Global menu

Our global pages


Self-reporting made easy? New e-form by SFC to submit para. 12.5 Notifications

  • Hong Kong


    On 10 May 2019, the Securities and Futures Commission (SFC) issued a short and simple circular introducing a new online service tailored for firms to submit notifications under paragraph 12.5 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct), or what is commonly referred to as self-reporting. Although termed as a “new service” which firms are only “strongly encouraged” to use (from 10 May 2019), the SFC is effectively rolling out a prescribed form for self-reporting. Firms should review their internal monitoring and reporting systems and make appropriate adjustments.


    Self-reporting is a key aspect to Hong Kong’s regulatory landscape. To the SFC, self-reporting is an important source of information that the SFC relies on in detecting potential non-compliance. To firms, when considering whether an incident has triggered the self-reporting obligation, one of their concerns is whether a report may unnecessarily escalate a minor incident into a full blown investigation by the SFC. The new service is therefore more than just a service enhancement by the SFC - it has substantive regulatory implications on how firms should manage and handle self-reporting going forward. 


    The self-reporting obligation is set out in paragraph 12.5 of the Code of Conduct. In essence, firms are required to self-report to the SFC immediately upon the happening of any material breaches and non-compliance (actual or suspected).

    Following failures to report non-compliance on the part of some firms, the SFC has previously issued a circular dated 11 May 2015 and a circular dated 14 September 2018 to remind firms of their reporting obligation. In those circulars, the SFC emphasised that:

    1. by requiring firms to report “immediately”, the SFC is expecting firms to report as soon as practicable upon identification of a reportable incident, which means not after the firm has already completed its internal investigation, obtained legal advice or taken remedial actions; and

    2. both licensed corporations and registered institutions (RIs) are under the reporting obligation and that registered institutions are required to fulfil this obligation by making the report directly to the SFC in addition to reporting to the Hong Kong Monetary Authority (HKMA).

    The new e-form

    Prior to the introduction of the new service, there was no prescribed form for self-reporting. In practice, firms enjoyed certain degree of flexibility in self-reporting in terms of the format of the report as well as the contents and details to be included. With the new e-form, the SFC effectively expects firms to provide specific and granular details concerning the incident that is being self-reported.

    More significantly, the e-form specifically requests information in relation to not just the date on which the firm was aware of the incident, but also the precise time. Such information may lead the SFC to review whether the firm has made “immediate” self-reporting, and whether it has proper systems and controls on self-reporting.

    Furthermore, the e-form includes a confirmation clause which reiterates that if information provided is false or misleading, the SFC may hold the firm and its management members liable. Apart from ensuring that firms complete the notification with care and reminding them to provide accurate information, the SFC is emphasising the importance of individual accountability. This resonates with the principles under the Manager-in-Charge (MIC) regime.

    As mentioned above, RIs may need to self-report to both the SFC and the HKMA. Although the SFC e-form adopts an approach which is similar to the incident reporting form prescribed by the HKMA, the two forms are not identical and RIs must exercise care in preparing and filing these two forms, particularly when under tight timeframes and with limited information about the incident to be reported.


    By rolling out the new e-form, the SFC is re-emphasising the need for firms to self-report promptly and properly. Firms should review the existing monitoring and reporting system and make appropriate adjustments in order to fulfil the regulatory expectation on self-reporting. Failure to self-report promptly and properly is itself a separate incident of non-compliance which in turn reflects a lack of effectiveness in the firm’s overall system and control. It would not be a surprise if the SFC will in appropriate cases attribute personal liability to one or more MICs with regard to such non-compliance.

    We have seen firms getting into unnecessary trouble because of their misunderstanding of the self-reporting requirement and the then available information. Given the potential significant consequences arising from self-reporting, it is important for firms to seek timely assistance from experienced external counsel to advise on and assist in the self-reporting.