This article focuses on the post-licensing maintenance of Hong Kong SFC Type 1, 4, and 9 licenses, dissects the core of dynamic supervision for "no fixed term" licenses, explains in detail the basic compliance requirements of the Companies Registry and the Inland Revenue Department, as well as the SFC's annual compliance tasks, ongoing operational responsibilities and special compliance points for virtual asset businesses, with practical implementation suggestions, providing a compliance operation guide for licensed institutions.
TABLE OF CONTENTS
As an international financial hub, Hong Kong sees obtaining Type 1, 4, and 9 licenses from the Securities and Futures Commission (SFC) as a key milestone for financial institutions to conduct regulated activities. Yet the real test begins after license issuance. This guide systematically outlines the maintenance and compliance framework for Type 1, 4, and 9 licenses, serving as a practical operational roadmap for licensed corporations.
A common misconception among licensees is that a license with no stated expiration date is perpetually valid, allowing complacency. Is this really the case?
Upon securing SFC Type 1, 4, and 9 licenses, licensed corporations must first recognize a critical principle: a “no fixed term” license does not mean a one-time achievement.
On the contrary, this status requires ongoing compliance and proactive governance to maintain validity.
The core of license maintenance lies in continuously meeting three dynamic regulatory benchmarks, which the SFC uses to assess ongoing eligibility:
-
Suitability Continuity: The licensed corporation and its Responsible Officers (ROs) must maintain sound reputation and requisite professional competence at all times.
-
Adequate Capitalization: The licensed corporation must sustain compliance with net capital and other financial thresholds on an ongoing basis.
-
Full Discharge of Compliance Obligations: The licensee must adhere to all applicable regulations and submit accurate returns/reports in a timely manner.
These three conditions form a dynamic threshold for continued licensure. Failure to meet any one of them may trigger license suspension, revocation, or other regulatory sanctions. In essence, license maintenance is an unceasing compliance marathon guided by these benchmarks.
Before focusing on SFC-specific obligations, licensed corporations must first fulfill foundational corporate compliance obligations—essential for lawful existence and operations in Hong Kong.
-
Annual Return: Pursuant to Section 662 of the Companies Ordinance, a company must file its Annual Return with the Companies Registry within 42 days of its anniversary of incorporation.
-
Notification of Changes: Pursuant to Sections 645, 652, and 658 of the Companies Ordinance, any changes to directors, company secretaries, or registered office addresses must be notified to the Companies Registry within 15 days of occurrence.
Practical Note: Late filing of Annual Returns incurs significant additional registration fees, and prolonged delays may be deemed a sign of poor corporate governance.
-
Profits Tax Returns: Companies must submit Profits Tax Returns by the deadline specified in the notice issued by the Inland Revenue Department (IRD).
-
Employer’s Returns: Applicable to employees employed as of March 31; must be submitted within one month of the return issue date.
-
Audit Requirements: Under the Companies Ordinance, financial statements must be audited by a qualified certified public accountant, with an audit report issued.
Core SFC License Maintenance Requirements
Compliance for licensed corporations centers on two pillars: annual cyclical tasks with fixed deadlines and ongoing obligations embedded in day-to-day operations. Together, these constitute the license maintenance regime.
Annual compliance is analogous to a mandatory “annual health checkup,” with all metrics requiring timely assessment and submission. Failure to complete any item may jeopardize license validity.
Timely payment of annual license fees is a prerequisite for maintaining license validity. Licensed corporations must settle fees within one month of the license anniversary date. The SFC imposes strict fee schedules and late payment penalties for Type 1, 4, and 9 regulated activities (see table for details).
Deadline: Pursuant to Section 138(2) of the Securities and Futures Ordinance (SFO), annual fees must be paid in full within one month of the license anniversary date.
Consequences of Late Payment:
- Less than one month late: 10% surcharge.
- 1–2 months late: 30% surcharge.
- 2–3 months late: 50% surcharge.
- 3–4 months late: Suspension of license.
- Over 4 months late: Revocation of license.
Licensed corporations must file their Annual Return via the SFC’s WINGS system within one month of the license anniversary date. This return is critical for updating license status. Penalties for late submission are severe: suspension if delayed 3–4 months, and revocation if delayed over 4 months.
- All Licensed Representatives must complete a minimum of 10 hours of CPT annually, with 5 hours directly related to their regulated activities.
- Responsible Officers (ROs), due to their supervisory duties, must complete an additional 2 hours of regulatory compliance training annually.
- Training records must be retained for at least 3 years for SFC inspection.
Additional Mandatory Training:
- Within 12 months of initial SFC licensing, individuals must complete 2 hours of mandatory “Ethics” training, covering (but not limited to) integrity, fairness, due diligence, honesty, objectivity, acting in clients’ best interests, treating customers fairly, managing conflicts of interest, and safeguarding client confidentiality.
- Subsequent to the initial year, licensees must complete at least 2 hours of “Ethics or Compliance” training per calendar year. “Compliance” topics include (but are not limited to) the legal and regulatory framework for financial services, codes of conduct and industry guidelines issued by regulators, and internal policies/procedures.
Licensed corporations must submit FRRs to the SFC on a monthly or semi-annual basis, depending on business nature. This requirement demonstrates ongoing compliance with minimum capital thresholds, ensuring sustained financial soundness. Licensed corporations engaging in Type 1, 4, or 9 activities must adhere to their respective financial resource requirements.
Audited annual accounts and supporting documents must be submitted to the SFC within 4 months of the financial year-end. These accounts are a key tool for the SFC to assess financial health and corporate governance.
Important Distinction: While audited accounts are submitted to both the SFC and IRD, their purposes and scrutiny standards differ significantly. IRD audits focus on tax compliance and general business operations, whereas SFC reviews are tied directly to license eligibility, with stricter and more comprehensive criteria for financial robustness, client asset protection, and ongoing compliance capabilities. Ensure audit reports meet these specialized regulatory requirements.
2. Ongoing Operational Obligations
If annual compliance is a “regular health checkup,” ongoing operational obligations are the “healthy habits” that must be integrated into daily workflows.
A valid license must be prominently displayed at the principal place of business. Certified copies must be displayed at all other business locations. This fundamental requirement underscores commitment to market transparency.
At least two Responsible Officers (one of whom must be an Executive Director) must directly supervise operations, with at least one RO available for oversight at all times. For Type 1, 4, and 9 licensees, ROs must possess relevant expertise and experience—particularly for virtual asset (VA) activities.
Material changes (e.g., company name, address, directors, shareholding structure) must be notified to the SFC via the WINGS system within 7 business days of occurrence. Timely reporting is critical to maintaining regulatory trust; late or missed notifications may be deemed a governance deficiency.
Licensed corporations engaging in VA activities are subject to enhanced SFC supervision. In addition to the above requirements, focus on these three often-overlooked but critical compliance priorities:
This includes updating high-risk jurisdiction lists, refining Customer Due Diligence (CDD) processes, and enhancing suspicious transaction identification criteria. Outdated AML frameworks may trigger regulatory scrutiny.
For VA clients, “high-risk” includes those with large transaction volumes, connections to high-risk jurisdictions, or complex transaction structures. CDD must extend beyond onboarding to include annual reviews—re-verifying identity, updating source of funds documentation, reassessing risk ratings, and maintaining comprehensive review records.
VA activities rely heavily on technology. Systems must ensure full transaction traceability, robust cybersecurity safeguards, and effective suspicious transaction monitoring. Conduct quarterly internal compliance self-audits and retain detailed records for SFC inspection.
To translate regulatory requirements into sustainable operational practices, embed compliance into daily workflows:
-
Establish an Internal Compliance Calendar: Develop a customized Internal Compliance Calendar aligned with business cycles and regulatory deadlines, assigning owners, timelines, and deliverables. Integrate this into regular governance to shift from reactive to proactive compliance.
-
Digital Compliance Tools: Adopt compliance management software with automated alerts, and integrate the SFC’s WINGS platform with internal systems for seamless reporting.
-
Document Standardization: Create standardized templates and checklists for all cyclical tasks to ensure consistent, compliant execution.
-
Regular Compliance Health Checks: Conduct periodic reviews of compliance calendar adherence to identify and remediate gaps promptly.
Conducting regulated activities in Hong Kong is analogous to driving on a highway: obtaining a license is like getting a driver’s license, while ongoing compliance ensures the vehicle remains roadworthy, adheres to traffic rules, and reaches its destination safely. “Continuous obligations” mean compliance is an eternal journey. For licensees—especially those in emerging VA sectors—investing in a robust, forward-looking compliance framework is no longer a cost but a core competitive advantage and essential investment for long-term sustainable growth.
For tailored compliance solutions aligned with your specific business model, please contact us for professional legal advice.
