Inside SFC Investigation: Compliance Advice Letters Explained

When an investigation by the Securities and Futures Commission (SFC) concludes without formal enforcement proceedings, corporate founders, executives, and licensed individuals are often left navigating regulatory jargon. “No further action,” “warning letter,” and “compliance advice letter” are frequently conflated. They are distinct outcomes, occupying different positions on the enforcement spectrum, and carrying materially different commercial, reputational, and legal consequences.

A Compliance Advice Letter is often the most commercially valuable outcome achievable in an SFC inquiry. It signals the closure of an investigation without disciplinary sanctions, fines, or public censure.

Every investigation turns on its own facts, and no outcome is predetermined.

This article details what a Compliance Advice Letter entails, the evidentiary factors that consistently dictate whether an investigation closes or escalates, and the strict statutory secrecy obligations under section 378 of the Securities and Futures Ordinance (Cap. 571) (SFO) that govern the resolution.

Our Track Record and Experience

We have acted in SFC investigations —from matters closed with no further action, to those concluded by compliance advice letter or warning letter, through to contested disciplinary and court proceedings.

We do not comment on individual client matters, and we do not identify clients in our published materials without explicit consent. What our experience confirms is this: the difference between a closed file and a career-defining enforcement action is often established in the first few weeks, determined by the quality of the evidence marshalled, the submissions advanced, and the remediation demonstrated.

Key Takeways

• A Compliance Advice Letter is not enforcement. It identifies concerns and sets out expectations going forward. It does not constitute a finding of wrongdoing and does not trigger disciplinary consequences.

• Outcomes are not binary. Between “no further action” and public enforcement sits a range of intermediate outcomes, of which the compliance advice letter is the most common and, in many cases, the most commercially advantageous.

• The trajectory is set early. The evidence, submissions, and remediation presented before the SFC forms its preliminary view have a material bearing on whether a matter is escalated.

• Remediation frequently bears on the outcome. Where the regulator is satisfied that the conduct has been structurally addressed and the risk of recurrence is low, public enforcement action is often unnecessary to achieve the regulatory objective.

• The letter is strictly confidential. Section 378 of the SFO prohibits the disclosure of information relating to an investigation, and that absolute prohibition extends to the compliance advice letter itself. Breach is a criminal offence.

• The file closes, but the guidance remains. A compliance advice letter typically sets out expectations for the future. Those expectations must be implemented and meticulously documented.

What a Compliance Advice Letter Is — and Is Not

It is

A written communication from the SFC’s Enforcement Division which:

• identifies specific concerns arising from the investigation;

• sets out the SFC’s expectations as to the recipient’s conduct, systems; and

• closes the investigation without further regulatory action.

It is not

• a finding of breach of the SFO or the HKEX Listing Rules;

• a disciplinary sanction;

• a precondition to enforcement proceedings;

• a public censure or a statement of unsuitability; or

• a bar to the recipient continuing in their role or business.

Commercial Dividend

For high-net-worth individuals and listed companies, the distinction matters commercially. A compliance advice letter does not ordinarily require disclosure in a prospectus, does not trigger director unsuitability consequences under the Listing Rules, and does not carry the collateral fallout—banking restrictions, counterparty hesitation, or D&O insurance complications—that accompany formal enforcement action.

SFC Investigation Outcome Spectrum

Regulatory investigations in Hong Kong conclude in a range of ways. The principal outcomes, in ascending order of severity, are:

A compliance advice letter sits at the lower end of this spectrum. It is a conclusion that the regulatory objective—the correction of the conduct and the protection of the market—has been achieved without formal sanction. That is not a technicality; it is the fundamental difference between a discrete closed file and a highly public enforcement action.

Factors That Bear on the Outcome

No two investigations are identical.  However, four main factors may bear on whether a matter is escalated or closed. 

Strength of the underlying evidence 

Where the documentary record does not support a finding of knowledge, participation, or dishonesty, enforcement action is difficult for the regulator to sustain. The role of defense counsel in such cases is to meticulously marshal the record.

Adequacy of the response

Investigations are shaped by the quality of the responses provided to the regulator. A response that is late, incomplete, or overtly defensive invites escalation. A response that is prompt, comprehensive, and heavily supported by contemporaneous documentation allows enforcement staff to close the file with confidence.

Remediation record

Where the concern relates to systems, controls, or corporate disclosure, the SFC is primarily concerned with whether the risk has been neutralized. Evidence of proactive remediation—such as commissioning an independent internal control review, revising transaction approval processes, enhancing disclosure protocols, or enacting personnel changes—frequently bears directly on the outcome.

Absence of aggravating factors

Matters are significantly more likely to escalate where there is evidence of personal benefit, deliberate concealment, repeat conduct, or financial harm to investors. Matters are more likely to close administratively where the conduct is isolated, the individual cooperated fully, and the underlying position has been corrected.

Statutory Secrecy: Section 378 of the SFO

The Obligation

A compliance advice letter is not a public document. It is a private communication between the SFC and the recipient, caught entirely by the strict secrecy obligations in section 378 of the SFO.

Section 378 binds every person who becomes aware of a matter relating to an SFC investigation—including the person under investigation, their legal advisers, and anyone to whom the information is passed. The obligation is threefold: you must not disclose, must not communicate, and must not permit access to any record containing the information. 

Permitted Disclosures

The existence of the investigation, the content of any notice, and the compliance advice letter itself may not be disclosed to any person—including colleagues, family members, employers, insurers, or other professional advisers—unless a recognized statutory exception applies or the SFC has explicitly consented. Disclosure for the strict purpose of obtaining legal advice is permitted; disclosure to anyone outside that privileged circle is not.

Criminal Penalties

Breach is a serious criminal offence. On indictment, the maximum penalty is a fine of HK$1 million and imprisonment for two years. The SFC has previously prosecuted a solicitor for breach, resulting in a conviction.

Frequently Asked Questions

Does a compliance advice letter mean the recipient was found to have breached the rules? 

No. A compliance advice letter does not constitute a finding of breach. It communicates the regulator’s concerns and sets expectations going forward.

Is a compliance advice letter disclosed publicly? 

No. It is a private communication between the SFC and the recipient. It is not published by the SFC and does not appear on the SFC’s enforcement news .

Can the letter be disclosed to anyone? 

Only within the strict limits of section 378. Disclosure for the purpose of obtaining legal advice is permitted. Disclosure to colleagues, family members, employers, insurers, or other third parties is not, unless an exception applies or the SFC has consented. Breach is a criminal offence.

Does it affect the recipient’s ability to serve as a director? 

A compliance advice letter is not a disqualification order and does not, of itself, affect a director’s eligibility or suitability under the Companies Ordinance or the Listing Rules. However, whether it gives rise to a disclosure obligation in any particular context should be assessed on the facts.

Can the SFC re-open the investigation? 

The SFC retains its statutory powers. If new evidence emerges, or if the conduct continues, the matter could be revisited. This is why implementing the expectations set out in the letter as soon as possible — and formally documenting that implementation — matters.  

What should a company do if it receives a compliance advice letter? 

Review the expectations set out, implement any required measures, document the steps taken, retain the record, and restrict access to the letter. Where the letter identifies systems or disclosure issues, an independent review may assist in demonstrating that the concerns have been comprehensively addressed.