exchange companies under the SFO.

The Hong Kong Monetary Authority (HKMA) regulates banking business under the Banking Ordinance; for securities activities of registered institutions it acts as the SFC's front-line supervisory partner.

The Insurance Authority regulates insurance intermediaries under the Insurance Ordinance; the Mandatory Provident Fund Schemes Authority regulates MPF intermediaries under MPF legislation.

The SFC's regulatory objectives include maintaining market fairness, efficiency and transparency, protecting investors, reducing systemic risk, and promoting Hong Kong as an international financial centre.

The Financial Services and the Treasury Bureau (FSTB) is the policy bureau responsible for financial services policy; it does not carry out day-to-day market supervision.

Cross-sectoral coordination occurs through mechanisms such as the SFC-HKMA Memoranda of Understanding and the Council of Financial Regulators, which shares information among Hong Kong regulators.

The SFC may investigate under Part VIII of the SFO and has powers to require production of records, compel attendance, and enter premises under warrant.

The SFC may take disciplinary action against licensed corporations and licensed representatives, including public or private reprimand, revocation or suspension of licence, and fines of up to HK$10 million or three times the profit gained or loss avoided, whichever is greater.

The Market Misconduct Tribunal (MMT) is a civil tribunal chaired by a High Court judge; it hears SFC proceedings for insider dealing, false trading, price rigging, disclosure of false or misleading information inducing transactions, and stock market manipulation.

The SFC may seek court injunctions, disqualification orders against directors for up to five years, cold shoulder orders, and cease-and-desist orders.

The SFC's Enforcement Division handles investigations and disciplinary proceedings; the Corporate Finance Division administers the listing regime and takeovers; the Intermediaries Division handles licensing and supervision.

The Takeovers and Mergers Panel and the Takeovers Appeal Committee administer the Codes on Takeovers and Mergers and Share Buy-backs; the SFC's Executive Director of Corporate Finance chairs the Panel.

The Investor Compensation Fund, administered by the SFC, compensates investors for losses caused by default of licensed intermediaries, subject to per-investor and per-default caps.

The SFC may refer serious criminal conduct to the Hong Kong Police or the Department of Justice; it may also pursue criminal prosecution under the SFO for offences such as unlicensed dealing.

The SFC and the HKMA divide supervision: the SFC licenses corporations and individuals, while the HKMA supervises registered institutions (banks) conducting regulated activities under the SFO.

There are ten regulated activities (Types 1 to 10): dealing in securities; dealing in futures contracts; leveraged foreign exchange trading; advising on securities; advising on futures contracts; advising on corporate finance; providing automated trading services; securities margin financing; asset management; and providing credit rating services.

A corporation must be licensed for each regulated activity it carries on; an individual must be licensed as a representative and may only perform regulated activities for the licensed corporation to which he or she is accredited.

A licensed representative must be at least 18 years old, have the required industry qualification, pass the relevant SFC-recognised examination, and satisfy the fit-and-proper test.

Responsible Officers (ROs) are approved by the SFC to supervise regulated activities; a licensed corporation must have at least two ROs, at least one of whom must be an executive director available at all times to supervise the business.

The fit-and-proper test considers financial status, education and experience, criminal record, disciplinary history, and past regulatory compliance; the SFC may refuse or revoke a licence on this basis.

Continuing professional training (CPT) requirements apply to licensed representatives and ROs; the SFC sets the annual CPT hours and the topics that qualify.

Licences are subject to conditions; the SFC may impose restrictions on the scope of business, and a licensed corporation must notify the SFC of changes in directors, substantial shareholders, or ROs.

Exemptions exist for certain persons, such as solicitors acting in the ordinary course of practice and banks conducting activities that fall within the HKMA's supervisory remit.

An applicant must demonstrate competence through qualifications such as recognised degrees, professional designations, or passing the relevant papers of the HKSI licensing examination.

The SFC's Code of Conduct for Persons Licensed by or Registered with the SFC sets out conduct requirements, including honesty, fairness, diligence, and acting in the client's best interests.

Intermediaries must ensure suitability of recommendations: a recommendation must be reasonably suitable for the client given the client's financial situation, investment experience, and investment objectives.

Client order handling rules require fair allocation of orders, prompt execution, and no front-running or misuse of client orders by the firm or its staff.

Conflicts of interest must be managed and disclosed; firms must have policies on personal account dealing by staff and on gifts and entertainment.

Intermediaries must keep proper records of client instructions, orders, and communications, and must maintain adequate internal controls and compliance functions.

Advertising and marketing materials must be accurate, not misleading, and must include required risk warnings; the SFC may require prior approval for certain marketing.

Client money and client assets must be segregated from the firm's own assets and held in designated accounts; the Client Money Rules and Client Securities Rules apply.

Firms must have a complaints handling procedure and must report material breaches and misconduct to the SFC promptly.

Senior management is responsible for establishing and maintaining a proper compliance culture; the SFC may hold senior managers accountable for failures in their areas of responsibility.

Know Your Client (KYC) requires collecting and verifying a client's identity, address, financial situation, investment experience, and investment objectives before providing services.

Client identity must be verified using reliable, independent source documents; for individuals, this typically includes an identity card or passport and proof of address.

The suitability assessment must be documented; if a client refuses to provide information, the intermediary should not make a recommendation and should explain the consequences.

Client agreements must set out the scope of services, fees, risks, and the client's rights; the SFC requires written client agreements for certain services.

Risk disclosure statements must be provided for derivative products and other high-risk products; the client's acknowledgement should be recorded.

Client assets must be held in segregated accounts, reconciled regularly, and protected against misappropriation; the SFC conducts inspections of client asset handling.

The Professional Investor regime allows reduced protections for clients meeting specified asset or portfolio thresholds, but the intermediary must still assess suitability and document the classification.

Vulnerable clients, such as the elderly or those with limited understanding, require additional care; the SFC expects enhanced safeguards for such clients.

Record-keeping requirements mean client onboarding documents, suitability assessments, and risk disclosures must be retained for the period specified by the SFC.

Market misconduct under the SFO includes insider dealing, false trading, price rigging, disclosure of false or misleading information inducing transactions, and stock market manipulation.

Insider dealing occurs when a person in possession of inside information deals in the securities, or counsels or procures another to deal, when the information is not generally available.

The MMT can impose civil sanctions, including disqualification orders, cold shoulder orders, cease-and-desist orders, and fines; it may also refer cases for criminal prosecution.

Criminal offences under the SFO include unlicensed dealing, making false statements to the SFC, and breaches of disclosure requirements; penalties include fines and imprisonment.

The SFC's disciplinary regime for licensed persons includes reprimands, suspension or revocation of licence, and fines; the SFC publishes disciplinary decisions.

The SFC may take action against listed companies and their directors for breaches of the Listing Rules and the SFO's disclosure requirements.

Inside information must be disclosed to the public as soon as reasonably practicable under Part XIVA of the SFO; the SFC enforces the statutory disclosure regime through the Market Misconduct Tribunal.

The SFC may seek disqualification orders against directors for up to five years and may seek compensation orders for investors who suffered loss.

Whistleblower protections and cooperation with other regulators, including the Hong Kong Police and overseas authorities, form part of the enforcement framework.

The Listing Rules are made by the SEHK and approved by the SFC; they govern the admission, continuing obligations, and delisting of issuers on the Main Board and GEM.

The SFC has statutory power to approve Listing Rule amendments and to review listing decisions; the SEHK remains the front-line regulator of listed companies.

An issuer must satisfy financial and other eligibility criteria; the Main Board requires a minimum profit or market capitalisation test, while GEM has lower thresholds.

Continuing obligations include timely disclosure of inside information, publication of financial results, and notification of notifiable transactions and connected transactions.

Inside information is information about the issuer that is not generally available and would, if available, be likely to materially affect the price of the issuer's securities.

Part XIVA of the SFO imposes a statutory duty on listed corporations to disclose inside information as soon as reasonably practicable; directors must take reasonable measures to ensure compliance.

A listed issuer must have a board, independent non-executive directors, and an audit committee; the Corporate Governance Code sets out recommended practices.

Connected transactions require independent shareholder approval and disclosure, depending on the size and nature of the transaction under the Listing Rules.

The Codes on Takeovers and Mergers and Share Buy-backs regulate takeovers; the SFC administers these codes through the Takeovers and Mergers Panel.

The SFO defines a collective investment scheme (CIS) as an arrangement in respect of property where participants do not have day-to-day control and the property is managed as a whole, with profits or income pooled or shared.

Offers of investments to the Hong Kong public generally require SFC authorisation under the SFO unless an exemption applies; unauthorised offers may be criminal offences.

The SFC's authorisation process for CIS involves review of the offering document, the management company, and the custodian; authorisation is not a guarantee of performance.

Exemptions from authorisation include offers to professional investors, offers to no more than 50 persons, and offers with a minimum subscription of HK$500,000 per investor.

The SFC's Code on Unit Trusts and Mutual Funds sets out requirements for authorised funds, including diversification, valuation, and disclosure standards.

The SFC regulates the marketing of investment products and requires that advertisements be accurate and not misleading; certain products require prior approval of marketing materials.

The SFC's Guidelines on Sale of Investment Products apply to the distribution of investment products and require suitability assessment and risk disclosure.

The SFC may withdraw authorisation of a CIS if the scheme no longer complies with the applicable requirements or if the interests of investors are not protected.

The SFC maintains a public register of authorised CIS and licensed intermediaries; investors can check the register to verify authorisation status.

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO) imposes customer due diligence (CDD) and record-keeping requirements on financial institutions, including licensed corporations.

CDD requires identifying and verifying the identity of the customer and the beneficial owner, understanding the purpose and nature of the business relationship, and ongoing monitoring.

Enhanced due diligence (EDD) is required for politically exposed persons (PEPs), high-risk customers, and correspondent relationships; senior management approval is required for PEP relationships.

Simplified due diligence may be applied to low-risk customers, but the financial institution remains responsible for the overall risk assessment.

Suspicious transaction reports (STRs) must be filed with the Joint Financial Intelligence Unit (JFIU); tipping off the customer is a criminal offence.

Record-keeping requirements under AMLO require retention of CDD records and transaction records for at least five years after the end of the business relationship or the transaction.

The SFC's Guideline on Anti-Money Laundering and Counter-Terrorist Financing sets out the SFC's expectations for licensed corporations, including risk-based approaches and staff training.

A risk-based approach requires the institution to assess the money laundering and terrorist financing risks of its customers, products, and delivery channels, and to apply proportionate measures.

Sanctions screening and terrorist financing controls require checking customers and transactions against relevant lists, including those issued under the United Nations Sanctions Ordinance.

The JFIU is a multi-agency body that receives and analyses STRs; it is not an enforcement agency but refers cases to law enforcement.

The Drug Trafficking (Recovery of Proceeds) Ordinance and the Organised and Serious Crimes Ordinance create offences of dealing with proceeds of crime and failure to report knowledge or suspicion.

The United Nations (Anti-Terrorism Measures) Ordinance criminalises the provision of funds or financial services to terrorists and terrorist associates.

Licensed corporations must appoint a Money Laundering Reporting Officer (MLRO) and a compliance officer responsible for AML/CFT compliance.

Staff training must be provided on AML/CFT requirements, including how to recognise suspicious transactions and how to report them internally and to the JFIU.

The SFC may take disciplinary action against licensed corporations for AML/CFT breaches, including fines and suspension of licence.

Cross-border information sharing and cooperation with overseas regulators is important; the SFC has entered into MOUs with overseas authorities for AML/CFT cooperation.

Ongoing monitoring requires scrutiny of transactions to ensure they are consistent with the customer's business and risk profile, and regular updating of CDD information.

A customer's source of wealth and source of funds must be established for higher-risk relationships, and the rationale for the risk assessment must be documented.

Shell banks and anonymous accounts are prohibited; financial institutions must not establish relationships with shell banks.

Wire transfer rules require originator and beneficiary information to accompany transfers; the SFC expects licensed corporations to comply with the relevant FATF standards.

Politically exposed persons include foreign PEPs, domestic PEPs, and international organisation PEPs; the level of EDD depends on the category.

The risk-based approach requires periodic review of customer risk ratings and updating of CDD when there are changes in the customer's circumstances.

Record-keeping must be sufficient to reconstruct individual transactions and to demonstrate compliance with CDD and monitoring requirements.

The SFC's AML/CFT inspection programme assesses licensed corporations' compliance; deficiencies may lead to disciplinary action and remediation requirements.

Terrorist financing risk assessment should consider the institution's customer base, products, and geographic exposure, and should be reviewed regularly.

Suspicion is subjective; a person who knows or suspects that property is criminal property must report it, and failure to do so can be a criminal offence.

The AMLO also covers designated non-financial businesses and professions (DNFBPs), such as lawyers, accountants, and real estate agents, which are supervised by their respective regulators.

The SFC's Guideline on Anti-Money Laundering and Counter-Terrorist Financing is issued under section 399 of the SFO and sets out the SFC's expected standards.

Licensed corporations must have written AML/CFT policies and procedures approved by senior management and communicated to all staff.

Customer due diligence must be completed before establishing a business relationship or carrying out a transaction, except in limited circumstances where delayed verification is permitted.

If CDD cannot be completed, the financial institution must not establish the relationship or carry out the transaction, and should consider filing an STR.

Beneficial ownership identification requires identifying the natural persons who ultimately own or control the customer, and verifying their identity.

The SFC expects licensed corporations to use a risk-based approach and to document the rationale for their risk assessments and decisions.

Internal audit and independent testing of AML/CFT controls are expected to ensure the effectiveness of the compliance programme.

The JFIU's STREAMS system is used for reporting suspicious transactions; reports should be made promptly and include all relevant information.

The SFC may share information with the JFIU and law enforcement agencies, and may take action against licensed corporations that fail to comply with AML/CFT requirements.

The AMLO requires financial institutions to take reasonable measures to identify the beneficial owner of a customer, including for legal persons and arrangements.

For trusts, the beneficial owner includes the settlor, trustee, protector, and beneficiaries; for companies, it includes persons holding more than 25% of shares or voting rights.

Enhanced due diligence for PEPs includes establishing the source of wealth and source of funds, and obtaining senior management approval for the relationship.

Financial institutions must conduct ongoing monitoring of business relationships, including scrutiny of transactions and updating of customer information.

The SFC's AML/CFT requirements apply to all licensed corporations, including those providing asset management, dealing, and advisory services.

Failure to comply with AML/CFT requirements can result in criminal liability, disciplinary action by the SFC, and reputational damage.

The SFC expects licensed corporations to have a designated compliance officer and a Money Laundering Reporting Officer with sufficient seniority and resources.

Cross-border transfers require compliance with the laws of both jurisdictions, and financial institutions should consider the risk of sanctions and terrorist financing.

The SFC's supervisory approach includes off-site reviews, on-site inspections, and thematic reviews of AML/CFT compliance across the industry.

The AMLO's CDD requirements apply to all new customers and to existing customers on a risk-sensitive basis; periodic reviews are required.

Financial institutions must verify the identity of the customer and any beneficial owner using reliable, independent sources, and must retain records of the verification.

The SFC's Guideline on AML/CFT provides guidance on the risk-based approach, including how to assess customer risk and how to apply proportionate measures.

Suspicious transaction reporting is mandatory; failure to report knowledge or suspicion of money laundering can result in criminal liability.

Tipping off is prohibited; financial institutions must not disclose to the customer that an STR has been filed or that an investigation is underway.

The SFC may impose conditions on a licence or take disciplinary action if a licensed corporation fails to maintain adequate AML/CFT controls.

Staff training should be tailored to the roles and responsibilities of staff, and should be updated regularly to reflect changes in the regulatory environment.

The SFC expects licensed corporations to maintain adequate resources for AML/CFT compliance, including systems and personnel.

The JFIU provides feedback to reporting entities on STRs and publishes trends and typologies to assist in identifying suspicious transactions.

The SFC's AML/CFT requirements are set out in the SFO, the AMLO, and the SFC's Guideline on Anti-Money Laundering and Counter-Terrorist Financing.

Licensed corporations must have a customer acceptance policy that sets out the types of customers they will accept and the due diligence measures applied.

Risk assessment should consider the customer's country of residence, the nature of the customer's business, and the products and services provided.

Financial institutions must screen customers and transactions against sanctions lists, including those issued by the United Nations and other relevant authorities.

The SFC may require licensed corporations to take remedial action if deficiencies are identified during inspections or reviews.

Record-keeping requirements under the AMLO are in addition to the SFC's record-keeping requirements under the SFO; the more stringent requirement applies.

The SFC cooperates with the JFIU and law enforcement agencies in the investigation of money laundering and terrorist financing.

Licensed corporations should have a whistleblowing policy that allows staff to report suspicious activity internally without fear of retaliation.

The SFC's approach to AML/CFT supervision is risk-based, focusing on areas of higher risk and on firms with weaker controls.

The AMLO requires financial institutions to appoint a Money Laundering Reporting Officer (MLRO) and to ensure that the MLRO has access to all relevant information.

The MLRO is responsible for receiving internal reports of suspicious transactions and for deciding whether to file an STR with the JFIU.

Financial institutions must have procedures for identifying and reporting suspicious transactions, and for responding to requests for information from the JFIU and law enforcement.

The SFC's Guideline on AML/CFT sets out the SFC's expectations for the role of senior management in AML/CFT compliance.

Senior management is responsible for ensuring that the firm has adequate AML/CFT policies, procedures, and controls, and for fostering a culture of compliance.

The SFC may take action against senior management for failures in AML/CFT compliance, including disqualification and fines.

Financial institutions must keep records of their risk assessments and of the measures taken to mitigate identified risks.

The SFC expects licensed corporations to review their AML/CFT policies and procedures regularly and to update them in response to changes in the regulatory environment.

The JFIU publishes annual reports on STRs and on trends in money laundering and terrorist financing, which can inform the firm's risk assessment.

The SFC's AML/CFT requirements apply to all licensed corporations, regardless of size or business model.

Financial institutions must take a risk-based approach to CDD, applying enhanced measures to higher-risk customers and simplified measures to lower-risk customers.

The SFC expects licensed corporations to have a clear allocation of AML/CFT responsibilities, including at the board and senior management levels.

The SFC may conduct thematic reviews of AML/CFT compliance in specific sectors or areas of business.

Licensed corporations must ensure that their staff are aware of their AML/CFT obligations and of the firm's policies and procedures.

The SFC's Guideline on AML/CFT provides examples of suspicious transactions and of red flags that may indicate money laundering or terrorist financing.

Financial institutions must not rely solely on third parties for CDD; they remain responsible for ensuring that CDD is properly conducted.

The SFC expects licensed corporations to have adequate systems for monitoring transactions and for identifying unusual or suspicious activity.

The SFC may share information with overseas regulators and law enforcement agencies to assist in the investigation of cross-border money laundering and terrorist financing.

The AMLO requires financial institutions to conduct CDD on a risk-sensitive basis, and to update CDD information when there are changes in the customer's circumstances.

The SFC expects licensed corporations to have a customer risk assessment methodology that is documented and consistently applied.

Financial institutions must verify the identity of beneficial owners and must understand the ownership and control structure of legal persons and arrangements.

The SFC's Guideline on AML/CFT provides guidance on the identification of beneficial owners, including the use of ownership and control tests.

Financial institutions must screen customers and transactions against sanctions lists and must report any matches to the relevant authorities.

The SFC expects licensed corporations to have procedures for dealing with customers who are subject to sanctions or who are otherwise prohibited.

The SFC may take disciplinary action against licensed corporations that fail to comply with sanctions requirements.

Financial institutions must keep records of their sanctions screening and of any matches identified.

The SFC cooperates with other regulators and law enforcement agencies in the enforcement of sanctions and AML/CFT requirements.

The SFC's AML/CFT requirements are enforced through inspections, investigations, and disciplinary action.

Licensed corporations must have a compliance function that is independent of the business and that has sufficient resources and authority.

The SFC expects licensed corporations to have a compliance monitoring programme that covers AML/CFT risks.

Financial institutions must report material breaches of AML/CFT requirements to the SFC and to the JFIU.

The SFC may require licensed corporations to appoint an independent consultant to review their AML/CFT controls and to implement remedial measures.

The SFC's Guideline on AML/CFT provides guidance on the reporting of suspicious transactions, including the information that should be included in an STR.

Financial institutions must ensure that their staff are trained on AML/CFT requirements and on the firm's policies and procedures.

The SFC expects licensed corporations to have a culture of compliance that is led by senior management and that is embedded throughout the organisation.

The SFC may take action against licensed corporations that fail to maintain adequate AML/CFT controls, including fines, suspension, and revocation of licence.

The AMLO requires financial institutions to take reasonable measures to identify and verify the identity of the customer and any beneficial owner.

The SFC's Guideline on AML/CFT provides guidance on the CDD measures that should be applied to different types of customers, including individuals, companies, trusts, and partnerships.

Financial institutions must conduct ongoing monitoring of business relationships, including scrutiny of transactions and updating of customer information.

The SFC expects licensed corporations to have a risk-based approach to AML/CFT compliance, with enhanced measures for higher-risk customers and simplified measures for lower-risk customers.

Financial institutions must keep records of their CDD and of their transactions for the period required by the AMLO.

The SFC may take disciplinary action against licensed corporations that fail to comply with AML/CFT requirements, including fines and suspension of licence.

The SFC cooperates with the JFIU and law enforcement agencies in the investigation of money laundering and terrorist financing.

Licensed corporations must have a Money Laundering Reporting Officer (MLRO) who is responsible for receiving internal reports and for filing STRs with the JFIU.

The SFC expects licensed corporations to have adequate resources for AML/CFT compliance, including systems, personnel, and training.