Can a Single Mandate Protect Corporate Cash? The Control Risks Behind Simplified eDDA

First define who the circular applies to

The SFC circular dated August 20, 2026 applies to licensed corporations, SFC-licensed virtual asset trading platforms and related regulated entities. It is not a general payment rule for every Hong Kong company. Simplified eDDA can allow a client to fund a trading account from a bank account in the same name under a pre-authorised mandate initiated by the recipient; the paying bank may not seek the account holder's confirmation each time.

The risk therefore concerns not only whether a transaction succeeds, but who was authorised to establish the instruction and who bears an unauthorised transaction. Under some arrangements, the regulated firm may also confirm the mandate to the receiving bank and provide an indemnity.

Minimum controls require more than a screenshot

The circular requires firms to understand how partner and paying banks confirm mandates, the contractual indemnities involved, and the firm's own capacity to bear them. If the paying bank does not confirm, or confirmation cannot be verified, the client should first make a small transfer from the designated account and the firm should verify the account holder's name using the bank deposit record—not only a record supplied by the client.

Identity details must also match client records. Any discrepancy requires additional identity information and verification.

Signals that warrant greater scrutiny

Regulatory warning signs include repeated mandate or deposit failures in a short period; frequent or large deposits without an evident purpose; activity inconsistent with the client's previous pattern; a new eDDA mandate appearing alongside a new wallet whitelist; and funds being converted into virtual assets and withdrawn rapidly.

Depending on the risk, a firm may reject the mandate, delay a deposit or require further verification, and consider reporting to the Joint Financial Intelligence Unit or the Anti-Deception Coordination Centre. Additional controls can include amount and frequency limits, waiting periods and stronger authentication.

What ordinary companies can learn

Even when a company is outside the circular's direct scope, the control principles are useful: a successful login should not be the only evidence of payment authority; creating a payee instruction, increasing a limit and changing a whitelist should involve segregation of duties; every exception should record its reason, approver and time; and high-risk processes should have reversible limits and cooling-off periods.

This is a risk-management interpretation, not a statement that the circular imposes legal duties on ordinary companies.

G70 perspective: speed is not a substitute for control

Payment risk in family enterprises often concentrates around a small number of managers, urgent transfers and cross-border processes. The central question is not whether eDDA is used, but whether the powers to establish, approve and verify an instruction rest with the same person—and whether an anomaly can be stopped before funds leave.

Important notice

This article is for general information and education only and does not constitute legal, compliance or operational advice. Institutions should obtain professional advice based on their licences, banking agreements and risk appetite.