LE Paper 1 · Topic 6
Topic 6 tests how a licensed corporation runs itself: the SFC's Internal Control Guidelines, who in senior management answers for what, the AML/CFT regime under the AMLO and the SFC Guideline, suspicious transaction reporting, electronic trading and dark pools, client data under the PDPO, compulsory insurance and the CRS. Most questions give you a firm doing something slightly wrong and ask what the rule requires. The marks come from thresholds and periods: more than 25%, 30 and 120 working days, five years, two years, six years, and the three OSCO penalties.
13 min read7 sections
Checked October 2026 against: AMLO (Cap. 615) ss.5, 21 and Sch. 2 (HKLII version 24 Sep 2026); OSCO (Cap. 455) ss.25, 25A; DTROP (Cap. 405) s.25A; UNATMO (Cap. 575) ss.6-8, 12, 14; SFC Guideline on AML/CFT (June 2023); SFC Management, Supervision and Internal Control Guidelines (April 2003); SFC MIC circular (16 Dec 2016); SFC Code of Conduct (January 2026 edition) paras 18-19, Schedules 7-8; Securities and Futures (Insurance) Rules (Cap. 571AI); Securities and Futures (Professional Investor) Rules (Cap. 571D); PDPO (Cap. 486) Part 6A, s.19, Sch. 1; Inland Revenue Ordinance (Cap. 112) Part 8A. Independent prep, not endorsed by HKSI Institute or the SFC.
The SFC's Management, Supervision and Internal Control Guidelines (April 2003) are published under SFO s.399. They do not have the force of law and breach is not itself an offence, but they are admissible in SFO proceedings and the SFC asks whether a failure to substantially follow them reflects adversely on fitness and properness. Management (the board, CEO and senior operating managers) is ultimately responsible for internal controls. The SFC takes a pragmatic approach, for example to a small firm that cannot segregate duties, and looks for compensating supervisory controls.
| Part | Core expectation | Exam detail |
|---|---|---|
| I Management and supervision | Documented structure, clear reporting lines, defined authorities | Management assumes full responsibility for operations and controls |
| II Segregation of duties | Sales, dealing, accounting and settlement segregated where practicable | Research kept apart from sales, dealing and corporate finance |
| III Personnel and training | Employ only fit and proper staff; train initially and ongoing | Staff given up-to-date policies, including personal dealing |
| IV Information management | Integrity, security and availability of records and data | EDP security; record retention that allows reviews and investigations |
Every note. Every question. One pass.
5 more sections of this note are part of Premium.
From ≈HK$49.83/mo on the Until-you-pass pass (12 months)
| V Compliance |
| Compliance function independent of business, reporting to Management |
| Written complaints procedures; complaints investigated by staff not involved |
| VI Audit | Internal audit free of operating duties | Direct line to Management or the audit committee |
| VII Operational controls | Client identity, order handling, asset protection, reconciliations | Staff disclose holdings on joining and at least semi-annually |
| VIII Risk management | Identify, measure and report credit, market, liquidity and operational risk | Aggregate exposures to clients in the same group |
Appendix examples worth knowing: a client's request not to receive statements must be in writing, signed, and reconfirmed at least annually; trade errors go to an error account reviewed by compliance or audit; passwords are disabled when staff leave; the firm keeps a business continuity plan and adequate insurance, including fidelity cover.
Trap: reading 'no force of law' as 'no consequence'. Breach goes to fitness and properness, which is what the SFC licenses on.
Takeaway: Eight parts. Independence for compliance and audit, segregation where practicable, and Management owns the result.
Corporate governance deals with the agency problem: the people running a firm may not act in the interests of its owners or clients. In a licensed corporation the mechanisms are a board with ultimate responsibility, a documented management structure, independent control functions, and personal accountability for senior managers. General Principle 9 of the Code of Conduct puts primary responsibility for standards on senior management.
The SFC's circular of 16 December 2016 (in force 18 April 2017) requires a Manager-In-Charge (MIC) for each of eight core functions:
One person may hold several MIC roles, and two or more people may share one. MICs report to the board or to the MIC of Overall Management Oversight. The board approves the management structure, and the firm notifies the SFC of MIC changes within seven business days with an updated organisational chart. MICs need not be licensed, but every person involved in managing a licensed corporation is a 'regulated person' under Part IX of the SFO, and under s.193(2) misconduct by the firm that is attributable to a manager's neglect is that manager's misconduct too.
Trap: assuming an unlicensed senior manager sits outside SFC discipline, or that every MIC must be an RO.
Takeaway: Eight core functions, two of them RO-level, seven business days to notify changes. Unlicensed managers are still regulated persons.
