COVID-19: Governance: SFC extends deadline for data storage compliance (Hong Kong)

The Hong Kong Securities and Futures Commission (SFC) has extended its deadline for licensed corporations to confirm compliance with its new data storage regulations, due to the COVID-19 outbreak.

On 31 March 2020, the SFC granted a six-month extension to the implementation deadline for aspects of its 31 October 2019 circular on the use of external electronic data storage providers (EDSPs) by licensed corporations for the storage of regulatory records (EDSP Circular).

You can read more about the EDSP Circular in our previous bulletin.

Extension to 31 December 2020

In the original EDSP Circular, licensed corporations that exclusively kept regulatory records at a Hong Kong EDSP at a data centre approved under section 130 of the Securities and Futures Ordinance before 31 October 2019 were required to provide the SFC’s Licensing Department with the following no later than 30 June 2020:

• a confirmation that requirements for keeping regulatory records exclusively with an EDSP set out in the EDSP Circular are satisfied;

• a copy of a notice from the licensed corporation to the EDSP, substantially in the form of the template in Appendix 2 of the EDSP Circular, authorising and requesting the EDSP to provide the licensed corporation’s records to the SFC, countersigned by the EDSP as evidence of the EDSP’s recognition of the authorisation and request; and

• a confirmation of compliance with the other requirements in the EDSP Circular.

Comment

Importantly, the SFC has also reminded licensed corporations in the latest circular that they must notify the SFC without delay if they are already keeping records exclusively with EDSPs, either in Hong Kong or overseas.

We recommend that firms that have not yet notified the SFC of their pre-existing use of EDSPs consider whether a notification is required. Given the deadline extension, the SFC has more time to become aware of a firm’s use of an EDSP through other means – for example, through data loss incidents or a routine inspection.

The SFC has not announced a deadline for licensed corporations to comply with other aspects of the EDSP Circular (including the Section E requirements on non-exclusive use of EDSPs).

However, we strongly recommend that firms continue to work diligently towards compliance with these requirements as soon as practicable, particularly given the increased importance of electronic storage of records as remote working practices increase due to the COVID-19 outbreak.