Legal update: SFC clarifies obligations on licensed corporations using cloud-based storage for keeping records with “external electronic data storage providers”

Under section 130 of the Securities and Futures Ordinance (Cap 571) (SFO), a licensed corporation shall not, without the Securities and Futures Commission’s (SFC) prior written approval, use any premises for keeping records or documents relating to the carrying on of the regulated activity for which it is licensed.

The SFC has observed that the use of external electronic data storage, including public and private cloud storage, has become increasingly prevalent.

In a circular issued on 31 October 2019, the SFC states that when licensed corporations use external electronic data storage providers (EDSPs) for keeping all records or documents which they are required to keep under the SFO or the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap 615) (Regulatory Records), they should remain in full compliance with the existing regulatory requirements.

To provide licensed corporations with greater flexibility in keeping and storing Regulatory Records, as well as to clarify their general obligations in relation to electronic data, the circular:

(a) sets out the requirements where licensed corporations’ Regulatory Records are kept with EDSPs instead of at premises approved under section 130 of the SFO;
(b) explains the approval requirements for such record keeping; and
(c) explains the regulatory standards to be observed by licensed corporations when information is kept or processed electronically using EDSPs.

Following the issuance of the circular, SFC expects licensed corporations to review their use of external electronic data storage to ensure compliance with section 130 of the SFO (including making an application for approval described in the circular itself) and the regulatory expectations set out in the circular.

Any licensed corporation which has not already ensured full compliance with the requirements should act very quickly to remedy their position and minimise the risk of disciplinary action.

Russell Bennett 

The above is not intended to be relied on as legal advice and specific legal advice should be sought at all times in relation to the above.

If you would like to discuss any of the matters raised in this article, please contact:

Russell Bennett
Partner | E-mail

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.