Consultation Conclusions on Proposals to Reduce and Mitigate Hacking Risks Associated with Internet Trading
sfc.hk website
Prompt notification to clients A licensed or registered person should notify clients (eg, via email, short message service (SMS) or other push notifications) promptly after certain client activities have taken place in their internet trading accounts. These activities should at least include: (a) System login; (b) Password reset; (c) Trade execution; (d) Fund transfer to third party accounts unless these have been registered with the licensed or registered person for fund transfer purposes prior to the transfer; and (e) Changes to client and account-related information. The channel of notification to clients should be different from the one used for system login (as outlined in paragraph 1.1). Clients may choose to opt out from “trade execution” notifications only. Under such circumstances, adequate risk disclosures should be provided by the licensed or registered person to the client and an acknowledgement should be executed by the client confirming that the client understands the risks involved in doing so.
