Office Search Checklist for an SFC-Licensed Firm in Hong Kong

The Securities and Futures Commission does not ban licensed corporations from operating in a business centre or shared office, and it prescribes no single permitted office format. What it requires is that the exact premises remain suitable for the regulated activities carried on there.

Which is why "private office", "enterprise floor", "secure Wi-Fi" and a good address are not compliance conclusions. A serviced office may well meet a firm's requirements — after the firm has tested the exact room, the operating arrangements, the record locations and the agreement against its own activities.

Use the questions and evidence-pack sections below to prepare the operator questions and the approval pack. A completed checklist is not SFC approval. The applicant or licensed corporation, its responsible officers and its compliance and legal advisers own the regulatory determination and any submission.

The SFC's premises FAQ lists factors that may indicate premises are unsuitable:

• no secured, properly segregated, lockable office area designated for the corporation's own exclusive use;
• essential equipment or telecommunications outside a secure enclosed area accessible only by staff and authorised people;
• insufficient measures to prevent clients confusing the corporation with other businesses at the same premises;
• practical difficulty protecting confidentiality during face-to-face client meetings;
• inability to ensure access for formal regulatory visits, including investigations and inspections.

The list is not exhaustive, and suitability is a continuing obligation rather than a one-off test. The same FAQ notes that the SFC generally expects a "fixed abode" and discourages frequent office changes.

Which produces a simple procurement rule:

Never shortlist a brand as "SFC suitable". Test an exact room and its operating arrangement as Fail, Open evidence, or Ready for the firm's compliance review.

Only the firm and the regulator close the regulatory question.

One address can perform several roles, and each raises a different question.

"We keep everything in the cloud" does not close this. The SFC FAQ makes premises approval relevant where regulatory records are kept or accessed, and separate rules apply where electronic regulatory records sit exclusively with an electronic data storage provider or an affiliate.

Record each role in the search brief explicitly. If the team, the records model or the client-facing activity changes later, reassess the premises rather than assuming the original approval still covers it.

Build the compliance brief before requesting rooms

An ordinary office search starts with district, desks, budget and move date. An SFC-related brief needs a second page, completed by the firm:

• applicant, licensed corporation or other status;
• regulated activities to be conducted from the premises;
• principal place, branch and record-keeping roles;
• expected staff and visitors, including out-of-hours patterns;
• frequency and nature of face-to-face client meetings;
• physical and electronic records created, held or accessed;
• confidential or non-public information handled;
• equipment and telecommunications that must stay staff-only;
• reception, legal-name, signage and licence-display requirements;
• regulatory inspection and investigation access;
• technology, resilience and incident requirements;
• intended term, expansion plan and tolerance for room changes;
• the compliance, legal, IT/security and responsible-officer approvers.

We should be direct about our own position, because it affects how you use this article.

We do not verify or track the regulatory status of our clients, and we have not been involved in identifying or satisfying any client's SFC obligations. This is not a case study, and we are not claiming specialist SFC advisory experience or a track record with licensed corporations.

What we do is source options against a premises brief the firm has already approved, and pass property and technical questions to the operator. Compliance provisions, the evidence behind them and any control the firm requires are agreed directly between the firm and the chosen operator. We do not define the firm's controls, act as its compliance adviser, or make the compliance decision.

Firms in this position sometimes decide they need measures such as separate swipe access, CCTV coverage, or their own network circuit instead of shared Wi-Fi. Those are illustrations of what a firm might specify for itself — not SFC requirements, not our recommendations, and no combination of them proves a room is suitable.

The test is not whether the operator calls the product "private". Inspect the boundary.

Confirm the exact suite and room number; the walls and doors enclosing the area; whether it is designated for the firm's exclusive use; the lock type and who can issue, copy or deactivate credentials; everyone holding master-key or override access; cleaner, maintenance, security and emergency entry; entry logging and how long logs are retained; whether another member can pass through the area; lockable storage for physical records; and a floor plan marking the area the firm occupies.

The SFC's published application materials ask firms using a business centre or shared office to confirm the area is secure, properly segregated, enclosed, lockable and designated for exclusive use — and to supply a floor plan identifying the occupied area.

A full floor can still fail if the access boundary or the agreement is unclear. A small private room can stay open if the operator documents the controls.

The SFC test refers to essential office equipment and telecommunications sitting inside a secure enclosed area accessible only to staff and authorised personnel.

Inventory what is actually relevant to the firm's activities: routers, firewalls and network termination equipment; telephones and any voice recording or dealing equipment; laptops, workstations and privileged administration devices; printers, scanners and multifunction devices; physical records, backup media and secure waste; server, rack or communications cabinets; and any screens visible from corridors or shared areas.

Then ask whether the connection is shared, logically separated or physically dedicated; who owns and administers the router, firewall, Wi-Fi and credentials; whether another centre member can discover or reach the firm's devices; whether the firm can install its own line, equipment and cabling; who can enter the riser, rack or communications room; what the operator logs, retains or processes; what happens during an outage, an incident or a move to another room; and which control belongs to the operator versus the firm.

"High-speed Wi-Fi", "corporate-grade internet" and "enterprise IT" answer none of that.

The contract matters as much as the kit. The Executive Centre's Hong Kong private-office page describes a lockable office, 24-hour access and corporate-grade connectivity. IWG's March 2026 global terms state the allocated room is used non-exclusively, may be reallocated, can be entered by the operator for stated purposes, and carries no guarantee of network security.

Different products, different contract structures, and neither one evidence that a specific Hong Kong room suits a specific licensed firm. Get the proposal, the local agreement, the house rules, the IT specification and any written exceptions for the actual suite.

Co-location creates a plain risk: a visitor may not understand which business they are dealing with.

Walk the route from the building entrance to the room and record the directory listing; lift-lobby and floor signage; the reception script when your client arrives; the legal company name displayed at or near the room; visitor badge and host identification; whether unrelated companies share a reception identity; where the firm's SFC licence or a certified copy can be displayed; and whether the operator can change or remove any of it.

The SFC's ongoing-obligations guidance says a licensed corporation should display its licence prominently — in the client reception area at its principal place of business, with a certified copy at each other place of business. Confirm the arrangement with the firm's adviser, and make the required display a written operator permission rather than a favour.

A building directory entry may not prevent confusion inside a multi-company centre. A shared receptionist may not identify the contracting firm clearly. Test the whole arrival path.

A bookable meeting room is not automatically a confidential meeting environment.

For every room the firm might use: inspect acoustic leakage from the corridor and adjacent rooms; identify glass, blinds and sightlines; check screens, whiteboards and document clearing; confirm who can enter and when; test booking visibility and naming conventions; record the visitor route; establish whether conversations cross a shared lounge or reception; confirm the room is actually guaranteed when a client arrives; and check how the operator handles lost property, printing and confidential waste.

Where the firm regularly takes client instructions or discusses non-public information face to face, a shared room available "subject to booking" creates both a capacity and a confidentiality dependency. Put the required room, access and fallback into the agreement or an approved operating procedure.

"24/7 member access" is not access for an SFC inspection.

Walk through the scenario on paper:

1. A regulator arrives without being on the visitor list.
2. Building security asks for identification or pre-registration.
3. Operator reception is unstaffed, or requires a member host.
4. Lift access is controlled.
5. The firm's responsible staff member is temporarily away.
6. Records have to be retrieved, viewed or reproduced.

For each step, identify the person, the system and the written rule that permits access. Then confirm building and centre operating hours; visitor and government-authority protocols; whether operator approval, escort or advance notice is required; emergency and out-of-hours contacts; access to the exact room, records and equipment; retrieval and reproduction capability; and what happens if the operator, the access system or the internet is unavailable.

The SFC FAQ requires the firm to ensure premises will always be accessible for formal regulatory visits. A salesperson's verbal reassurance does not meet that. Keep the centre and building confirmation with the firm's procedure.

"Paperless" is not a records answer.

Build a register for each regulatory-record category. The table below is a completion guide, not a populated compliance record: replace every prompt with the firm's actual system, location, access evidence and named reviewer.

The premises FAQ says a branch may require approval where records are kept or can be accessed. The SFC's external electronic data storage circular and its related FAQ address regulatory records kept exclusively with an EDSP or an affiliate.

This is a specialist compliance and technology workstream. An operator can describe its room, network and services. It cannot decide the firm's section 130 position, its record inventory or its EDSP obligations.

The room you viewed may not be the room you occupy for the whole term.

Check whether the operator can substitute another room; move the firm within the centre or to another centre; alter access hours or security procedures; enter for cleaning, inspection, maintenance or sales viewings; change shared reception or signage; suspend access during a payment or rule dispute; or change the network specification.

For each right, decide with compliance whether the firm needs prior written notice; prior written consent; an objectively defined equivalent room; a new floor plan and control review; a regulatory notification or approval step; a termination right; or a temporary continuity arrangement.

A flexible room move is not only a facilities event. The SFC's Licensing Handbook treats an intended business-address change as a notifiable event, and notes that it triggers a section 130 application for the new premises.

For an existing licensed corporation, the SFC's ongoing-obligations table gives at least seven business days' notification before an intended business-address change. The application-procedures page states that an intended new business address requires a section 130 application for premises used for record keeping.

Seven business days is a notification deadline. It is not a processing time, and it is certainly not an office-search timetable.

Before signing, map: operator hold or reservation expiry; agreement signing and deposit; compliance, legal, IT and responsible-officer approval; SFC application or notification preparation; any approval or acknowledgement the firm needs before use; network, access, signage and records setup; the move and operational-readiness date; and exit from the previous approved premises.

Conditions, delayed commencement, a hold or another risk allocation should only follow legal and compliance review. Nobody on the property side can invent regulatory timing or promise that a room will be accepted.

Do not send an internal approver a marketing page. Assemble:

1. exact operator legal entity and centre address;
2. exact suite identifier and dated availability;
3. marked floor plan showing the firm's occupied area;
4. photographs of the door, lock, room boundary, reception and proposed displays;
5. key, access-card, master-access, visitor and operator-entry matrix;
6. proposed company-name and licence-display locations;
7. meeting and privacy walkthrough;
8. IT architecture and responsibilities, including any approved custom installation;
9. records and electronic-data location and access map;
10. written regulatory-visit route and escalation contacts;
11. proposal, service agreement, local terms, house rules and IT schedule;
12. relocation, substitution, entry, suspension and change-control analysis;
13. internal legal, compliance, IT/security and responsible-officer approvals;
14. relevant SFC submission, approval, acknowledgement or adviser record.

Record source dates and unresolved items. A brochure statement stays Open until the exact room and the agreement support it.

Our catalogue helps discover buildings, operators, private-office products and general amenities. Its structured fields cover generic attributes: 24/7 access, internet connectivity, reception services, printer, server room, meeting-room availability.

It holds no verified exact-room fields for exclusive and lockable use; staff-only equipment and telecommunications; operator or master access; client-confusion controls; legal-name or licence display; confidential meeting operation; regulatory-visit access; records kept or accessible; section 130 status; EDSP or affiliate record arrangements; relocation and substitution restrictions; or floor-plan evidence and compliance-review dates.

Which is why you will never see an "SFC approved", "audit-ready" or "regulated-firm suitable" badge from us. A catalogue can invite a qualified enquiry. The firm decides which exact-room evidence and controls it requires.

We describe an option as available for the firm's review against its own requirements. Never as regulator-approved or compliance-ready.

These are for the firm to put to the operator, and for the firm's reviewers to assess. Ask the operator to answer in writing:

1. Is the exact enclosed room reserved for the firm's exclusive use, and can it be locked?
2. Who can enter with a master key or override credential, for what purposes, and with what record?
3. Can all essential equipment and telecommunications stay inside the staff-only area?
4. Which dedicated or segregated network options exist, and who administers each component?
5. Can the firm install its own line, firewall, telephone, recording or other approved equipment?
6. Which legal-name, room, directory and licence displays are permitted?
7. How does reception identify the firm and route its clients?
8. Which rooms can support confidential meetings, and how are access, acoustics and clearing controlled?
9. How would an unplanned formal regulatory visit pass building security, reception and lift controls?
10. Can regulatory records be retrieved, viewed and reproduced without undue delay from the exact premises?
11. Can the operator relocate the firm, substitute the room, enter it or change relevant services?
12. Will the operator attach the floor plan, IT specification and agreed exceptions to the signing pack?

A missing answer is an open dependency. A sales promise is not closed evidence until it appears in a controlled document, or in written confirmation the firm's reviewers accept.

A flexible office is not disqualified because other companies share the centre. It is not qualified because the room has a door.

Before committing, the firm should be able to show what regulated work happens at the premises; where every relevant record is kept and accessed; that the exact area, equipment and telecommunications are properly controlled; how client identity and confidentiality are protected; how licence display and company identification work; how the SFC reaches the premises and the records; how operator entry, substitution and change are controlled; and who approved the evidence and completed any required regulatory step.

If one of those answers is missing, the option is not "probably compliant". It is Open.

Once your compliance team has approved the premises requirement, send it to us with your target dates and we will search for exact rooms that match it and put your property and technical questions to the operators.

The compliance questions above, the answers and the supporting evidence are for the firm to agree directly with the operator it selects. Your compliance, legal and responsible-officer review, and any SFC application or notification, stay where they belong.

Talk to us about an office search

This is an office-search and evidence-collection guide. It is not legal, licensing, investment or regulatory advice, and it does not determine whether any firm needs a licence or whether any premises are suitable. Requirements, forms and operator arrangements change — use current SFC materials and case-specific Hong Kong professional advice.