On 20 August 2026, the Securities and Futures Commission (SFC) issued a circular on simplified Electronic Direct Debit Authorisation (eDDA) arrangements.1 The circular addresses licensed corporations, SFC licensed virtual asset service providers and associated entities. The SFC refers to these collectively as licensed firms. Internet brokers and virtual asset trading platform operators are the principal audience. The circular responds to the increasing use of simplified eDDA for receiving client deposits. It identifies risks arising from erroneous, unauthorised or fraudulent setup requests. It also covers the resulting direct debit transactions, defined as eDDA Deposits. The circular sets out measures for assessing and mitigating these risks. Its stated purpose is to protect firm operations and clients from financial loss. The circular carries reference SFO/IS/033/2026. It was issued by the Intermediaries Division.
How simplified eDDA arrangements operate
eDDA is a service under the Faster Payment System.2 It enables a payer to authorise direct debits from a bank account held in the payer’s own name. Under a standard eDDA arrangement, the client initiates the setup request through its own bank. Under a simplified eDDA arrangement, the licensed firm initiates the setup request as payee. The firm acts on authorisation and information supplied by the client. That information includes the bank name, account number and account owner name. It also includes the identification document type and number used to open the account.
The payee bank transmits the request to the payer bank for verification. The payer bank may or may not require confirmation from the account owner. Where confirmation is not required, the setup completes faster. The firm may then be required to confirm to its bank that authorisation was obtained. The firm may also be required to indemnify its payee bank. The indemnity covers losses, liabilities and third party claims arising from setup requests and eDDA Deposits.
The Risks Identified by the SFC
Where no owner confirmation occurs, liability concentrates in the licensed firm. The SFC states that:
“the licensed firm that initiates the setup request and subsequent eDDA Deposits at the client’s request bears primary responsibility for ensuring that it has obtained proper authorisation from the bank account owner”.
The SFC in the above frames simplified eDDA as a convenience purchased with firm level liability. Two risk categories follow. The first is impersonation and unauthorised access risk. Stolen personal and bank account information may be used to initiate a setup request. The account owner may have no knowledge of the request. The second is indemnity and financial risk. The indemnity given to the payee bank exposes the firm to claims. Erroneous setup requests containing inaccurate client supplied information carry the same exposure.
Risk assessment expectations
The circular anchors its expectations to existing conduct obligations. Paragraph 4.3 of the Code of Conduct requires proper internal controls against fraud. Paragraph 11.10 of the VATP Guidelines imposes equivalent obligations on platform operators.3 Before entering or continuing simplified eDDA arrangements, firms should complete a structured assessment. They should review the terms of indemnities given, or to be given, to their banks. They should identify which payer banks their payee banks can reach. They should establish whether those payer banks require confirmation from account owners. They should then assess the resulting risks against their operational capabilities and financial resources. The assessment should be repeated periodically and whenever the arrangement materially changes in scale or risk profile.
Verification measures before processing setup requests
Firms should verify authorisation before processing any new setup request. Where the payer bank requires owner confirmation, firms should assess that bank’s authentication process. Enquiries may be made through the payee bank or directly with the payer bank.
Where no confirmation is required, firms should verify account ownership independently. The circular prescribes a single small value transfer test. The client transfers funds from the designated account to the firm’s bank account. The firm then verifies the account holder name against its own bank’s deposit record. Firms should not rely solely on deposit records supplied by clients. For clients onboarded through the designated Hong Kong bank account approach, the initial deposit should not pass through simplified eDDA unless authorisation is established.4
Firms should also verify the identification information submitted in setup requests. That information should match the firm’s existing records for the client. Where it differs, firms should obtain the identification document used to open the bank account.
The withholding obligations
Where verification cannot reasonably be satisfied, firms may consider to decline the setup request. Firms may also withhold processing where red flags emerge from ongoing monitoring.5 The circular lists them as following:
- Repeated failure in setup requests or deposits;
- frequent or large deposits within a short period without apparent commercial rationale;
- deposits inconsistent with the client’s financial profile or historical deposit pattern;
- new setup request paired with the whitelisting of a new wallet address, in either order.
- suspicious deposits converted into virtual assets and withdrawn shortly thereafter.
Firms should investigate such activity promptly. Reporting may be warranted to the Joint Financial Intelligence Unit or the Anti-Deception Coordination Centre of the Hong Kong Police Force. Notification obligations to the SFC may also arise.6
Supplementary measures and alternative channels
Firms may consider supplementary restrictions on eDDA Deposits, which include limits on transaction amounts or frequency and withholding periods after deposit. Step up authentication may be required for setup requests or deposit instructions. Client agreements may be considered to be reviewed and amended where the control framework requires it.7 Where the risks cannot be adequately mitigated, firms may consider to adopt alternative deposit channels. The circular identifies standard eDDA and bank transfers as alternatives.
Disclosure and reminders to clients
Firms may consider to disclose eDDA settings to clients and obtain consent to those settings. Settings include transaction limits, frequency limits and expiry dates. Clients may also consider to be reminded to review the bank accounts registered for eDDA Deposits. Clients may also monitor their bank transactions and report irregularities without delay. Reports may be made to the firm, the bank or the Hong Kong Police Force.
.
Footnotes
- Securities and Futures Commission, Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities: Mitigating risks in receiving deposits through simplified eDDA arrangements, 20 August 2026, reference SFO/IS/033/2026.
- Hong Kong Interbank Clearing Limited, Faster Payment System, Electronic Direct Debit Authorisation service.
- Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission, paragraph 4.3; Guidelines for Virtual Asset Trading Platform Operators, paragraph 11.10.
- Circular of 20 August 2026, footnotes 5 and 6.
- Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers), Chapters 5 and 7.
- Code of Conduct, paragraph 12.5; Guidelines for Virtual Asset Trading Platform Operators, paragraph 16.7.
- Circular of 20 August 2026, footnote 9.
