Two securities firms received regulatory penalty notices on the same day due to issues related to brokerage business controls, account real-name verification, and information security.

On the evening of September 24, Guosheng Securities and Xiangcai Co., Ltd. separately issued announcements disclosing the latest progress of prior regulatory investigations. Guosheng Securities, Xiangcai Securities, and multiple responsible individuals received advance notices of administrative penalties and administrative regulatory measures from regulators.

The violations of the two brokers overlap significantly. Both are proposed to be ordered to rectify and suspended from opening new securities accounts for 3 months, during which they may not add new brokerage business clients. Multiple former senior executives, department heads, and branch heads are also being held accountable simultaneously.

Three Major Issues Highly Overlapping

Previously, Guosheng Securities and Xiangcai Securities, a subsidiary of Xiangcai Co., Ltd., were both investigated by the China Securities Regulatory Commission on July 31 this year on suspicion of violating the Securities Brokerage Business Management Measures regarding account real-name verification and other provisions.

On the evening of September 24, an announcement from Guosheng Securities showed that the company and relevant parties received several advance notices from the Jiangxi Securities Regulatory Bureau, including an Administrative Penalty Advance Notice, an order to rectify, a regulatory talk, and a determination as an inappropriate candidate.

According to the investigation, Guosheng Securities had problems in three areas. First, there were major deficiencies in brokerage business controls, including gaps in relevant brokerage service management measures, inadequate implementation of brokerage business control systems, and improper provision of relevant information technology services. Second, there were major faults in implementing account real-name verification, as the company failed to effectively fulfill responsibilities for real-name account use and abnormal transaction management during abnormal transaction verification. Third, there were serious violations of information security regulations, with related risks potentially having a relatively large impact on the stable operation of network and information security in the securities and futures industry, and the company failed to fulfill reporting obligations as required.

For these three acts, the Jiangxi Securities Regulatory Bureau proposed giving Guosheng Securities a warning and a fine of 290,000 yuan, while also proposing administrative regulatory measures including ordering rectification, suspending new securities account openings for 3 months, and ordering punishment of relevant responsible persons. During the suspension period, the company may not add new brokerage business clients.

On the same day, Xiangcai Securities received an Administrative Penalty Advance Notice and advance notices of regulatory measures including suspension of new account openings from the Hunan Securities Regulatory Bureau. Its illegal facts are highly similar to those of Guosheng Securities: major deficiencies in brokerage business controls, omissions in relevant business rules, conducting brokerage business in violation of its own business rules, and improper provision of information technology services; major faults in implementing account real-name verification and inadequate performance of duties in abnormal transaction verification; and serious violations of information security regulations, with hidden dangers affecting industry network security and failure to report as required.

In addition, Xiangcai Securities also had problems with inadequate management of employee integrity in practice.

Penalties Applied to Both Institutions and Individuals

It is worth noting that this round of penalties continues the regulatory orientation of the "dual punishment system," holding both institutions and responsible persons accountable at the same time.

In the penalty notice for Guosheng Securities, 6 responsible persons were proposed to be fined a total of 810,000 yuan. Among them, Kuang Moubang, head of the Ningbo Sangtian Road business department, and Wu Mou, head of the Zhejiang branch, were each proposed to be fined 180,000 yuan; Lu Mouran, then general manager of the Information Technology Headquarters, was proposed to be fined 170,000 yuan; Liu Mouning, then vice president in charge of the Brokerage Business Management Department and the Wealth Management Department, and Lu Mou, then head of the Wealth Management Department, were each proposed to be fined 100,000 yuan; and Zhou Moulai, then head of the Brokerage Business Management Department, was proposed to be fined 80,000 yuan.

In addition, Zhang Mousheng, then the senior executive in charge of the Brokerage Business Management Department and the Wealth Management Department, was proposed to be subject to a regulatory talk measure. Beyond economic penalties, accountability for qualification for office was also implemented simultaneously. The Jiangxi Securities Regulatory Bureau proposed determining Lu Mouran as an inappropriate candidate, prohibiting him from serving as a director, senior manager, or head of a branch of a securities company for 1 year from the date the regulatory measure decision is made.

As for Xiangcai Securities, the company was warned and proposed to be fined 290,000 yuan, while 5 responsible persons were proposed to be fined a total of 960,000 yuan. Based on this calculation, the fines for the company and responsible persons total 1.25 million yuan. Among them, Zhou Moufeng, then vice president and president in charge of brokerage business, and Liang Mou, then head of a business department, were each proposed to be fined 200,000 yuan; Ding Mou, then chief information officer, and Deng Mou, then general manager of the Information Technology Center, were each proposed to be fined 190,000 yuan; and Qiu Mouqiang, then vice president in charge of brokerage business, was proposed to be fined 180,000 yuan.

At the same time, the Hunan Securities Regulatory Bureau proposed taking regulatory measures against Xiangcai Securities, including ordering rectification, suspending new securities account openings for 3 months, and ordering punishment of relevant responsible persons.

Information Security Regulation Continues to Intensify

Analysts believe that for the securities industry, the signal significance of these two penalty notices is that regulators are stepping up "look-through" verification of front-line compliance in brokerage business, especially account real-name verification and information system access. The penalties fall not only on institutions, but also directly on executives in charge, branch heads, and even chief information officers personally.

Information security is also a prominent keyword in this round of penalties. Both brokers were held accountable because information security risks could affect the stable operation of industry network and information security and because they failed to report as required, with chief information officers and information technology heads punished as well.

As the digital transformation of the securities industry accelerates, compliance risks in areas such as information technology outsourcing, system operation and maintenance, and data security continue to become more prominent, and information security is rising from a technical issue to an important topic in compliance management.

It is worth noting that information security-related rules are continuing to tighten. The Network and Information Security Management Measures for the Securities and Futures Industry, which took effect in May 2023, focuses on the field of network and information security, takes security protection as the basic principle, and sets regulatory requirements for network and information security management. In July this year, the People's Bank of China, the National Financial Regulatory Administration, the China Securities Regulatory Commission, and the State Administration of Foreign Exchange jointly drafted the Financial Industry Cybersecurity Management Measures (Draft for Comment), further strengthening financial institutions' primary responsibility for cybersecurity.

In response, both brokers said in their announcements that their current operations are normal and that they will deeply reflect and seriously rectify the issues. Guosheng Securities said that, based on the findings in the notice, this penalty does not trigger the major illegal mandatory delisting circumstances stipulated in the Shenzhen Stock Exchange's stock listing rules, nor does it trigger other risk warnings. Xiangcai Co., Ltd. also said it does not trigger other risk warnings or major illegal mandatory delisting circumstances stipulated by the Shanghai Stock Exchange. The final results shall be subject to the formal decision letters issued by the regulatory authorities.