Annual Maintenance and Compliance Guide for Hong Kong SFC Licenses

A systematic analysis of the maintenance and compliance management framework for Type 1, 4, and 9 licenses.

Introduction

In Hong Kong, an international financial center, obtaining Type 1, 4, and 9 licenses issued by the Securities and Futures Commission (SFC) represents a significant milestone for many financial institutions in commencing business operations. However, the true test begins only after licensure. This article provides a systematic analysis of the maintenance and compliance management framework for Type 1, 4, and 9 licenses, offering licensed institutions a practical guide for ongoing operations.

 

What Is an “Indefinite-Term” License?

After successfully obtaining a license, many enterprises fall into a cognitive misconception: since the license has no explicit “expiry date,” it is presumed to be permanently valid, allowing them to rest easy. Is this truly the case?

I. “Indefinite Term” Does Not Mean “Permanent License”

Upon successfully obtaining SFC Type 1, 4, and 9 licenses in Hong Kong, licensed institutions must first clarify a key concept:The “indefinite term” of a license by no means implies that one can rest on their laurels.

On the contrary, this characteristic requires licensees to maintain the license’s validity through continuous compliance operations and proactive management.

The core of license maintenance lies in continuously meeting the following three dynamic regulatory benchmarks. The SFC determines whether your license remains valid based on these benchmarks:

• Continuity of the “Fit and Proper” Requirement:The licensed corporation and its Responsible Officers (ROs) must at all times maintain good repute and the necessary professional competence.
• Capital Adequacy:Licensed corporations must at all times ensure that financial indicators, such as net capital, continuously meet the required standards.
• Comprehensive Fulfillment of Compliance Obligations:Licensed institutions must continuously comply with all applicable regulations and fulfill all filing and reporting obligations in a timely and accurate manner.

These three conditions collectively constitute a dynamic “eligibility threshold.” The failure to meet any one of them is equivalent to triggering conditions for license invalidation, which may result in regulatory penalties, suspension, or even revocation of the license. Therefore, maintaining a license is essentially an unceasing compliance marathon centered around these three benchmarks.

 

Basic Corporate Compliance Requirements

Before focusing on the requirements of the Securities and Futures Commission (SFC), licensed institutions must first ensure that their basic corporate compliance work is properly in place, as this is the cornerstone of the company’s legal existence and operations in Hong Kong.

I. Filings with the Companies Registry:

• Annual Return Filing:Pursuant to Section 662 of the Companies Ordinance, a company must submit its annual return to the Companies Registry within 42 days from the anniversary date of its incorporation.
• Change Filing:Pursuant to Sections 645, 652, and 658 of the Companies Ordinance, any changes regarding directors, the company secretary, or the registered office address must be filed withinwithin 15 daysfile with the Companies Registry.
• Practical Note:Late filing of the Annual Return will incur significant additional registration fees, and prolonged delays may be regarded as an indication of poor corporate governance.

II. Filing with the Inland Revenue Department:

• Profits Tax Return:The company must file the return within the specified period after receiving the Profits Tax Return issued by the Inland Revenue Department.
• Employer’s Return:Applicable toemployees still employed as of March 31. The return must be filed within one month from the date of issuance.
• Audit Requirements:Under the Companies Ordinance, a company's financial statements must be audited by qualified certified public accountants, who shall issue an audit report.

 

Core Maintenance Requirements of the Securities and Futures Commission (SFC)

The compliance maintenance work of licensed corporations primarily revolves around two dimensions: first, annual periodic tasks with clear deadlines; and second, ongoing obligations that must be integrated into daily operations. Together, these two aspects constitute the license renewal actions for licensed institutions.

I. Annual Compliance Requirements

The annual compliance work of a licensed corporation is akin to a mandatory "annual health check-up." All indicators must be tested and reported within the prescribed time limits, and any omission may directly affect the status of the license.

(1) Payment of Annual License Fees

Timely payment of the annual license fee is the primary prerequisite for maintaining the validity of the license. A licensed corporation must pay the annual fee within one month after the anniversary date of the issuance of the license.For Type 1, 4, and 9 regulated activitiesthe SFC has established strict regulations regarding specific fee standards and penalties for late payment, as detailed in the table below:

Payment Deadline: Pursuant to Section 138(2) of the Securities and Futures Ordinance, the annual fee must be paid in full within one month after the anniversary date of the issuance of the license.

Consequences of Late Payment: Failure to pay on time will result in serious consequences. The SFC will impose surcharges based on the duration of the delay and has the authority to suspend or revoke the license. The penalty structure is as follows:

• Delay of less than one month: A 10% surcharge will be imposed.
• Overdue by more than one month but less than two months: a 30% surcharge will be imposed.
• Overdue by more than two months but less than three months: a 50% surcharge will be imposed.
• Overdue by more than three months but less than four months: temporary suspension of the license.
• Overdue by more than four months: revocation of the license.

(2) Submission of Annual Return

Licensed corporations must submit the annual return through the WINGS system within one month after the anniversary date of licensing. This form is a critical document for updating licensed status, and late submission will incur strict penalties: failure to submit within more than three months but less than four months will result in license suspension, while delay exceeding four months will lead directly to license revocation.

(3) Completion of Continuing Training

All licensed representatives must complete at least 10 hours of continuing training annually, of which 5 hours must be directly related to the regulated activities in which they are engaged. Given their managerial responsibilities, responsible officers are additionally required to complete 2 hours of regulatory compliance training. It should be emphasized that training records must be retained for at least three years for inspection by the Securities and Futures Commission (SFC) at any time.

Furthermore, particular attention should be paid to the requirement that, within the first 12 months after an individual is initially licensed by the SFC, they must complete 2 hours of specialized training on “Professional Ethics.” Such training shall cover, but not be limited to, the following topics: integrity, fairness, prudence and due diligence, honesty, objectivity, prioritizing clients’ best interests, fair treatment of clients, avoidance of conflicts of interest, and confidentiality of client information.

Thereafter, the licensed person must complete at least 2 hours of training on “Professional Ethics or Compliance” in each calendar year. The topic of “Compliance” includes, but is not limited to, the legal and regulatory framework of the financial industry, codes of conduct and industry guidelines issued by regulatory authorities, as well as policies and guidelines established by the company internally or by other professional bodies.

(4) Submission of Financial Resources Return

Licensed corporations are required to submit financial resources returns to the SFC on a monthly or semi-annual basis, depending on the nature of their business. This requirement aims to continuously demonstrate that the company meets the minimum capital requirements, serving as a concrete manifestation of maintaining “adequate and stable capital.” Licensed corporations engaging in Type 1, 4, and 9 regulated activities should pay particular attention to their respective financial resources requirements:

(5) Minimum requirements for paid-up share capital and liquid capital

(6) Submission of audited accounts

Within four months after the end of each financial year, a licensed corporation must submit its audited annual accounts and related documents to the Securities and Futures Commission (SFC). This report serves as an important basis for the SFC to assess the licensed corporation’s financial condition and governance standards.

It is particularly important to note that, although a licensed corporation is required to submit audited accounts to both the SFC and the Inland Revenue Department,the purposes of these two reports and the dimensions of their review differ significantly.This is because the Inland Revenue Department’s audit primarily focuses on tax compliance and ordinary business operations, whereas the SFC’s review directly affects licensing status. The SFC applies stricter and more comprehensive assessment criteria regarding financial soundness, the safety of client funds, and ongoing compliance capabilities. Licensed corporations must ensure that the submitted audit reports meet these specific regulatory requirements.

II. Ongoing Operational Obligations

If annual compliance is akin to a “periodic health check,” then ongoing operational obligations are the “healthy habits” that a licensed corporation must maintain at all times, integrated into every aspect of its day-to-day operations.

(1) Display of valid licence

A licensed corporation must continuously display its valid licence in a conspicuous place at its principal place of business. If there are multiple places of business, certified copies of the licence must also be displayed at other locations. This fundamental requirement demonstrates a commitment to market transparency.

(2) Ensuring supervision by responsible officers

A licensed corporation must ensure that at least two responsible officers (one of whom must be an executive director) directly supervise the business, and that at least one responsible officer is available on-site at all times to provide supervision. For licensed corporations conducting Type 1, 4, or 9 regulated activities, it is necessary to ensure that responsible officers possess the corresponding professional competence and experience, particularly experience relevant to virtual asset businesses.

(3) Timely reporting of changes to submitted materials

Any material changes, such as to the company name, address, directors, or shareholding structure, must be reported to the Securities and Futures Commission (SFC) via the WINGS system within seven business days of the occurrence. This obligation to report promptly is key to maintaining regulatory trust; any delayed or omitted reporting may be regarded as a deficiency in corporate governance.

III. Key Compliance Considerations Specific to Virtual Asset Businesses

For licensed corporations engaged in virtual asset businesses, the SFC imposes stricter regulatory standards. In addition to the general requirements outlined above, particular attention should be paid to the following three compliance points that are often overlooked but critical:

(1) Annual update of the anti-money laundering (AML) manual

This includes timely updates to the list of high-risk jurisdictions, adjustments to customer due diligence (CDD) procedures, and refinement of criteria for identifying suspicious transactions. Failure to update the AML framework in a timely manner may attract regulatory scrutiny.

(2) Annual review of high-risk customers

For virtual asset customers, "high-risk" categories include those engaging in large-volume transactions, customers from high-risk jurisdictions, and those involved in complex transaction structures. Due diligence for these customers should not be limited to the onboarding stage; an annual review mechanism must be established to re-verify customer identities, update proof of source of funds, assess changes in risk ratings, and maintain complete records of such reviews.

(3) Regular compliance checks of IT systems

Virtual asset businesses rely heavily on technological systems. Therefore, licensed corporations must ensure that their systems can achieve full traceability of all transaction records, effective cybersecurity protection, and monitoring of suspicious transactions. It is advisable to conduct self-assessments of system compliance at least quarterly and retain detailed inspection records for regulatory review.

 

Mankun Recommendations

To ensure that licensed institutions can translate regulatory requirements into sustainable operational actions, we recommend embedding compliance management into the company’s daily operational processes:

(1) Establish an internal compliance calendar

It is recommended that each institution, taking into account its own business rhythm and regulatory cycles, prepare a dedicated Internal Compliance Management Calendar. This calendar should clearly specify the persons responsible for each task, key timelines, and deliverables, and be incorporated into routine management practices to facilitate a shift from reactive responses to proactive planning.

(2) Digital management tools

It is recommended that companies adopt compliance management software with automated reminder functionalities and ensure effective integration between the WINGS platform and their internal systems.

(3) Standardization of documentation

Establish standardized templates and checklists for each periodic task to ensure uniformity and standardization in the execution process.

(4) Regular health checks

It is recommended to periodically review the implementation status of the compliance calendar to promptly identify and rectify any gaps in execution.

 

Conclusion

Engaging in regulated activities in Hong Kong is akin to driving a car at high speed on a highway. Obtaining a license is merely acquiring the “driver’s license,” whereas ongoing compliance maintenance constitutes the entire process of ensuring optimal vehicle performance, adherence to traffic rules, and safe arrival at the destination.“Continuing obligations” dictate that compliance work is an ongoing endeavor.For licensed institutions, particularly those involved in the emerging virtual assets sector, investing in a sound and forward-looking compliance management system is no longer merely a cost, but rather a core competitive advantage and the most critical investment for safeguarding the long-term and stable development of the business.

If you require a tailored compliance solution for a specific business model, please feel free to contact us to obtain professional legal advice.