HK SFC Account-Opening Controls: Fix Client Onboarding, CBCR and Mainland-Investor Gaps Now

Bottom line

Licensed corporations should immediately test their onboarding and cross-border correspondent controls; those opening investment accounts for Chinese Mainland individual investors must implement the new-account measures from the circular’s date. SFC Circular, Appendix B

This matters particularly to asset managers and group entities with direct investor accounts, dealing arrangements, remote onboarding, or overseas intermediaries.

Do today

• Should — launch a targeted onboarding look-back. Compliance should identify the population and risk criteria for accounts where questionable or forged documents may have been accepted, focusing on altered third-party broker statements, inconsistent dates/balances, invalid QR codes, duplicate documents, unusual addresses and funding without trading activity. The SFC expects an internal review “as soon as practicable.” Appendix A, pp. 1–2
• Must — fix new-account onboarding for Chinese Mainland individual investors. For accounts opened from 22 May 2026, obtain a written declaration covering lawful offshore funding, prior closure/suspension for forged documents, notification of changes within seven business days, and possible disclosure to authorities. Require settlement exclusively through the investor’s own-name account at a Hong Kong-licensed bank or a bank supervised in an eligible jurisdiction. Appendix B, p. 4
• Should — put senior management visibly in charge. Appoint an accountable senior manager, approve a remediation plan, and retain evidence of challenge, resourcing, training and completion. The circular expressly ties control failures to fitness-and-properness risk. SFC Circular, pp. 2–3
• Should — freeze weak “check-the-box” controls. Do not approve an account where document authenticity, identity verification, or source-of-funds concerns remain unresolved. A process that merely reads a document is a photocopier, not a control. Appendix A, pp. 1 and 4

Check

• Document controls: Can the onboarding team detect identical content across supposedly different broker statements, font/format anomalies, impossible dates, unreconciled asset movements, and invalid or missing QR codes? Is escalation mandatory and independently reviewed?
• Identity and CID: For designated Hong Kong bank-account onboarding, do you retain evidence that the initial and every subsequent transfer came from the client’s own account? For remote overseas onboarding, has an independent qualified assessor confirmed the technology before use? Are controls enforcing the CID “waterfall” and capturing client representations where required? Appendix A, pp. 4–5
• Address anomalies: Do systems flag unrelated clients sharing an address, commercial/government addresses presented as residences, and unverifiable addresses—and require documented follow-up? Appendix A, pp. 5–6
• Overseas intermediaries / CBCR: Where the firm provides dealing, IPO subscription, futures or leveraged-FX services through overseas intermediaries, are risk assessments based on independently verified licensing, reputation, regulatory oversight, underlying-client profile and transaction activity—not just the intermediary’s questionnaire? Higher-risk relationships require deeper diligence and ongoing monitoring. Appendix A, pp. 2–3
• Cross-border services: Are services to clients outside Hong Kong lawful in both Hong Kong and the relevant overseas jurisdiction? Material foreign-law or regulatory breaches must be reported to the SFC immediately. SFC Circular, p. 2

Keep an eye on

• SFC selection notices: Measures 1 and 2 in Appendix B are risk-based and apply when the SFC selects and notifies an LC. A selected firm may need an independent external consultant to review accounts since January 2023 (or another period specified), complete the review within three months of the SFC request, and report slippage promptly. Appendix B, pp. 1–3
• Account closures: If forged documents are identified, expect suspension of new client-initiated transactions, safeguarding and wind-down steps, suspicious-activity review/reporting where appropriate, and closure generally within six months of completing the review. Appendix B, p. 2
• Dormant Chinese Mainland accounts: Selected LCs may have to identify zero-balance accounts inactive for 12 months, refresh KYC/CDD and bank-account information before reactivation, and close accounts that cannot be satisfactorily reactivated. Appendix B, pp. 2–3; Appendix C, pp. 1–2

Scope and timing

The circular applies to SFC-licensed corporations. Appendix B’s Measure 3 targets new investment accounts for individual Chinese Mainland investors using a PRC resident identity card and/or passport; it does not apply to corporate or institutional clients, and existing Southbound Scheme requirements remain unchanged. Written declarations may be collected electronically. Appendix B, pp. 1 and 4, Appendix C, pp. 2–3

This guidance note does not constitute legal advice. Enforcement matters described involve allegations only; no findings of wrongdoing have been made by a court unless expressly stated. AI, under human supervision, has been used for research and drafting assistance. All content has been reviewed by a human prior to publication.

‍