Circular to intermediaries Obtaining client consent under the Hong Kong Investor Identification Regime for the exchange-traded derivatives market (HKIDR-DM)

On September 30, 2026, the Securities and Futures Commission (""SFC"") issued a circular addressed to Relevant Regulated Intermediaries (""RRIs""), prescribing requirements under paragraph 5.6A(p) of the Code of Conduct for RRIs in relation to obtaining express client consent for the collection and transfer of personal data to the SFC and Hong Kong Exchanges and Clearing Limited (""HKEX"") pursuant to the HKIDR-DM, which is scheduled for launch in the second quarter of 2028. Acceptable methods for securing such consent include a written signed acknowledgement on paper, email, other electronic means (including instant messaging applications), or telephone.

Scope and Applicability

The express client consent requirement applies exclusively to individual clients, i.e., natural person clients, and does not extend to corporate clients as no personal data is collected from such entities. For the purposes of this circular, RRIs are SFC-licensed corporations and SFC-registered institutions subject to the HKIDR-DM pursuant to paragraph 5.6A of the Code of Conduct.

Express Consent: Form and Manner

Client consent must be obtained in an explicit form whereby the client clearly indicates agreement to the collection and transfer of personal data to HKEX and the SFC for specified purposes. Implied consent derived from a client's conduct, silence, or omission is expressly impermissible.

Pre-Consent Obligations and Operational Restrictions

Prior to or at the time of obtaining consent, an RRI must explain both the purpose of the proposed data collection and the consequences of withholding consent, and implement procedures accordingly. No order or trade opening new positions may be executed without express client consent under the HKIDR-DM. Where such consent cannot be obtained, the RRI is prohibited from submitting the client's BCAN or CID to HKEX; in those circumstances, only orders for closing existing open positions (i.e., a sell order to close long positions or a buy order to close short positions) may be submitted.

Authentication of Client Identity

The identity of each client from whom consent is obtained must be properly authenticated and validated. In the event any doubt arises as to the client's identity, the RRI shall conduct further enquiries through a communication channel distinct from that previously used for verification purposes.

Permitted Purposes of Data Use

For HKIDR-DM purposes, express consent must expressly cover: (a) disclosure and transfer by the RRI to HKEX and the SFC in accordance with their rules as updated from time to time; (b) permitting HKEX to collect, store, process, and use personal data for market surveillance and monitoring, enforcement of relevant HKEX rules and procedures, disclosure to Hong Kong regulators and law enforcement agencies (including but not limited to the SFC) so as to facilitate performance of statutory functions with respect to Hong Kong's financial markets, and analysis for market oversight purposes; and (c) permitting the SFC to collect, store, process, and use personal data for performance of its statutory functions including monitoring, surveillance, and enforcement with respect to Hong Kong's financial markets, as well as disclosure to relevant regulators and law enforcement agencies in accordance with applicable laws or regulatory requirements. An RRI may adopt the template set out in the Annex thereto or utilise its own version provided all enumerated purposes are encompassed.

Recording of Consent and Withdrawals

An RRI must retain records of all client consents and withdrawals irrespective of the means employed (phone, electronic, etc.). For written consent, relevant documents including dates shall be retained; for verbal, email, or other electronic channels, corresponding phone logs or electronic records with dates are required. Additionally, a written log must be maintained containing at minimum: (a) the name of the client providing the consent or withdrawal; (b) the date thereof; and (c) the means by which it was provided.

Record Retention and Security Requirements

All records and corresponding logs must be retained for as long as the relevant individual remains a client of the RRI, plus not less than two years after ceasing to be a client. Records shall be centrally maintained in a secure manner protecting against unauthorised, accidental or inappropriate access, modification, deletion, or loss, and kept readily accessible for compliance monitoring and audit purposes. Where phone or electronic records are retained, appropriate storage arrangements and sufficient backup capability must exist. The RRI is further obliged to provide the SFC with access to, or copies of, such records upon request.

Reliance on Existing Client Consent

An RRI need not obtain new express consent for HKIDR-DM purposes where both conditions are satisfied: first, that express consent has already been obtained from the client for use of personal data collected by the RRI; and second, that such existing consent expressly encompasses all purposes set out in paragraph 4 above. The consent need not reproduce those purposes verbatim provided they are clearly covered therein; however, this requirement will not be met where purposes can only be implied or inferred from the wording of the consent. Where either condition is unmet, new express consent must be obtained covering all stated purposes, using the template set out in the Annex to this circular.

Definitions and Interpretive Notes

'Personal data' carries the meaning ascribed under section 2 of the Personal Data (Privacy) Ordinance (Cap. 486), namely any data relating directly or indirectly to an individual, from which it is practicable for that individual's identity to be directly or indirectly ascertained, and in a form where access to or processing of such data is practicable.

References to HKEX denote Hong Kong Futures Exchange Limited ("HKFE") or The Stock Exchange of Hong Kong Limited ("SEHK"), as context requires. Where client consent cannot be obtained, orders for closing existing open positions should be tagged with a specific code representing the BCAN in accordance with the Information Paper on HKIDR-DM released by HKEX.

Paragraph 5.6A of the Code of Conduct was set out in Appendix C to the consultation conclusions on proposals to implement an investor identification regime at trading level for the exchange-traded derivatives market, published by the SFC in June 2026. These additions will be gazetted and take effect on a date consistent with the implementation timeline.

This circular does not constitute legal advice regarding compliance with the Personal Data (Privacy) Ordinance or any other applicable data privacy legislation. RRIs subject to the HKIDR-DM are advised to seek professional counsel where necessary.