Introduction

In March 2022, both the Securities and Futures Commission (the “SFC”) and the Stock Exchange of Hong Kong Limited (the “SEHK”) reprimanded and fined HSBC Securities Brokers (Asia) Limited (“HCCB”). HCCB is a wholly owned subsidiary of the Hongkong and Shanghai Banking Corporation Limited and part of the HSBC group entities (the “HSBC Group”). In one set of facts, the SEHK fined HSBC Securities HK$1,000,000 for internal control failures and regulatory breaches of various Broker-to-Client Assigned Number^[1] (“BCAN”) requirements under the Rules of the Exchange of SEHK (“Rules of the Exchange”). The SFC imposed a fine of HK$6,300,000 pursuant to section 194 of the Securities and Futures Ordinance (“SFO”) for BCAN-related breaches and other internal control failures and regulatory breaches.

The relevant trading rules and duties

As with other securities firms, HCCB is regulated under the Securities and Futures Ordinance (Cap. 571) to carry on Type 1 (dealing in securities) and Type 7 (providing automated trading services) regulated activities. It is also registered with the SEHK as an Exchange Participant (“EP”) and a China Connect Exchange Participant (“CCEP”) in order to gain access to the Mainland-Hong Kong Stock Connect (“Stock Connect”). Its clients can not only trade shares listed on the SEHK, but also A-shares eligible for trading under the Northbound (“NB”) link of Stock Connect (i.e. China Connect Securities, or “CCS”) listed on the Shanghai Stock Exchange and Shenzhen Stock Exchange via SEHK.

Over the past few years, securities markets have become increasingly complex with a growing trend for global regulators to develop investor identification mechanisms to facilitate effective market surveillance capabilities. The Mainland securities markets adopt a trading and clearing see-through model to impose the requirements for real-time and all-encompassing surveillance over its investors. Hence, the “NB Investor ID Regime” was launched in 2018 by SEHK and a CCEP like HCCB has responsibilities including, in simple terms, (1) accurately and consistently assigning a BCAN to each of its clients (“BCAN-CID Assignment”); and (2) accurately mapping the BCAN with the client’s Client Identification Data^[2] (“CID”) via the BCAN-CID information mapping exercise (“BCAN-CID Mapping”) by submission to SEHK, which would be forward to the Shanghai and Shenzhen stock exchanges for monitoring the NB trading activities. When submitting orders for trading, CCEPs are required to tag the relevant BCAN to every NB order on a real-time basis, which will then be routed to the Mainland stock markets via Stock Connect by SEHK.

HCCB’s regulatory breaches and internal control failures

The multiple BCAN-related errors

1.        Errors in BCAN-CID Assignment and BCAN-CID Mapping

Between January 2020 and October 2021, HCCB reported to the SFC and the SEHK multiple errors involving incorrect BCAN-CID Assignment and BCAN-CID Mapping for at least 25 clients. Typical instances include where (1) the BCAN was mapped to incorrect client entities; (2) the BCAN assigned to a client was changed without the prior written approval of the SEHK; (3) and two BCANs were assigned to the sub-accounts of the same client (“Mapping Errors”). These incorrect BCAN-CID mapping data in respect of them was submitted to the SEHK through the BCAN-CID Mapping File for different durations over a period of nearly 3 years since the inception of the “NB Investor ID Regime”, between 26 September 2018 and 3 September 2021.

2.        Errors in the tagging of BCAN to its clients’ orders (the “Tagging Errors”)

Between 26 September 2018 and 6 May 2020, 760,320 orders and 1,070,957 trades involving 67 clients were tagged with incorrect BCAN.

It was investigated that the above Mapping Errors and Tagging Errors were the result of internal control deficiencies relating to (1) processes (e.g. processes were highly manual and fragmented between multiple support functions), (2) people (e.g. inadequate awareness around the impact of changes in client static data on compliance with BCAN-related requirements); and (3) system (e.g. system bug not being discovered in time). Due to these errors, a total of 92 clients’ incorrect BCAN and CID information was submitted to the SEHK involving 3,379,065 orders and 4,202,534 trades.

Considering the above Mapping Errors and Tagging Errors, HCCB had breached Rule 1425A of the Rules of the Exchange. Rule 1425A clearly specifies a CCEP’s duty in its client’s trading activities, i.e. accurately assigning and maintaining a client’s unique BCAN, mapping the BCAN with the correct CID and provide the same to SEHK and tagging the BCAN correctly to each CCS’s order. By HCCB’s failure to comply with Rule 1425A of the Rules of the Exchange, it had further breached SFC General Principle (“GP”) 7 and paragraph 12.1^[3] of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the “Code of Conduct”). And by failing to ensure that its internal systems and controls were adequate and effective in fulfilling the requirements in relation to BCAN and BCAN-CID Mapping Files, HCCB had also failed to comply with GP 2^[4] and paragraph 4.3^[5] of the Code of Conduct.^[6]

Takeaway

Modern exchange markets are highly automated, efficient and sophisticated. As securities markets continue to reinvent themselves with more products and offerings, regulations on the said markets are bound to be increasingly complex and far reaching. Whilst the word “automated” may seem to make a task simpler, it indeed poses real risks and challenges to a securities firm in ensuring the consistency, efficiency, veracity and timeliness from client on boarding and receiving orders (through multiple accounts), to trade execution and post-trade. In the example illustrated above, HCCB’s highly manual system for account creation, client’s data maintenance and etc., is one of the root causes for its deficiencies in HCCB’s CCS client on boarding and BCAN-CID Assignment processes. The HSBC Group engaged a multifarious system, which generated a variety of data structure and made the BCAN-CID Assignment exercise more difficult but not more accurate. Further, errors were not detected because there was system migration, followed up a system bug that was belatedly discovered as HCCB was ordinarily unaware that specific areas needed proper monitoring and surveillance. Luckily, no loss was suffered by its clients because of these BCAN-related failures this time.

Traditionally, SEHK usually focuses on listed companies’ breaches of its Listing Rules, and this is one of the rather rare cases where SEHK did not only pick up HCCB’s breaches of the trading rules, but also imposed a penalty against its breaches. On the same set of facts, the SFC also reprimanded and fined HCCB. The SEHK and SFC’s dual actions definitely sounded the alarm for industry participants. It does seem that the two regulators will work together to ensure  compliance by market participants with different aspects of the rules in the securities market.