The Hong Kong Monetary Authority (HKMA) and the Securities and Futures Commission (SFC) jointly announced on August 26 that The Hong Kong and Shanghai Banking Corporation Limited (HSBC) has been publicly reprimanded and fined HK$4.2 million by the SFC for breaching disclosure requirements. Between 2013 and 2021, HSBC failed to disclose and/or correctly disclose its investment banking relationships with multiple Hong Kong-listed issuers and new listing applicants when publishing research reports.

This enforcement action stemmed from HSBC's voluntary disclosure to the HKMA and SFC in March 2023 that certain research reports on Hong Kong securities omitted and/or incorrectly disclosed its investment banking relationships with issuers or new listing applicants, breaching paragraph 16.5(d) of the SFC Code of Conduct for Licensed Persons or Registered Persons (Disclosure Issues).

Subsequent investigations revealed that the disclosure issues stemmed from multiple deficiencies in HSBC's data recording and matching across systems, specifically:

- Using “master groups” to consolidate corporate group data caused transactions involving subsidiaries to be erroneously triggered for disclosure under the parent company, while failing to disclose them in the subsidiary's research reports, resulting in incorrect disclosures/omissions;

- Inconsistent recording of client names across systems led to certain reportable transactions not being identified, causing omissions;

- Inconsistent practices in recording client activities within internal systems, coupled with delayed transaction logging, caused omissions;

- A logical error in one system erroneously included transaction data beyond the 12-month scope, resulting in incorrect disclosures.

The investigation identified approximately 7,705 instances of omitted or incorrect disclosures between 2013 and 2021, affecting around 4,252 research reports covering Hong Kong securities. These reports were published on the “HSBC Global Research” website (renamed “Global Investment Research” in May 2025), the HSBC Private Banking platform, and provided to post-market service providers such as Bloomberg and Refinitiv.

The SFC noted that HSBC failed to act with due skill and care, and did not establish effective systems and controls to ensure compliance with disclosure requirements and the accuracy of disclosures in its research reports.

The SFC determined that HSBC had committed “misconduct.” However, in deciding on disciplinary action, the regulator also considered:

- There was no evidence that clients suffered losses due to the disclosure issues;

- HSBC had conducted reviews to identify the root causes and scope of the breaches;

- HSBC had taken steps to improve its systems and controls to prevent future breaches;

- HSBC cooperated with the HKMA and SFC to address concerns identified during the investigation.

Ultimately, the SFC publicly reprimanded HSBC and imposed a HK$4.2 million fine.

While HSBC was penalized for deficiencies in its systems and internal controls, its proactive reporting and cooperative stance were factored into the penalty decision. Although HSBC's disclosure deficiencies did not result in direct client losses, over 4,200 research reports were affected, underscoring the critical importance of information disclosure management. For financial institutions, compliance is not merely about the amount of fines but also about reputation and market trust. As regulations tighten, financial institutions must continuously invest in system development, data management, and a compliance culture to truly earn investor confidence and achieve long-term market stability.

Author：Qinger