HKSI Paper 4: 60 Key Concepts and Study Guide
HKSI Paper 4, Regulation of Credit Rating Services, is the licensing examination paper for persons who want to conduct the Type 10 regulated activity of providing credit rating services in Hong Kong. The exam consists of 40 multiple-choice questions taken in 60 minutes, and the pass mark is 70%. It covers the regulatory framework around the SFC and the SFO, day-to-day operational compliance, the conduct rules for credit rating agencies, and market misconduct.
This guide walks you through 60 key revision concepts in the official topic order of the Paper 4 public syllabus, from the general regulatory framework through to improper trading practices. Each concept pairs an explanation with a hypothetical example, a common trap, and a self-check question so you learn to apply the rules, not just recite them. Note that examinable content follows the current published study guide version, so confirm the version valid for your sitting before you study.
Exam format: HKSI examination overview . Latest published pass rate: 100.00% (Jun 2026) . A pass rate is a past result for a group of candidates, not your required score.
How to use these 60 concepts
- Work through the four topics in order, because Paper 4 builds from the general regulatory framework to the specialist CRA Code of Conduct, and later misconduct topics assume you understand the earlier framework.
- After reading each concept, cover the answer and attempt the self-check question yourself; if you get it wrong, reread the explanation and rewrite the trap in your own words before moving on.
- In your final revision week, use only the questions and traps as prompts to reconstruct each concept aloud; anything you cannot reconstruct goes back on a short list for focused review.
The practice examples are original and hypothetical unless explicitly identified as a published case. The concept count is a revision structure; it does not represent official question frequency or topic weighting.
No matching concepts. Try a shorter search term.
Topic 1: General Regulatory Framework
The background and international context of credit rating, the SFO licensing regime for Type 10 activity, the SFC and other regulators, the Code of Conduct, internal control guidelines, personal data, AML/CFT, fining principles and corporate governance.
1. Background to the Credit Rating Industry
Credit rating agencies grew alongside debt markets, giving investors independent opinions on the creditworthiness of issuers and debt securities. Because ratings feed directly into pricing, allocation and regulatory capital decisions, weak rating quality can damage markets, which is why regulators worldwide now supervise CRAs closely.
Example. a Hong Kong fund manager buys a corporate bond partly because a CRA assigned it a top-tier rating, showing how a rating shapes real investment decisions.
Watch out. A rating is an opinion on credit risk, not a guarantee of repayment and not investment advice.
Self-check: A colleague says an agency's top rating guarantees the issuer will repay. Is he right?
Answer: No. A rating is an independent creditworthiness opinion, never a guarantee or a recommendation.
2. Why Ratings Attract Regulation
Ratings are used by investors, issuers and the market infrastructure, so a flawed rating process harms parties who never commissioned the rating. This third-party reliance is the core justification for regulating CRAs as intermediaries rather than treating them as ordinary commercial publishers.
Example. if an agency relaxes its criteria under pressure from a paying issuer, bondholders who relied on the published rating suffer losses.
Watch out. Do not think regulation covers only the rated entity; the protected group is the investing public relying on ratings.
Self-check: Who benefits from CRA regulation besides the entity being rated?
Answer: The investing public and market users who rely on published ratings in their decisions.
3. International Context: The IOSCO Code
Globally, CRA conduct is anchored in the IOSCO Code of Conduct Fundamentals for Credit Rating Agencies, built on fundamentals covering the quality and integrity of the rating process, CRA independence and conflicts of interest, responsibilities to the investing public and rated entities, and disclosure to the public. It sets the benchmark national regulators translate into local rules.
Example. when a new agency opens in Hong Kong, its compliance manual is checked against these IOSCO fundamentals as the international reference point.
Watch out. The IOSCO Code is an international benchmark, not Hong Kong legislation enforceable in local courts by itself.
Self-check: Name the broad fundamentals that the international CRA code addresses.
Answer: Rating process quality and integrity, independence and conflicts, duties to the public and rated entities, and public disclosure.
4. Relationship Between the CRA Code and the IOSCO Code
Hong Kong's Code of Conduct for Persons Providing Credit Rating Services applies the IOSCO fundamentals to the local setting, sitting within the SFC's Code of Conduct for licensed persons. So the IOSCO Code supplies the framework, while the CRA Code is the operational rulebook a Hong Kong CRA must actually follow.
Example. an agency's compliance officer maps each internal policy to a CRA Code paragraph, and can trace that paragraph back to an IOSCO fundamental.
Watch out. The two codes are not interchangeable; only the local CRA Code is the SFC conduct standard for Hong Kong CRAs.
Self-check: Which document is the binding local conduct reference for a Hong Kong CRA?
Answer: The SFC's CRA Code, which implements the IOSCO fundamentals locally within the Code of Conduct.
5. Relevance of International Regulation to Hong Kong
Because CRAs rate cross-border issuers and securities, Hong Kong aligns its regime with international standards so local ratings remain credible and comparable worldwide. International developments therefore influence how the SFC frames CRA supervision and how Hong Kong agencies operate across jurisdictions.
Example. a Hong Kong agency rating a regional bond programme applies its Hong Kong standards even though the issuer sits overseas.
Watch out. International alignment does not mean foreign laws automatically apply in Hong Kong; the local regime governs local conduct.
Self-check: Why does Hong Kong model its CRA rules on international standards?
Answer: To keep local ratings credible and comparable in cross-border markets and to support consistent global supervision.
6. Framework of Laws and Regulations
The SFO is the principal statute governing credit rating services as a regulated activity, supported by subsidiary rules made under it. Layered on top are codes and guidelines, such as the Code of Conduct and the CRA Code, which are not ordinances but are used by the SFC as benchmarks for whether a firm remains fit and proper.
Example. a licensing breach breaches the SFO directly, while sloppy rating procedures may breach a code and trigger SFC disciplinary action instead.
Watch out. Codes and guidelines are not statutes, so breaching them is not automatically a criminal offence; the usual consequence is SFC disciplinary or licensing action.
Self-check: What distinguishes an SFO breach from a Code of Conduct breach?
Answer: The SFO is statute with legal consequences; codes are SFC benchmarks used mainly for disciplinary and licensing purposes.
7. Type 10 Regulated Activity and Licensing
Providing credit rating services is a Type 10 regulated activity under the SFO. A firm must be licensed by the SFC as a licensed corporation to carry on the business of that activity in Hong Kong, and individuals acting for it must be licensed representatives, unless an exclusion applies.
Example. RatingCo Ltd wants to publish corporate bond ratings commercially, so it applies to the SFC for a Type 10 licence before starting.
Watch out. Licensing attaches to both the corporation and its individual representatives; a licensed firm does not license its staff by itself.
Self-check: What must a firm and its rating analysts do before commercially issuing ratings in Hong Kong?
Answer: Obtain a Type 10 licensed corporation licence and ensure individuals acting in the activity are licensed representatives.
8. What Constitutes Credit Rating Services Under the SFO
Credit rating services under the SFO centre on preparing credit ratings for publication or distribution to persons other than the entity being rated, and extend to preparatory and auxiliary services connected with producing those ratings. The outward-facing nature of the rating is what makes the activity regulated.
Example. an agency builds an internal rating model and then publishes the resulting ratings to subscribers; both the preparation and the publication service fall within the regulated activity.
Watch out. Focus on the audience: ratings reaching parties other than the rated entity point towards regulation, private ratings may not.
Self-check: A firm prepares a rating used only by the issuer itself. Is that credit rating services under the SFO?
Answer: No, because the rating is not prepared for publication to persons other than the rated entity.
9. Services Not Covered by the SFO
The SFO excludes certain rating work from the regulated activity, notably ratings prepared solely for the internal use of the person preparing them and ratings prepared solely for the use of the entity being rated. Learning the boundary lets you decide whether a new product line needs a Type 10 licence.
Example. a bank scores its own corporate loan clients for internal credit approval only; that scoring is not the regulated activity of providing credit rating services.
Watch out. The exclusion depends on who uses the rating; once outputs reach outside parties, the exclusion argument weakens.
Self-check: An agency's model is sold to one issuer to rate only that issuer. Regulated or not?
Answer: Not regulated, as the rating is solely for the use of the rated entity itself.
10. Codes and Guidelines Relevant to CRAs
A licensed CRA is subject to the SFC Code of Conduct generally, including the CRA Code chapter specific to rating services, together with the Management, Supervision and Internal Control Guidelines and related SFC guidelines. Knowing which instrument governs which issue helps you identify the source of any obligation in a scenario.
Example. a question about record storage points to operational guidelines, while a question about rating transparency points to the CRA Code.
Watch out. The CRA Code does not replace the general Code of Conduct; a CRA must satisfy both layers.
Self-check: Which instruments apply to a licensed CRA alongside the SFO?
Answer: The general Code of Conduct including the CRA Code, the Management, Supervision and Internal Control Guidelines, and related SFC guidelines.
11. Role and Functions of the SFC
The SFC is the statutory regulator for Hong Kong's securities and futures markets, with objectives including maintaining market integrity and protecting investors. Its functions span licensing and supervision of intermediaries, setting conduct standards, and investigating and disciplining breaches.
Example. the same regulator that grants a CRA its licence can later investigate it and take disciplinary action if conduct falls short.
Watch out. The SFC both licenses and enforces; do not assume supervision and enforcement sit with different regulators.
Self-check: List the SFC's core functions relevant to a Type 10 firm.
Answer: Licensing, ongoing supervision, setting conduct standards, and investigation and enforcement of breaches.
12. SFC Divisions and Departments
Different SFC divisions handle different work, with the Intermediaries side overseeing licensed firms such as CRAs, and the Enforcement side conducting investigations and disciplinary actions. Other divisions support market regulation, corporate finance and corporate services, so a CRA's day-to-day contact point differs from the unit that polices misconduct.
Example. a CRA submits a licence variation to the intermediaries supervision team, while a suspected false trading case is handled by enforcement staff.
Watch out. Be ready to match each function to the appropriate division rather than merely naming divisions; supervision of licensed firms and enforcement of misconduct sit with different units.
Self-check: Which SFC function supervises a licensed CRA's ongoing conduct, and which investigates misconduct?
Answer: Intermediaries supervision oversees licensed CRAs; the Enforcement function investigates suspected misconduct.
13. Co-operation Between Regulators
Regulatory mandates overlap in practice, so the SFC co-operates with other Hong Kong authorities and with overseas regulators through arrangements such as memoranda of understanding and international networks. This allows information sharing and coordinated action where a matter crosses regulatory or national boundaries.
Example. a rating matter touching banking products may involve both the SFC and the banking regulator, who coordinate rather than duplicate inquiries.
Watch out. Overlap does not create a gap; co-operation mechanisms ensure one regulator can assist another with relevant information.
Self-check: How do regulators handle a matter falling under more than one mandate?
Answer: They co-operate through MoUs and information-sharing arrangements, coordinating their regulatory actions.
14. Fit and Proper Requirements
The SFC licenses only firms and individuals who are fit and proper, considering matters such as honesty, financial soundness, qualifications, competence, and reputation and character. Fitness and propriety is a continuing requirement, so a licensee must remain fit and proper throughout the life of the licence, not just at application.
Example. an analyst with an undisclosed fraud conviction raises fit and proper concerns for both himself and his firm.
Watch out. Fit and proper is not a one-off entry test; post-licensing conduct can strip a licence.
Self-check: An analyst is convicted of dishonesty two years after licensing. What is at stake?
Answer: His continuing fitness and propriety, which can cost him his representative licence and affect the firm.
15. Management, Supervision and Internal Control Guidelines
The Management, Supervision and Internal Control Guidelines set out the SFC's expectations on how licensed firms, including CRAs, should organise management responsibility, supervision and internal controls. They stress that senior management bears primary responsibility for the firm's compliance and control environment.
Example. an agency designs a compliance manual structured around management oversight, supervision of staff, and internal control systems, mirroring these guidelines.
Watch out. The guidelines allocate responsibility upwards: control failures are traced to senior management, not only to staff.
Self-check: Under these guidelines, who carries primary responsibility for a CRA's compliance systems?
Answer: Senior management, who must establish and maintain the supervision and internal control framework.
16. General Principles of the Code of Conduct
The Code of Conduct opens with general principles stating that licensees must act honestly and fairly, act with due skill, care and diligence, consider clients' interests, avoid or manage conflicts of interest, ensure adequate resources and competence, comply with regulations, and take management responsibility. These principles frame all the detailed conduct requirements that follow.
Example. an agency's marketing promise to 'never disappoint a rated client' conflicts with the honesty and independence principles and must be changed.
Watch out. The principles apply to every licensee; do not study only the CRA-specific chapter and skip the general principles.
Self-check: Which general principles matter most when an agency faces pressure from a paying issuer?
Answer: Honesty and fairness, independence, and effective management of conflicts of interest.
17. Applying the General Principles to Practical Matters
Use the general principles to test whether a proposed action is honest, competent and compliant, whether client interests are treated fairly, and whether conflicts have been identified and properly addressed. Detailed rules do not replace these broader responsibilities. A situation can raise a conduct problem even when there is no rule describing that exact scenario.
Example. an analyst is offered a lucrative job by a rated issuer mid-rating; the conflict and diligence principles require disclosure and handling before acceptance.
Watch out. No specific rule is needed to identify a breach; conduct inconsistent with the principles can itself be sanctionable.
Self-check: A situation is not covered by any detailed rule. Can conduct still be improper?
Answer: Yes. The general principles still apply, including honesty, competence, fair treatment of clients and appropriate handling of conflicts.
18. Key Areas of Internal Control Under the ICG
The Internal Control Guidelines identify key control areas including management supervision, segregation of duties, the compliance function, internal audit, risk management, information management and operational controls. The aim is a control environment where key functions check one another and problems surface quickly to management.
Example. an agency separates its rating committees from its sales team and gives compliance direct reporting access to senior management, implementing segregation and compliance controls.
Watch out. Internal control is a system, not a single policy; one isolated procedure does not satisfy the guidelines.
Self-check: Why should a CRA's rating and sales functions be segregated?
Answer: Segregation of duties stops commercial pressure from influencing rating outcomes, a core internal control.
19. Senior Management Supervision Under the ICG
Senior management must take overall responsibility for the business, set a compliance culture from the top, and ensure proper procedures, monitoring and escalation are in place. Accountability cannot be delegated away: outsourced or delegated tasks still leave management answerable for supervising them effectively.
Example. a CRA's CEO delegates rating operations to a department head but must still monitor that department's compliance reports and act on red flags.
Watch out. Delegation transfers tasks, not accountability; supervisors are answerable for failures they failed to detect.
Self-check: A department head hides control failures from the CEO. Is the CEO protected by the delegation?
Answer: No, senior management retains overall supervisory responsibility and must maintain systems that surface such failures.
20. Personal Data Principles Under the PDPO
The Personal Data (Privacy) Ordinance governs how CRAs collect and handle personal data through data protection principles covering purposeful and lawful collection, accuracy, limited retention, use consistent with the original purpose, restricted disclosure, and security with access rights. Personal data may only be used for the purposes for which it was collected unless relevant exemptions or consent apply.
Example. an agency collects directors' personal details for a rating, then wants to sell the list to a marketer; that new use is restricted by the use limitation principle.
Watch out. Collecting data is easy to justify; reusing it for a different purpose is where firms typically breach the PDPO.
Self-check: Data collected for a rating is later sold for marketing. Which principle is engaged?
Answer: The use limitation principle: data must not be used for new purposes without the required consent or exemption.
21. PDPO in the CRA Operating Context
CRAs hold personal data on directors, officers and borrowers of rated entities, so they need collection statements, secure storage, defined retention limits, and controls on cross-border transfer and direct marketing. Data subjects also have rights to access and correct their personal data, which the agency must operationalise.
Example. a former director of a rated company writes in asking what personal data the agency holds about him; the agency must respond under the access rights regime.
Watch out. Access rights apply to individuals whose data the agency holds, not just to direct clients of the agency.
Self-check: An unrelated individual requests access to his personal data held during a rating. Must the CRA comply?
Answer: Yes, data access and correction rights apply to any data subject whose personal data the CRA holds.
22. AML/CFT Legislation in Hong Kong
The anti-money laundering and counter-terrorist financing framework rests on the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which imposes customer due diligence and record-keeping requirements, alongside the organised crime and drug trafficking ordinances that create money laundering offences, and legislation giving effect to counter-terrorist financing measures. A CRA must embed these requirements in its onboarding and monitoring procedures.
Example. a new institutional client of an agency's non-rating service is onboarded with identity verification and checks on who ultimately owns and controls it.
Watch out. AML obligations cover the financing of terrorism as well as laundering of criminal proceeds; they are distinct risks.
Self-check: Name the type of ordinance imposing CDD and record-keeping duties, and the broader offence it supports.
Answer: The AMLO imposes CDD and record-keeping duties, supporting money laundering and terrorist financing offences under the wider framework.
23. Customer Identification and CDD Steps
Effective CDD means identifying and verifying the client's identity, identifying the beneficial owners and control structure, understanding the purpose of the relationship, and applying ongoing monitoring and scrutiny of transactions. Verification uses reliable, independent sources, and enhanced measures apply where risk is higher.
Example. an agency onboarding a corporate client traces ownership through two holding companies to identify the natural persons who ultimately own or control it.
Watch out. CDD is not a one-time box-tick; the identification must be kept current through ongoing monitoring.
Self-check: Why identify beneficial owners rather than only the contracting client?
Answer: Because criminals hide behind corporate structures, so the persons ultimately owning or controlling the client must be identified.
24. Suspicious Transaction Reporting and Tipping Off
When a firm knows or suspects that property represents proceeds of crime or is linked to terrorist financing, it must make a suspicious transaction report to the authorities. It is also an offence to tip off a person that a report has been or may be made, since disclosure could defeat the investigation.
Example. a compliance officer files a report on an unusual payment, then must refuse the client's request to explain the filing, because that would be tipping off.
Watch out. The threshold is suspicion, not proof; waiting for certainty before reporting is itself the mistake.
Self-check: A client asks whether his unusual transaction was reported. How should staff respond?
Answer: Neither confirm nor reveal any reporting, as tipping off is prohibited; refer the client per firm procedures.
25. Risk-Based Approach to Third-Party Risks
The risk-based approach requires a firm to assess where ML/TF risks arise, including risks arising through third parties and intermediated relationships, and to apply controls proportionate to that risk. Higher-risk situations attract enhanced due diligence, while lower-risk situations allow simplified measures, with the assessment documented.
Example. an agency relies on a third-party introducer for client onboarding, so it assesses that introducer's controls and applies extra verification because the risk is higher.
Watch out. Reliance on a third party does not transfer final responsibility; the firm must still assess and manage the risk.
Self-check: An onshore intermediary introduces a high-risk client. What does the RBA require?
Answer: Assess the third-party risk, apply enhanced due diligence appropriate to that risk, document it and manage or report the exposure.
26. SFC Principles in Exercising Fining Powers
When deciding whether and how much to fine under the SFO and the AMLO, the SFC applies published principles weighing factors such as the seriousness of the breach, whether the firm self-reported and cooperated, its disciplinary history, the need for deterrence, and consistency with past outcomes. Fines are one tool among disciplinary options, not an automatic response.
Example. two firms breach the same requirement, but the one that self-reported, cooperated fully and remediated promptly receives a materially lighter financial penalty.
Watch out. Do not assume identical breaches produce identical fines; cooperation, history and seriousness change the outcome.
Self-check: What factors would reduce a fine for an AMLO systems breach?
Answer: Prompt self-reporting, full cooperation, effective remediation, no prior disciplinary history and lower seriousness.
27. Corporate Governance and Senior Management Direction
Sound corporate governance means the board and senior management genuinely direct and supervise the business, with clear reporting lines, effective risk and compliance functions, and honest escalation of problems. Strengths appear where oversight is independent and documented; deficiencies appear where a dominant figure overrides controls or boards rubber-stamp management decisions.
Example. in one agency the CEO pressures analysts to please big clients and compliance reports only to the CEO; in another, compliance reports to the board with independent minutes. The second shows stronger governance.
Watch out. Governance questions test judgment: identify the structural weakness, such as compliance lacking independence, and its consequence.
Self-check: A CRA's compliance head reports solely to the CEO who sets analyst pay. What deficiency do you identify?
Answer: Lack of independent oversight: compliance should report to the board to counter the CEO's commercial influence.
Topic 2: Operational Compliance
Ongoing notification duties to the SFC, capital adequacy requirements, and the record keeping, accounts and audit obligations that keep a licensed CRA continuously compliant.
28. Ongoing Notification Requirements
Licensing is not a one-off event: a licensed CRA must notify the SFC of prescribed changes to its information and circumstances within the timeframes set by the rules. This keeps the SFC's register accurate so it can supervise the firm on the basis of current facts.
Example. a CRA moves to new offices and changes its compliance officer's contact details; it notifies the SFC of these changes within the prescribed time.
Watch out. Notification duties apply after licensing too; many candidates wrongly think obligations end once the licence is granted.
Self-check: A CRA changes its registered office address. What must it do?
Answer: Notify the SFC of the change within the timeframe prescribed by the applicable notification rules.
29. Events That Must Be Reported to the SFC
Beyond administrative changes, a firm must report significant events such as breaches of regulatory requirements, changes in its licensed representatives, regulatory action by other authorities, and other matters that materially affect its status or ability to remain compliant. The purpose is early warning so the SFC can assess any risk to clients and markets.
Example. a CRA discovers its liquid capital has fallen below the required level; that breach is a notifiable event, not just an internal problem.
Watch out. Self-reporting a breach does not excuse it, but failing to report an incident compounds the regulatory problem.
Self-check: A CRA breaches its capital requirement on Friday and fixes it by Monday. Must it report?
Answer: Yes, a capital breach is a reportable event; the prompt fix does not remove the notification duty.
30. Capital Adequacy Requirements for CRAs
Licensed CRAs, like other licensed corporations, must comply with the Financial Resources Rules, which require them to maintain sufficient liquid capital relative to their required amount at all times. Liquid capital is a measure of near-cash resources, so the regime is about being able to meet obligations as they fall due, not just owning assets.
Example. a CRA holds most of its funds in listed blue-chip shares; under the FRR framework it counts only the portion accepted as liquid capital towards its required level.
Watch out. Total assets are irrelevant; the test is the prescribed liquid capital measure against the firm's required amount.
Self-check: A CRA is asset-rich but its holdings are illiquid. Does it satisfy the FRR?
Answer: Not necessarily; only resources recognised as liquid capital count against the required amount under the FRR.
31. Record Keeping Under the Keeping of Records Rules
The Keeping of Records Rules require licensed corporations to keep books and accounts and prescribed records that accurately explain their business and financial position, and to retain them for the retention period the rules prescribe. Records must be organised so the SFC and auditors can locate and inspect them efficiently.
Example. a CRA keeps rating committee minutes, client agreements and internal correspondence in a searchable electronic system for the prescribed retention period, ready for inspection.
Watch out. Keeping everything does not comply; records must also be retrievable and maintained for the full prescribed period.
Self-check: A CRA's old records are complete but stored in unlabeled boxes at a distant depot. Any problem?
Answer: Yes, records must be readily accessible for the prescribed period, so poor retrievability breaches the record-keeping regime.
32. Accounts and Audit Rules
The Accounts and Audit Rules require licensed corporations to prepare accounts in the required form, have them audited by an approved auditor, and file the audited accounts and related reports with the SFC within the prescribed time. Auditors must report prescribed matters to the SFC, giving the regulator an independent check on the firm's financial soundness.
Example. a CRA's auditor identifies a reportable matter during the annual audit and, as the rules require, reports it to the SFC rather than only to the board.
Watch out. The auditor's duty runs to the SFC as well as to the company; some findings must go directly to the regulator.
Self-check: Who checks a CRA's financial statements annually, and who else may learn of audit findings?
Answer: An approved auditor audits the accounts, and prescribed auditor findings must be reported to the SFC under the rules.
Topic 3: Code of Conduct for Persons Providing Credit Rating Services
The CRA Code in practice: the House Code, the rating process, methodologies, ongoing monitoring, conflicts of interest, SFC reporting, structured finance disclosures, and duties to the investing public and rated entities.
33. Importance of the CRA Code for Type 10 Activity
Conducting the Type 10 regulated activity means the CRA Code applies as the SFC's benchmark for how a credit rating agency should behave. Compliance matters doubly: breaches can lead to SFC discipline, and because the CRA Code reflects international standards, non-compliance undermines the credibility the agency is selling.
Example. an agency that skips monitoring of published ratings is not just sloppy, it is falling below the CRA Code standard the SFC will test in any review.
Watch out. The CRA Code binds CRAs specifically; do not attribute it to all intermediaries or confuse it with the general Code alone.
Self-check: Why does CRA Code compliance matter commercially, not only legally?
Answer: Because rating credibility depends on following the Code, and breaches also expose the agency to SFC discipline.
34. Purpose and Coverage of the House Code
Each CRA must adopt its own code of conduct, the House Code, which implements the CRA Code's requirements within the firm. The House Code should cover how the agency manages its rating processes, conflicts of interest and disclosures, translated into concrete internal policies and procedures its staff can follow.
Example. RatingHK Ltd's House Code sets out who may sit on rating committees, what gifts analysts may accept, and how ratings changes are announced.
Watch out. The House Code is not optional and not merely a copy of the CRA Code; it must be the firm's own operating rules.
Self-check: What is a House Code and how does it differ from the CRA Code?
Answer: It is each CRA's own internal code implementing the CRA Code's requirements through firm-specific policies and procedures.
35. Keeping the House Code Updated and Publicly Disclosed
The CRA Code requires the House Code to be kept updated and publicly disclosed, so investors and rated entities can see the standards the agency claims to follow. Public disclosure creates accountability: outsiders can compare the agency's actual conduct against its published code.
Example. an agency changes its conflict-of-interest policy after a merger but leaves its old House Code on the website; it is failing the update-and-disclose requirement.
Watch out. Publishing once is not enough; the House Code must be maintained and updated as the business and rules change.
Self-check: An agency's website shows a House Code written years ago and outdated. What is the problem?
Answer: The House Code must be updated and publicly disclosed; an outdated public code breaches the CRA Code.
36. Transparent Rating Methodologies
Agencies must use rigorous, systematic rating methodologies and disclose them publicly so users can understand how ratings are derived and any limitations. Methodologies should be applied consistently and changed through a controlled process, since unexplained or retrofitted criteria destroy the comparability ratings depend on.
Example. an agency publishes its criteria for rating property developers, then applies them consistently to every developer it rates, documenting any model changes and reasons.
Watch out. Transparency means users can understand the method, not that every input and internal model detail must be revealed.
Self-check: Why must a CRA publish its rating methodology rather than keep it internal?
Answer: So rating users can understand how ratings are derived and their limits, ensuring consistency and comparability.
37. The Rating Process
A sound rating process runs from obtaining information, often from the rated entity, through analysis by primary and supporting analysts, to review and approval by a rating committee independent of commercial pressure. Ratings are then published with appropriate disclosures, and the process should be documented at each stage so it can be evidenced and reviewed.
Example. an analyst drafts a rating after meeting the issuer's management, but only a committee of senior analysts unconnected to winning the mandate can approve it.
Watch out. A single analyst cannot properly decide a rating; committee review is the structural safeguard in the process.
Self-check: Who should decide the final rating under a proper rating process?
Answer: A rating committee, independent of commercial considerations, reviewing the analysts' documented work.
38. Ongoing Monitoring of Ratings
Issuing a rating is the start, not the end: the CRA Code requires agencies to monitor ratings on an ongoing basis and update or withdraw them when circumstances change. Stale ratings mislead investors just as much as wrong ratings, so surveillance resources and procedures matter.
Example. a rated issuer suffers a major profit warning; the agency reassesses the credit and publishes a downgrade promptly rather than letting the old rating stand.
Watch out. Candidates often treat rating publication as the finish line; monitoring and timely updating are explicit Code requirements.
Self-check: A rated company's finances deteriorate sharply. What does the CRA Code expect of the agency?
Answer: Ongoing monitoring leading to a timely review, update or withdrawal of the rating to reflect new circumstances.
39. Sources of Conflicts of Interest for CRAs
Conflicts arise naturally in the rating business because fee income often comes from the entities being rated, and agencies may also sell ancillary services to those same entities. Other conflict sources include analysts' personal interests, gifts and entertainment, and pressure connected with winning or keeping mandates.
Example. an agency is negotiating a lucrative risk-assessment service contract with a company while its analysts rate that company's bonds; the dual relationship is a structural conflict.
Watch out. A conflict is managed, not eliminated; the Code expects identification, disclosure and controls, not necessarily refusing all such business.
Self-check: List two structural conflicts in CRA business and the expected response.
Answer: Issuer-pays fees and ancillary services for rated entities; respond by identification, disclosure and managed controls.
40. Analyst Remuneration and Conflicts
The CRA Code requires that analysts' compensation not be tied to the fees generated by the specific ratings they work on, so that pay structures do not reward generous ratings. Remuneration should instead rest on the quality of analytical work, free from revenue links that would bias outcomes.
Example. an agency plans to bonus analysts on the revenue from the bond issues they rated; compliance redesigns bonuses around rating quality and process instead.
Watch out. The issue is the link between pay and fees from rated entities; general firm performance bonuses are a different question.
Self-check: Can analysts be paid more when the issuers they rate pay the agency higher fees?
Answer: No, compensation must not be linked to fees from rated entities the analysts rate; it should reward analytical quality.
41. Issuer-Pays Model and Fee Negotiation
Because rated entities usually pay for their ratings, there is an inherent risk that fee discussions bleed into rating discussions. The CRA Code addresses this by requiring that those who negotiate fees be separate from rating decisions, and by restricting how fees and pre-rating interactions with rated entities are handled.
Example. a sales director hints to an issuer that a higher fee could accompany a better rating outcome; separating commercial staff from the rating committee prevents this pressure.
Watch out. The issuer-pays model itself is permitted; the Code controls how it operates, so do not answer that fee income must stop.
Self-check: An issuer threatens to withhold its rating fee unless the rating improves. How should the CRA respond?
Answer: Insulate the rating committee from the fee dispute, document the pressure, and decide the rating independently under the House Code.
42. Independent review and reporting to the SFC
A credit rating agency must establish a rigorous formal review function, independent of the business lines principally responsible for ratings. At least annually it reviews methodologies, models and significant changes, plus the adequacy and effectiveness of systems and internal controls. Record findings comprehensively, send the completed report to the SFC forthwith and address deficiencies.
Example. Hypothetically, the independent review identifies weak controls over a revised rating model. The agency records the finding in its report, sends the completed report to the SFC promptly as required and takes corrective action.
Watch out. This is not merely a House Code review supplied only when the SFC asks. The required formal review has a defined scope and a reporting obligation on completion.
Self-check: Can a CRA complete the formal review but keep the report internally until its next inspection?
Answer: No. A copy of the comprehensive written report must be provided to the SFC forthwith upon completion, and deficiencies must be addressed.
43. Structured Finance Product Disclosures
Ratings on structured finance products carry extra CRA Code disclosure requirements because analysis relies heavily on information and assumptions supplied by arrangers and originators. The agency must disclose matters such as the extent of its due diligence on the underlying data and the representations it received, so users understand the limits of what the rating certifies.
Example. before rating a hypothetical pool of securitised loans, the agency discloses that it did not independently verify every underlying loan file and relied on the arranger's data representations.
Watch out. Structured finance ratings are not analysed like ordinary corporate bonds; the extra disclosures exist because the data comes from transaction parties.
Self-check: Why do structured finance ratings need additional disclosures under the CRA Code?
Answer: Because analysis depends on originator and arranger data and assumptions, so users must know the due diligence done and limits of the rating.
44. Responsibilities to the Investing Public
The CRA Code requires agencies to act in a way that serves investors who rely on published ratings: exercising independence and rigour, avoiding distorted ratings, and making timely, meaningful disclosures. This duty runs to the market at large, not just to paying clients, which distinguishes CRAs from many other service providers.
Example. an agency discovers a rating was issued on incomplete data and promptly announces a review rather than quietly hoping nobody notices, protecting the investing public.
Watch out. The client who pays is the rated entity, but the ultimate duty owed is to the users of the rating.
Self-check: To whom does a CRA's primary published-rating duty run, given the issuer pays?
Answer: To the investing public relying on the rating, which the Code protects through independence and disclosure duties.
45. Responsibilities to Rated Entities
The CRA Code also imposes fair dealing duties towards rated entities: treating them fairly, using information they provide only for proper purposes, and handling confidential information securely. At the same time, the entity's commercial displeasure must never influence a rating, so fairness and independence must operate together.
Example. an agency receives detailed management forecasts during a rating, keeps them confidential, and does not leak them, even after the company later disputes the rating publicly.
Watch out. Fairness to rated entities never overrides rating integrity; you cannot please an entity by bending the rating.
Self-check: A rated entity threatens to leave if the downgrade proceeds. What does the CRA do?
Answer: Proceed with the independent rating while treating the entity fairly and protecting its confidential information.
46. Independence: Separating Rating and Commercial Functions
Independence is protected structurally: rating decisions, criteria and surveillance sit with analysts and committees, while sales, marketing and fee negotiation sit with commercial staff, with information barriers between them. This separation ensures commercial pressure stops at the door of the rating process.
Example. a business development head is barred from rating committee meetings and from seeing draft ratings before publication, so client negotiations cannot leak into the rating.
Watch out. Independence is judged by structure and evidence, not by slogans; a firm claiming independence without separation fails.
Self-check: What structural feature best demonstrates a CRA's independence from commercial pressure?
Answer: Formal separation, with information barriers, between commercial and fee functions and rating decisions.
47. Disclosure of Rating Relationships and Non-Rating Services
Users of ratings should know the agency's relationship with the rated entity, including whether the entity paid for the rating and whether the agency provides it with non-rating services, since both can colour perception of independence. The CRA Code requires appropriate disclosure so users can weigh these relationships when reading a rating.
Example. alongside a published rating, the agency discloses that the issuer paid a standard fee and separately bought the agency's sector research, letting investors judge the relationship.
Watch out. Hiding a paid relationship is worse than having one; disclosure is the regulatory cure, not refusing all paid ratings.
Self-check: An agency also sells consulting to a rated issuer. What must it do regarding the rating?
Answer: Disclose the non-rating service relationship appropriately so rating users can assess any impact on independence.
Topic 4: Misconduct
Market misconduct under the SFO, the twin MMT and criminal tracks, the tribunal's role and procedures, insider dealing's relevance to CRAs, the full range of misconduct types, consequences and civil actions, and improper trading practices.
48. Market Misconduct Provisions Under the SFO
The SFO sets out civil market misconduct provisions covering insider dealing, false trading, price rigging, disclosure of information about prohibited transactions, disclosure of false or misleading information inducing transactions, and stock market manipulation. The same conduct can also be prosecuted criminally, because the SFO provides parallel civil and criminal tracks for handling it.
Example. a trader circulates a fabricated takeover rumour to lift a share price; that could be examined as disclosure of false or misleading information likely to induce transactions.
Watch out. There are six distinct types; learn each element, because scenario questions may turn on which type fits the facts.
Self-check: Name the SFO's civil market misconduct types.
Answer: Insider dealing, false trading, price rigging, disclosure of information about prohibited transactions, disclosure of false or misleading inducing information, and stock market manipulation.
49. MMT Proceedings Versus Criminal Prosecutions
MMT proceedings are civil: the tribunal decides on the civil standard of proof whether market misconduct occurred and can impose civil sanctions, but cannot imprison. Criminal prosecutions are brought through the courts on the criminal standard and can result in conviction, fines and imprisonment, so the same conduct may theoretically face either track.
Example. two traders engaged in identical rigging conduct; one case is taken to the MMT as a civil matter, while in a different case the same conduct is criminally prosecuted.
Watch out. MMT findings are not criminal convictions; a person before the MMT is not being tried for an offence.
Self-check: Can the MMT imprison someone it finds engaged in market misconduct?
Answer: No, the MMT is civil and imposes civil sanctions; only criminal courts can impose imprisonment.
50. The SFC's Investigative and Enforcement Role
The SFC investigates suspected market misconduct using statutory powers to compel production of records and explanations, and to obtain search warrants where needed. After investigating, the SFC can pursue the civil route through MMT proceedings or refer the case for criminal prosecution, and may also take parallel disciplinary action against licensed persons.
Example. after a suspicious price spike, the SFC compels a CRA to produce dealing records of its staff, then assesses whether the matter belongs before the MMT or prosecutors.
Watch out. Investigation powers are compulsory, not consensual; failing to respond to an SFC requirement is itself serious.
Self-check: After investigating suspected rigging, what two routes can the SFC's findings lead to?
Answer: Civil MMT proceedings or referral for criminal prosecution, alongside possible disciplinary action.
51. Role of the Market Misconduct Tribunal
The MMT is the civil tribunal established to determine whether market misconduct has occurred under the SFO's civil regime. Its purpose is an efficient, expert forum that protects market integrity by imposing civil sanctions on those whose conduct harmed the market, without the machinery of a criminal trial.
Example. the SFC applies to the MMT over a false trading episode, and the tribunal examines the evidence and decides whether the misconduct is established.
Watch out. The MMT is not part of the SFC; it is an independent tribunal the SFC applies to.
Self-check: What is the MMT and what question does it decide?
Answer: An independent civil tribunal deciding, on the civil standard, whether market misconduct occurred under the SFO.
52. MMT Procedures
MMT proceedings typically begin with an SFC application identifying the conduct and persons involved; respondents receive notice, the hearing is generally in public, and they may be legally represented and contest the evidence. The tribunal applies the civil standard of proof, and its findings and orders are published, giving the process transparency and deterrence value.
Example. a respondent trader attends a public MMT hearing, cross-examines witnesses through counsel, and argues the price movements had a genuine market explanation.
Watch out. Publicity is part of the design; respondents' identities and findings are published, unlike some private disciplinary forums.
Self-check: What standard of proof applies at an MMT hearing, and can a respondent be represented?
Answer: The civil standard applies, and respondents may be legally represented at the public hearing.
53. Elements of Insider Dealing
Insider dealing arises where a person connected with a listed company deals, or induces dealing, in its securities while holding information he knows is generally unavailable and price-sensitive, or procures another to deal, or passes such information to another known to be likely to deal. The information must be material enough to affect price if generally known.
Example. an employee learns an unannounced profit collapse and sells his shares before the announcement; he dealt while holding generally unavailable price-sensitive information.
Watch out. Both dealing on the information and tipping others can constitute insider dealing; tipping is not a lesser safe harbour.
Self-check: A person tips a friend about unpublished good news, who buys. Who is exposed?
Answer: Both: the tipper for disclosing price-sensitive unpublished information expecting dealing, and the friend for dealing on it.
54. Insider Dealing Relevance to CRAs
CRAs are particularly exposed to insider dealing risk because analysts receive confidential, often price-sensitive information from rated entities during the rating process. Firms must impose information barriers, restrict personal dealing by analysts, and control the handling of material non-public information so that it never feeds trading decisions.
Example. a rated issuer's CFO reveals an unannounced acquisition; the agency restricts the information, forbids any related dealing, and preserves the disclosure to the proper channels only.
Watch out. Even receiving and passing on such information, without trading, can breach the regime; silence plus controls is the only safe course.
Self-check: An analyst receives unpublished price-sensitive data from a rated issuer. What must the firm do?
Answer: Apply information barriers, prohibit related personal dealing and tip-offs, and manage the information under strict procedures.
55. False Trading and Price Rigging
False trading concerns a false or misleading appearance of trading or the market or price; its provisions include intention or recklessness, deeming rules and defences. Price rigging separately covers specified wash sales with a price effect and fictitious or artificial transactions or devices intentionally or recklessly producing that effect. The categories can overlap, but each has its own elements.
Example. two connected accounts sell the same shares back and forth between themselves with no real change of ownership to prop up the quoted price; this is false trading, and the price-fixing purpose also points to price rigging.
Watch out. A false appearance of active trading can matter even without an aim to raise the price. Test the specific elements rather than defining both categories as intentional price fixing.
Self-check: Wash sales between connected accounts to hold up a price: which misconduct types arise?
Answer: False trading for non-genuine transactions, with price rigging also in point where the purpose is an artificial price.
56. Other Market Misconduct Types
Disclosure about prohibited transactions concerns information that securities prices are likely to be affected by prohibited manipulative dealing, with conditions involving participation or benefit. False-information provisions concern misleading information likely to induce transactions or materially affect price, together with the required mental element. Stock market manipulation is separate: two or more transactions affect price with an intention to induce specified trading decisions.
Example. a person circulates a fake 'exclusive' news story about a listed company's fictitious contract, moving the price; this fits disclosure of false or misleading information inducing transactions.
Watch out. No personal trading is needed; publishing false information that induces others to trade can itself be market misconduct.
Self-check: Someone spreads fabricated positive news but never trades himself. Any market misconduct?
Answer: Yes, disclosing false or misleading information likely to induce transactions or affect price is itself misconduct.
57. Consequences of MMT Findings
If the MMT finds market misconduct, it can make orders including disgorgement of profit gained or loss avoided (payable to the Government), disqualification from being a director or taking part in the management of any listed or unlisted corporation in Hong Kong, cold shoulder orders restricting dealings in the Hong Kong financial market, cease and desist orders, and orders to pay the SFC's investigation and legal costs and the costs of the proceedings. The respondent also carries the published finding, which is itself a powerful consequence.
Example. after a rigging finding, the trader is ordered to give up his gains, pay the SFC's investigation and proceedings costs, is barred from dealings in the Hong Kong financial market for a period, and is disqualified from managing any listed or unlisted corporation.
Watch out. No imprisonment can flow from MMT proceedings; sanctions are civil, financial and disqualifying in nature.
Self-check: List three MMT orders possible after a market misconduct finding.
Answer: Disgorgement of profit gained or loss avoided, payment of costs, and a cold shoulder, cease and desist or disqualification order.
58. Consequences of Criminal Prosecution for Market Misconduct
Where the same conduct is prosecuted criminally, conviction brings a criminal record and court-imposed fines and imprisonment, reflecting the graver stigma of the criminal route. A conviction also has knock-on effects for a licensed person, since a dishonesty-related conviction bears directly on continuing fitness and propriety and can end a licence.
Example. a dealer convicted of insider dealing receives a prison sentence and fine, and his employer terminates him because he is no longer fit and proper to act as a representative.
Watch out. Criminal consequences attach only after prosecution and conviction; an MMT finding alone does not create a criminal record.
Self-check: What extra consequences follow a criminal conviction that an MMT finding cannot impose?
Answer: A criminal record with court-imposed fines and imprisonment, plus knock-on fit and proper effects on licensing.
59. Private Civil Actions Under the SFO
The SFO gives persons who suffer loss from market misconduct a private right to sue the wrongdoer for compensation in civil proceedings, separate from the SFC's enforcement. A relevant MMT finding or criminal conviction provides strong support for the claimant's case in such an action.
Example. investors who bought shares at inflated prices after a false trading scheme claim compensation from the traders responsible, using the tribunal's published finding as the foundation of their civil claim.
Watch out. Private action is compensatory and belongs to the victims; the SFC does not sue for victims' damages on their behalf.
Self-check: How can victims of price rigging recover their losses?
Answer: By bringing their own private civil action for compensation under the SFO, supported by any MMT finding or conviction.
60. Improper Trading Practices
Some practices fall short of the technical elements of market misconduct yet remain improper and can breach conduct standards, so recognising them matters for compliance. Common forms include churning a client's account through excessive trading, trading ahead of client orders, and manipulative habits that would mislead clients or the market even where a full misconduct case is hard to prove.
Example. a representative trades a client's account far beyond any plausible strategy, generating commissions for himself and losses for the client; that churning is an improper practice and a conduct breach.
Watch out. Improper practice questions test the borderline: even if a statutory misconduct element is missing, the conduct may still breach the Code of Conduct.
Self-check: Excessive trading that mainly benefits the broker's commissions is not clearly false trading. How is it still wrong?
Answer: As churning, it is an improper trading practice breaching conduct standards on honesty and clients' interests, even without full misconduct elements.
Turn your revision into a study plan
Adjust the pace to your starting knowledge and examination date. These are suggested revision stages, not an official preparation timetable.
| Stage | What to do |
|---|---|
| Stage 1 - Framework foundation | Work through Topics 1 concepts 1 to 17, building a one-page map of the SFO, Type 10 licensing, what credit rating services cover and exclude, and how the CRA Code relates to the IOSCO Code. Finish by writing, from memory, the boundary between a regulated rating service and an excluded internal-use or rated-entity-only rating. |
| Stage 2 - Duties and controls | Study Topics 1 concepts 18 to 27 and all of Topic 2, drafting two checklists: one of internal control areas and senior management responsibilities, the other of AML/CFT steps, PDPO principles, fining principles and ongoing notifications, capital, record keeping and audit duties. Test yourself with the self-check questions on notification events and liquid capital. |
| Stage 3 - The CRA Code in depth | Cover Topic 3 concepts 33 to 47 by building a scenario drill: for each House Code, methodology, monitoring, conflict-of-interest and disclosure requirement, sketch one hypothetical situation where the requirement bites. Pay special attention to separating commercial and rating functions and to structured finance disclosures, as these combine easily with framework knowledge in questions. |
| Stage 4 - Misconduct and consolidation | Learn Topic 4 concepts 48 to 60 by making a comparison table: MMT versus criminal prosecution, each misconduct type's elements, consequences of each track, and private civil actions. Then complete a timed self-test of 40 questions across all four topics, aiming comfortably above the 70% pass mark, and revisit every trap you missed. |
Questions candidates ask
What is the exam format for HKSI Paper 4?
Paper 4 has 40 multiple-choice questions taken in 60 minutes, and the pass mark is 70%. The paper covers the four syllabus topics in this guide: the general regulatory framework, operational compliance, the CRA Code of Conduct, and misconduct.
Which study guide version should I use?
Examination questions are based on the latest version of the published study guide that is still current, and the Paper 4 guide listed by the HKSI Institute is version 2.2, published in March 2024. Confirm the version valid for your sitting via the HKSI Institute's announcements and downloads before you begin, since regulatory updates and guide versions can differ.
Do codes like the CRA Code have the force of law?
No. Codes and guidelines are not ordinances, so breaching them is not automatically a criminal offence. The SFC uses them as benchmarks in licensing and disciplinary decisions, while the SFO itself carries the statutory consequences, including market misconduct proceedings.
Can the Market Misconduct Tribunal send someone to prison?
No. MMT proceedings are civil, decided on the civil standard, and can only impose civil sanctions such as disgorgement of profit gained or loss avoided, cold shoulder orders restricting dealings in the Hong Kong financial market, cease and desist orders, disqualification orders covering listed or unlisted corporations, and costs orders. Imprisonment is available only through criminal prosecution in the courts on the separate criminal track.
How does Paper 4 relate to Paper 10?
Paper 4 is the regulatory paper on the rules governing credit rating services, while Paper 10 is the practical paper on credit rating services products and practices. They are separate examinations with their own study guides, so check which one your licensing or career route requires before enrolling.
Official sources and further reading
- HKSI Paper 4 syllabus and learning outcomes (PDF)
- HKSI current study guide versions and effective dates
- HKSI examination format and study resources
- SFC Code of Conduct
- SFC: Market Misconduct Tribunal orders in false trading case
- SFC Code of Conduct for Persons Providing Credit Rating Services
These independent revision notes explain the public syllabus through original examples. They do not reproduce the official study guide or examination questions. Use the official study guide valid for your examination date for the full examinable detail. HKSIDataBase is an independent provider and is not endorsed by the HKSI Institute.