By the APAC Compliance Lead, UWAY Innovation. Program-level guidance; operational, not legal advice.

A Hong Kong futures broker had a detection function built in. It switched the function off. The SFC later counted 176 same-second buy/sell orders the firm never saw.

Another AML fine, another promise to do better. This one has a catch.

Then read the SFC's file on Zheng Da International Financial Holding Limited, published 29 September 2026. Reprimand, HK$7 million fine, and seven months off the licence of its responsible officer and manager-in-charge, Zhong Hao, from 28 September 2026 to 27 April 2027 (SFC, 29 September 2026).

One line in that file carries the case. The platform already had a function for spotting same-second buy/sell orders from its clients. The firm switched it off, because it got in the way of normal client trading.

Working an alert belongs to a longer piece: what happens to an alert once it fires. What follows is the post-mortem. Here the question sits a step earlier: did the control run?

What the Firm Actually Did

For twenty-two months, between 1 December 2021 and 30 September 2023, Zheng Da let 160 clients run their own trading systems through the firm's broker supplied system. Those clients placed 10,444,295 futures trades in that window.

No guidelines or procedures governed due diligence on those systems. None covered testing. Its application files didn't record the design or functionality. It said it made enquiries about those systems. Only its word supports them.

Zheng Da told the SFC that its BSS provider handled due diligence, testing and monitoring of the client systems. The service agreement between them carried no such provisions. The provider said it had done no due diligence on the client systems at all.

The firm certified a system into its own stack and never ran a test on it.

The Function That Was Switched Off

Inside the eight accounts the SFC sampled, it found 176 instances where one client placed a buy and a sell order for the same futures contract, at the same price, in the same second.

None of that reached the firm at the time. Zheng Da worked out the 176 by hand during the SFC investigation, and told the regulator it hadn't known the orders were there.

Coverage was uneven. Orders on the Chicago Mercantile Exchange and other CME Group venues ran through a self-matching prevention function. Everywhere else, nothing would spot a same-second pair.

Then the firm's own words:

Zheng Da stated that its BSS had an inherent function to detect same-second buy/sell orders being executed by its clients, but it disabled the function as it interfered with normal client trading.

That finding is narrower than the hook. The file describes matching buy and sell orders placed by one client inside a single second, and makes no finding that any became an executed match. The AML guideline lists same-second buy/sell orders as a suspicious indicator: matching orders "creating the illusion of active trading" (SFC, Statement of Disciplinary Action).

A control that exists and doesn't run is where the SFC's finding lands. Who was supposed to notice?

The Enquiries With No Records

The eight sampled accounts held deposits that sat nowhere near what the holders had declared.

Among those eight, one client had told the firm he was a senior analyst at a global investigations company, earning over HK$1 million a year with a net worth of HK$5 million to HK$10 million. Across six months he made 439 deposits into his account, about HK$28 million in total, arriving from 22 different bank accounts. Another of the eight declared income below HK$200,000 and deposited roughly HK$37.5 million in ten months.

Zheng Da said its responsible officer phoned clients at random each month, and reached the five highest-volume clients by WeChat voice call. The SFC found no records behind any of it. No supporting documents either.

In the absence of any records of enquiries, Zheng Da failed to demonstrate that it had conducted proper enquiries on the deposits of the Selected Clients' accounts...

The charge was the inability to demonstrate. That is the shift from holding a licence to showing a control works.

The Eleventh Case

Hong Kong's SFC treated the history as an aggravating factor. Between 1 December 2021 and 8 August 2025 it issued press releases about similar failures at other licensed corporations. Zheng Da stopped taking new client system applications, and disabled the systems already running, only in August 2025.

Footnote 8 lists the earlier actions. Ten of them, from Grand International Futures in December 2021 through Zhonghui, South China Commodities, Rifa, Jinrui, City International, Lion Futures, CSC Futures and Xinhu International, to Freeman Commodities in July 2025. The SFC's own wording is failures similar to those identified in the present case.

Count this one in and the SFC has taken eleven enforcement actions in five years over failures it describes as similar. How other APAC regulators frame that same duty is set out in where each regulator places the duty.

The regulator published the precedent ten times. The failure repeated anyway.

What This Means for Your File

Move the question onto the platform. Three things a supervisor can ask for.

What testing did you run when you let someone else's system into your stack? What records do you have of the enquiries into deposits that didn't fit the declared profile? What did your own systems last detect without being told to look?

The demand isn't confined to securities. The HKMA updated its politically exposed persons guidance in August 2026 and said it would run thematic examinations later in the year "to test how effectively these have been implemented" (HKMA, 28 August 2026).

Building a monitoring trail a supervisor can follow from alert to decision is what most teams still owe their file. A control you can describe but can't evidence is a liability with a policy number attached.

What the decision leaves open runs wider than the headline suggests. It makes no finding that any client laundered money, and it doesn't split the HK$7 million across the three failures, so nobody can price the missing test, the missing records or the disabled function. Nor does it say whether the function, if left on, would have caught the 176 orders. What the firm did say is narrower: it admitted it could not tell whether those orders were matched trades without confirmations from the relevant exchanges.