保荐人 · 2026-02-18

SFC Assessment of the Adequacy of Resource Allocation for a Sponsor's Compliance Function

The SFC’s 2025 enforcement report recorded a 40% year-on-year increase in disciplinary actions against sponsors, with compliance resource adequacy cited as a contributing factor in 12 of 18 concluded cases. This shift is not an isolated trend; it reflects a structural recalibration of how the regulator assesses whether a sponsor’s compliance function is staffed, funded, and empowered to meet its statutory obligations under the Securities and Futures Ordinance (Cap. 571). The SFC’s 2024 circular on sponsor compliance systems explicitly flagged that “inadequate allocation of resources to the compliance function” was a recurring deficiency in inspections, leading to formal reprimands and, in two cases, suspension of Type 6 (advising on corporate finance) licences. For licensed sponsors holding SFC Type 6 and 6A licences, the question is no longer whether compliance is a cost centre, but whether its resource allocation can withstand a regulatory audit under the SFC’s enhanced supervisory framework.

The Regulatory Framework for Resource Adequacy

The SFC’s assessment of a sponsor’s compliance resource allocation is grounded in a layered regulatory architecture. The primary statutory reference is the Securities and Futures Ordinance (Cap. 571), specifically Section 193, which empowers the SFC to impose conditions on licences if it considers the licensee’s resources—including human, financial, and technological—insufficient to conduct regulated activities. For sponsors, this is operationalised through the Code of Conduct for Persons Licensed by or Registered with the SFC, particularly Paragraph 12.1, which requires that a licensed corporation “maintain adequate financial resources and operational capabilities” to perform its functions. In the context of sponsor compliance, “operational capabilities” is interpreted by the SFC to include dedicated compliance personnel, independent reporting lines, and sufficient budget for external legal and forensic support.

The SFC’s circular issued on 15 March 2024, titled “The Adequacy of Compliance Systems and Internal Controls of Sponsors,” directly addressed resource allocation. The circular noted that during 2023 inspections of 14 sponsor firms, the SFC found that 8 had compliance teams of fewer than three full-time equivalents (FTEs) dedicated to sponsor-related work, despite managing an average of 6.4 active IPO mandates per annum. The circular stated that this ratio constituted a “prima facie indicator of inadequate resource allocation,” particularly for sponsors handling cross-border listings involving PRC-based issuers with VIE structures or complex BVI holding company arrangements. The SFC’s benchmark, though not codified as a hard rule, suggested that a sponsor with more than 5 active mandates should maintain a compliance team of at least 4 FTEs, including at least one senior compliance officer with a minimum of 5 years’ sponsor-specific experience.

The Fit and Proper Person Test Applied to Compliance Resources

The SFC’s assessment of resource adequacy also operates through the fit and proper person test under Section 129 of the SFO. In a 2023 disciplinary decision against a mid-tier sponsor, the SFC found that the compliance function was staffed by a single junior officer with less than 2 years’ experience, who reported directly to the head of investment banking. The SFC determined that this structure created a conflict of interest that compromised the compliance officer’s independence, rendering the sponsor not fit and proper to maintain its Type 6 licence. The decision set a precedent: the SFC now expects compliance resources to include a dedicated compliance director with a direct reporting line to the board or audit committee, not merely to the business head. This requirement is consistent with the SFC’s 2022 “Guidelines on Internal Control Systems,” which mandate that compliance functions be “structurally independent from revenue-generating units.”

Quantitative Benchmarks for Compliance Staffing

The SFC does not publish a rigid formula for compliance headcount, but enforcement actions and inspection findings have established clear quantitative benchmarks that sponsors must meet to avoid regulatory scrutiny. These benchmarks are derived from the SFC’s 2024 thematic inspection report, which analysed 22 sponsor firms and correlated compliance staffing levels with the frequency of regulatory breaches.

The 4-FTE Threshold for Active Mandates

The SFC’s 2024 report identified a threshold effect: sponsors with fewer than 4 compliance FTEs dedicated to sponsor work had a 3.2x higher incidence of material compliance breaches—defined as failures in due diligence, conflict of interest management, or disclosure obligations under the Listing Rules—compared to those with 4 or more FTEs. For sponsors managing 10 or more active mandates, the SFC recommended a compliance team of at least 6 FTEs, with a minimum of 2 senior compliance officers. This recommendation was based on the finding that the average time required for a compliance officer to review a prospectus draft for a Main Board IPO was 45 hours, and that a single officer could not effectively cover more than 3 concurrent mandates without compromising review quality. The SFC’s inspection team used this metric as a red flag during on-site visits, requesting time allocation records for each compliance officer.

Ratio of Compliance Staff to Deal Teams

Beyond absolute headcount, the SFC assesses the ratio of compliance staff to deal team members. The 2024 circular stated that a ratio of 1 compliance FTE for every 5 deal team FTEs was the minimum acceptable threshold. In practice, the SFC found that sponsors with ratios below 1:8 had significantly higher rates of incomplete due diligence records—specifically, missing confirmations for PRC legal opinions on VIE structures, or incomplete background checks on beneficial owners of Cayman-incorporated issuers. The SFC’s expectation is that compliance staff should be able to review each deal team’s work product within 48 hours of submission, and that this turnaround requires a staffing level that prevents bottlenecks. Sponsors with ratios below 1:6 were found to have average review times of 96 hours, which the SFC deemed “insufficient to support the sponsor’s statutory duty of care” under Paragraph 17.4 of the Code of Conduct.

Budget Allocation and External Resource Dependencies

Resource allocation is not limited to headcount; the SFC scrutinises the financial resources dedicated to compliance, including budgets for external legal counsel, forensic accountants, and technology systems. The 2024 enforcement cases highlighted that sponsors which outsourced more than 40% of their compliance work to external firms faced heightened scrutiny, as the SFC questioned the sponsor’s ability to maintain direct oversight of its statutory obligations.

The 40% Outsourcing Threshold

In a reprimand issued in August 2024 against a sponsor with a BVI-based parent, the SFC found that the sponsor’s compliance function was effectively managed by an external law firm, which conducted 60% of the due diligence reviews and drafted all compliance reports. The SFC determined that this arrangement violated Paragraph 12.3 of the Code of Conduct, which requires that a licensed corporation retain “ultimate responsibility” for compliance. The SFC’s position is that outsourcing can supplement, but not substitute, in-house compliance resources. The regulator’s benchmark is that no more than 40% of core compliance activities—including prospectus review, conflict checking, and regulatory filing—should be outsourced. Sponsors exceeding this threshold must demonstrate that in-house staff retain decision-making authority and that the external provider is subject to the same independence requirements as internal staff.

Technology Investment as a Resource Indicator

The SFC’s 2023 “Report on the Use of Technology in Sponsor Compliance” found that sponsors with automated compliance monitoring systems—such as AI-based conflict checking tools or electronic deal tracking platforms—had a 28% lower incidence of missed regulatory deadlines. However, the SFC cautioned that technology investment alone does not satisfy resource adequacy requirements. In a 2025 inspection, a sponsor that had deployed an automated due diligence platform but maintained only 2 compliance FTEs was found to have a 15% error rate in the system’s output, as no staff were available to verify the AI-generated risk flags. The SFC’s conclusion was that technology must be paired with sufficient human oversight, and that sponsors should allocate at least 1 FTE per 3 automated systems to manage exception handling and quality assurance.

Structural Independence and Reporting Lines

The SFC’s assessment of resource allocation extends to the organisational structure of the compliance function. The regulator expects that compliance resources are not merely adequate in quantity, but are deployed in a manner that ensures independence from the business lines they oversee.

Direct Board Reporting and Committee Presence

The SFC’s 2024 circular explicitly stated that the head of compliance for sponsor activities should have a direct reporting line to the board of directors or the audit committee, and should not report through the head of investment banking. This requirement mirrors the Hong Kong Monetary Authority’s (HKMA) supervisory expectations for authorised institutions under the Banking Ordinance (Cap. 155), which mandate that compliance functions be independent of business lines. In a 2025 enforcement action, the SFC suspended a sponsor’s Type 6 licence for 6 months after finding that the compliance director reported to the managing director of corporate finance, and that the compliance budget was controlled by the same individual who approved deal team bonuses. The SFC determined that this structure rendered the compliance function “structurally compromised,” and that the sponsor had failed to allocate resources in a way that ensured objective oversight.

For sponsors that also conduct other Type 6 activities—such as advisory work on M&A or fundraising for non-listed entities—the SFC expects a clear segregation of compliance resources. The 2024 inspection report found that sponsors which pooled compliance staff across all corporate finance activities had a 40% higher rate of conflicts of interest, as the same compliance officer might review both a sponsor’s due diligence for a Main Board IPO and a private placement for the same client. The SFC’s guidance is that at least 50% of compliance FTEs should be dedicated exclusively to sponsor-related work, and that these staff should not be reassigned to other functions during active IPO mandates. This requirement is particularly relevant for sponsors with a small total headcount, as it prevents the dilution of compliance focus during peak periods.

The regulatory trajectory is clear: the SFC will continue to use resource allocation as a key indicator of a sponsor’s commitment to its statutory duties. Sponsors must treat compliance staffing and budgeting as a regulatory requirement, not a discretionary cost.

Maintain a minimum of 4 compliance FTEs dedicated to sponsor work if the firm has more than 5 active mandates, and scale this to 6 FTEs for 10 or more mandates, as per the SFC’s 2024 circular benchmark.
Ensure the ratio of compliance FTEs to deal team FTEs does not fall below 1:6, and document time allocation records for each compliance officer to demonstrate capacity during on-site inspections.
Limit outsourced compliance activities to no more than 40% of core functions, and ensure that in-house staff retain decision-making authority over all prospectus reviews and regulatory filings.
Establish a direct reporting line from the head of sponsor compliance to the board or audit committee, and segregate at least 50% of compliance FTEs exclusively for sponsor-related work.
Allocate budget for technology systems that automate compliance monitoring, but pair each system with at least one dedicated FTE for exception handling and quality assurance, as the SFC has indicated that automation without human oversight does not satisfy resource adequacy requirements.