COVID-19 Governance: SFC Extends Deadline For Data Storage Compliance (Hong Kong).

Extension to 31 December 2020

 

In the original EDSP Circular, licensed corporations that exclusively kept regulatory records at a Hong Kong EDSP at a data centre approved under section 130 of theSecurities and Futures Ordinance before 31 October 2019 were required to provide the SFC’s Licensing Department with the following no later than 30 June 2020:

 

• a confirmation that requirements for keeping regulatory records exclusively with an EDSP set out in the EDSP Circular are satisfied;
• a copy of a notice from the licensed corporation to the EDSP, substantially in the form of the template in Appendix 2 of the EDSP Circular, authorising and requesting the EDSP to provide the licensed corporation’s records to the SFC, countersigned by the EDSP as evidence of the EDSP’s recognition of the authorisation and request; and
• a confirmation of compliance with the other requirements in the EDSP Circular.

 

Comment

 

Importantly, the SFC has also reminded licensed corporations in the latest circular that they must notify the SFC without delay if they are already keeping records exclusively with EDSPs, either in Hong Kong or overseas.

 

We recommend that firms that have not yet notified the SFC of their pre-existing use of EDSPs consider whether a notification is required. Given the deadline extension, the SFC has more time to become aware of a firm’s use of an EDSP through other means – for example, through data loss incidents or a routine inspection.

 

The SFC has not announced a deadline for licensed corporations to comply with other aspects of the EDSP Circular (including the Section E requirements on non-exclusive use of EDSPs).

 

However, we strongly recommend that firms continue to work diligently towards compliance with these requirements as soon as practicable, particularly given the increased importance of electronic storage of records as remote working practices increase due to the COVID-19 outbreak.