Nº 0085 October 2026 · 5 min read

Futures clients, consent and the 2028 clock

A quiet September ended with a burst. The SFC’s circular list had not moved since 4 September, then three circulars landed on 30 September. Two of them belong together and are the story: the roadmap for the derivatives investor identification regime, and the rules on getting your clients’ consent for it.

01This Week's One Thing

The derivatives ID regime is 2028, but the consent work is now

Circular 26EC61 sets out the roadmap for the Hong Kong investor identification regime for the exchange-traded derivatives market (HKIDR-DM), following the SFC’s consultation paper of 22 September 2025 and its conclusions of 23 June 2026. The requirements are similar to those in the existing securities-market regime. Intermediaries must assign a Broker-to-Client Assigned Number (BCAN) to each relevant client who places orders for futures, options contracts and stock options on the HKFE trading system, collect up-to-date client identification data (CID) and submit it with the BCAN to a central HKEX repository, include the BCAN on every order sent to the HKFE trading system, and put robust data privacy and security measures in place — including express consent from individual clients.

The launch is currently scheduled for the second quarter of 2028, subject to market readiness and successful system testing and market rehearsals. The circular’s task list is where the real clock sits:

Obtaining appropriate client consent: Q3 2026 to Q4 2027
Updating individual and corporate clients’ CID: Q3 2026 to Q4 2027
Enhancing the order management system, in tandem with HKEX’s Orion Derivatives Platform rollout: Q3 2026 to Q3 2027
Assigning BCANs and preparing BCAN-CID mapping files: Q3 to Q4 2027
End-to-end testing and market rehearsals: Q3 to Q4 2027
Submitting mapping files to the HKEX repository: Q4 2027 to Q1 2028

The companion Circular 26EC60 spells out how consent must be obtained under paragraph 5.6A(p) of the Code of Conduct.

Who's in scope: licensed corporations and registered institutions whose clients trade futures, options or stock options on the HKFE trading system. Consent is needed from individual clients only; the circular says it is not required for corporate clients.
What to do: start with consent. It must be express, never implied from conduct, silence or omission. Explain the purpose and the consequences of not consenting, authenticate the client’s identity (re-verify through a different channel if in doubt), and cover every purpose of use the circular lists. A template is in the circular’s Annex. Consent can be given on paper, by email, by other electronic means such as instant messaging, or by phone.
By when: Q3 2026 to Q4 2027 for consent and CID, with launch scheduled for Q2 2028. After launch, a client who has not consented cannot open new positions. You may input an order or trade only to close out their existing open positions, and you must not submit their BCAN or CID to HKEX.

The small-firm lens

Two years sounds generous until you count what has to happen to each client: a consent request, an identity check on the reply, a log entry, and a CID refresh. The log is not optional. The SFC expects you to keep a written log of every consent and withdrawal showing the client’s name, the date and the means, together with the underlying phone or electronic record, centrally stored and kept for as long as the person is a client and at least two years after. A spreadsheet can carry that, but only if one person owns it. The defensible shortcut is reuse: you need no new consent if the client has already given express consent that covers all the purposes of use the SFC specifies. So take whatever consent wording you already use for securities clients and test it against that list, line by line. The shortcut that is not defensible is assuming it covers the derivatives purposes because it exists. Consent cannot be implied, and a client who gives it by chat message still has to be authenticated.

02The Sweep

ProductsThe third circular of 30 September, 26EC59, sets out a single submission arrangement with the Securities Commission Malaysia for companies seeking a simultaneous primary listing in one market and secondary listing in the other. Everything goes to the primary-listing regulator, in a package split into two clearly identified parts, with a single channel for regulatory comments. Relevant only if you sponsor a dual listing.
TechnologyThe one hard date still running is the phishing-resistant login deadline. Circular 26EC35 gives internet brokers and SFC-licensed VASPs a 12-month implementation period ending 8 July 2027 for robust client login authentication and device binding, with large internet brokers expected to implement immediately. If your consent process for HKIDR-DM runs over email or chat, the same circular’s lesson about SMS and OTP is worth having in mind.
ProductsStill open: 26EC55 (3 September) expects managers of SFC-authorised funds with direct or indirect private market exposure to review each fund and update offering documents and key facts statements as soon as practicable. Exposure of 50% or more of NAV makes a fund a complex product. That is not a date, so the only clock is the one you set.
AMLAlso open: the simplified eDDA deposit controls in 26EC51 (20 August). The SFC asks firms to review these arrangements, assess the risks, including impersonation and unauthorised setup requests, and implement mitigating measures.

03Enforcement Corner

Forged documents, and what the SFC says it will do about them

No new disciplinary action to report, so a reminder from the Record of what supervisory consequences look like in the SFC’s own words. On 22 May 2026 it issued Circular 26EC29 after reviewing the account opening practices of 12 licensed securities brokers. It found significant deficiencies, including some brokers accepting questionable or forged client documents, and said it has zero tolerance for their use in onboarding. For non-compliant brokers it listed the tools it intends to use: internal control and look-back reviews by external consultants, licensing conditions restricting business activities, and enforcement action as appropriate. It also asked firms to run their own internal review as soon as practicable to detect any such documents already accepted.

The link to this week is identity. HKIDR-DM consent only counts if the person giving it has been properly authenticated, and the CID you collect for the central repository is only as good as the documents behind it. The control that would catch a problem early is the same in both places: one documented standard for what counts as verified identity, applied at onboarding and again whenever you collect consent or refresh CID, with a named owner. The circular is blunt about who answers for the gap. Senior management are ultimately responsible for preventing the acceptance of questionable or forged documents, and failure “may call into question” the fitness and properness of the firm and its senior management.

The consent clock is long, but the owner needs naming this month. See you next Monday.

Get next Monday’s briefing in your inbox.

Five minutes, every Monday, 7:30am HKT. Free, unsubscribe anytime.