SFC Enforcement Reinforces Approach To Due Diligence on Third-Party Systems, Client Transaction Monitoring, AML Liability

The Hong Kong Securities and Futures Commission (SFC) recently reprimanded Zheng Da International Financial Holding Limited (Zheng Da) and fined it HKD 7 million. It also suspended one of its responsible officers and managers-in-charge, Zhong Hao (Zhong), for seven months. 

The sanctions imposed were for failures related to (i) performing adequate due diligence on customer supplied systems (CSSs) used to place orders through Zheng Da, (ii) conduct proper inquiries on client deposits that were inconsistent with the clients’ self-declared financial profiles, and (iii) effectively monitor client trading to detect and assess suspicious trading patterns.

The sanctions serve as yet another reminder to intermediaries and responsible officers (ROs) of several consistent themes in SFC enforcement actions in recent years, in particular the importance of adequate policies and contemporaneous records demonstrating they have been complied with (the absence of which will result in SFC inferring that no such steps were taken) and the need to conduct thorough due diligence on third-party systems. The enforcement outcome is also notable to the SFC’s conclusion that breaches of anti-money-laundering (AML) obligations have occurred in circumstances involving the potential use of client subaccounts.

Background and the SFC’s findings

Zheng Da holds licenses to deal in and advise on futures contracts. The SFC investigation began following complaints from third parties that Zheng Da was permitting its clients to create subaccounts and allowing those subclients to trade through Zheng Da’s platform. There were three key findings from the SFC’s investigation.

First, over a period of 20 months from 2021 through 2023, Zheng Da had permitted 160 clients to use their CSSs to place over 10 million futures trades through Zheng Da’s third-party broker supplied system (BSS). Zheng Da claimed that before allowing customers to connect their CSSs to its BSS it would interview clients as to the functionality of their systems and submit application documents to Zheng Da’s own BSS provider for approval, and this would be done via inquiries made of clients by Zhong or other employees. However, the SFC determined that Zheng Da did not perform due diligence on its clients’ CSSs for the following reasons:

• It had no guidelines or procedures for conducting due diligence on CSSs.
• It maintained no records of the inquiries claimed to have been made of clients.
• While Zheng Da asserted that it was the responsibility of its BSS provider to carry out due diligence on client CSSs, Zheng Da’s service agreement with the BSS provider contained no such obligation. The BSS provider also stated that it did not perform any such due diligence.

The second finding was that Zheng Da failed to conduct proper inquiries on client transactions. The SFC found that for eight selected clients, the amounts and frequency of their deposits through their Zheng Da accounts were inconsistent with their self-declared financial profiles. The anomalies highlighted by the SFC for two such clients are extreme. One client with an annual income declared to be above HKD1 million and net assets of between HKD5 and 10 million deposited approximately HKD28 million into his Zheng Da account through 439 transactions from 22 different bank accounts over a six-month period. The second client, with a declared annual income of below HKD200,000 and total assets of HKD5 to 10 million, deposited over HKD37 million into his account over a 10-month period. This occurred notwithstanding that Zheng Da’s own policies and procedures required its staff to identify complex, large, or unusual transactions and to ensure that client deposits were consistent with their self-declared financial circumstances. 

While Zheng Da claimed the RO, Zhong, would each month make unscheduled calls to randomly selected clients to understand their financial situation and up to five clients with the highest transactions volumes, no records could be provided to support these assertions. The SFC further found that Zheng Da’s own transaction monitoring reports failed to identify any risks concerning any of the eight selected clients. 

The SFC’s third finding was that during the 20-month period covered by the investigation there were 176 instances in which clients placed both buy and sell orders in the same futures contracts within the same second. Zheng Da failed to detect these same-second buy/sell orders, and therefore the SFC considered Zheng Da’s transaction monitoring system to be deficient. As Zheng Da was unaware of the same-second buy/sell orders at the time they occurred, Zhong could not produce any records of inquiries he claimed to have made in respect of any of them. Further, while Zheng Da had a “self-matching prevention” function for trading on one U.S. futures exchange, it did not for other exchanges on which its clients could trade. Furthermore, while its BSS had a function to detect same-second buy/sell orders, Zheng Da had disabled this function as “it interfered with normal client trading.” 

Against this background, the SFC found that Zheng Da breached the SFC’s Code of Conduct in several key respects, including failures to (i) act with due skill, care, and diligence in conducting its business (GP2), (ii) have and effectively use resources and procedures for the proper performance of its business (GP3 and paragraph 4.3), and (iii) take adequate steps to verify the true and full identity of its clients and their financial situation, investment experience, and investment objectives (paragraph 5.1).

The SFC also concluded that a number of provisions of the Anti-Money Laundering and Counter Terrorist Financing Ordinance (AMLO) and associated guidelines had been breached. These included failures to (i) identify and assess the money-laundering risks associated with the development of new products and business practices, (ii) implement adequate AMLO policies, procedures, and controls, (iii) review client information on an ongoing basis, (iv) continuously monitor business relationships with clients, and (v) identify unusual transactions with no apparent lawful purpose and make suspicious transaction reports to the Joint Financial Intelligence Unit regarding those transactions.

The SFC identified aggravating factors in respect of Zheng Da’s breaches, being that the SFC had published multiple enforcement actions during the relevant period for similar breaches and, notwithstanding this, Zheng Da took no steps to enhance its controls or more effectively monitor client trading.

With respect to Zhong, the SFC held that Zheng Da’s failures were attributable to his personal failures as an RO and manager in charge to ensure maintenance of appropriate standards or properly manage the regulatory risks of the businesses for which he was responsible.

Key takeaways

The facts involved in this enforcement action are arguably extreme, and most sophisticated financial intermediaries will likely consider some of the practices involved to be well below the standards of their own businesses. However, there are nonetheless several themes contained in the Statement of Disciplinary Action that are consistent with other SFC enforcement actions in recent years.

Adequacy of policies and procedures, and the ability to demonstrate that they have been implemented and adhered to, is paramount. Intermediaries are required to have policies and procedures commensurate with the risks of their regulated businesses. However, simply drafting those policies and procedures will never be enough. An intermediary must also be able to demonstrate to the SFC that policies and procedures have been implemented and that adherence to them is monitored on a regular basis.

The absence of evidence is treated as evidence of absence. Assertions to the SFC during an investigation that steps were taken during the course of operating a regulated business must be supported by contemporaneous documentary records. In this case, it appears that the intermediary and RO made a variety of assertions of steps that had been taken to comply with regulatory obligations. However, where there are no policies or procedures mandating employees to take those steps, or there are but no records of those steps having actually been taken, it is not surprising that the SFC will infer that this is evidence of no such steps being taken. The SFC’s thirst for documentary detail, even in much less extreme cases, cannot be underestimated.

Due diligence on third-party systems must be thorough. While the focus of this enforcement action was on due diligence of CSSs, the same is true of third-party-supplied BSS and other software or systems. Cursory questions and over-reliance on client or vendor assertions as to what their systems do (or do not do) are inadequate. Intermediaries must carry out thorough due diligence and keep detailed records of the steps they have taken. In the age of AI and other rapid advancements in fintech, this will remain an area of focus for the SFC.

Monitor SFC enforcement outcomes and consider how they might apply to your business. Sophisticated intermediaries will monitor SFC enforcement outcomes and consider whether their own business operations are consistent with the SFC’s expectations stated within them. In this case, the SFC considered it to be an aggravating factor that this had not been done. Enforcement outcomes should be considered as statements of the SFC’s expectations of minimum conduct requirements, and where any potential shortcomings are identified in their own operations, intermediaries should consider what changes are required and whether any identified issues should be raised with or self-reported to the SFC.