AI Regulation Tracker / Guidance

Hong Kong's SFC Orders Licensed Firms to Harden Cybersecurity Against AI-Enabled Attacks

Regulatory summary: The Securities and Futures Commission issued a circular on 2 June 2026 telling licensed corporations, virtual asset service providers and associated entities to review and strengthen their cybersecurity frameworks against frontier-AI threats, and it holds senior management and the Manager-in-Charge of IT primarily responsible.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

Hong Kong's SFC Orders Licensed Firms to Harden Cybersecurity Against AI-Enabled Attacks regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

The SFC moved cybersecurity expectations to explicitly cover frontier-AI-enabled attack techniques. It tells firms to reassess frameworks against threats that were previously theoretical: AI systems that autonomously discover zero-day vulnerabilities, chain multiple lower-risk flaws, orchestrate attacks across interconnected systems, and generate convincing phishing, social-engineering and deepfake impersonation at low cost and high speed. The circular ties these threats to concrete control domains and to named lines of accountability.
Chief information security officers, Managers-in-Charge of IT, and senior management at SFC-licensed brokers, asset managers, depositaries and virtual asset platforms; compliance and risk officers responsible for internal controls; and technology vendors and outsourced service providers whose systems sit inside a licensed firm's attack surface.
Status: Issued and in effect.
Convene senior management and the Manager-in-Charge of IT to run a gap review against the circular's appendix, prioritize patching, detection and incident-response upgrades for AI-enabled threats, and record the review and any framework changes for supervisory inspection.

Regulatory Briefing

Bindingness: SFC circular, in effect from issuance. A circular is a supervisory communication that sets out the SFC's expectations under its existing conduct and internal-control requirements. It does not create new primary legislation, but licensed firms are expected to comply, and failure to maintain adequate cybersecurity can expose a firm and its responsible officers to supervisory and disciplinary action. Certain firm categories are expected to implement every control in the appendix.
Scope: Licensed corporations, SFC-licensed virtual asset trading platforms and their associated entities in Hong Kong. The circular applies across the licensed population, with heightened expectations for three categories: licensed corporations engaged in electronic trading (particularly large retail brokers), depositaries of SFC-authorized collective investment schemes (Type 13 licensed firms), and virtual asset trading platforms.
What Changed: The SFC moved cybersecurity expectations to explicitly cover frontier-AI-enabled attack techniques. It tells firms to reassess frameworks against threats that were previously theoretical: AI systems that autonomously discover zero-day vulnerabilities, chain multiple lower-risk flaws, orchestrate attacks across interconnected systems, and generate convincing phishing, social-engineering and deepfake impersonation at low cost and high speed. The circular ties these threats to concrete control domains and to named lines of accountability.
Who This Affects: Chief information security officers, Managers-in-Charge of IT, and senior management at SFC-licensed brokers, asset managers, depositaries and virtual asset platforms; compliance and risk officers responsible for internal controls; and technology vendors and outsourced service providers whose systems sit inside a licensed firm's attack surface.
Current Status: Issued and in effect. The circular was published on 2 June 2026 and firms are expected to act on it now. It is a standing supervisory expectation rather than a consultation or a proposal.
Effective Date: 2 June 2026, effective on issuance. The circular does not set a future commencement date; the expectation to review and enhance measures applies immediately.
Primary Source: https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/doc?refNo=26PR77
Secondary Analysis: Davis Polk client update (2026), Charltons, Gibson Dunn, RSM Hong Kong and Mayer Brown JSM summarized the circular, the five review areas, the named threats, and the three firm categories expected to implement all appendix controls.
Workflow Impact: Firms will need documented framework reviews covering patch and vulnerability management, threat detection and monitoring, and incident response tuned to AI-enabled attacks, with change approvals routed through the Manager-in-Charge of IT and sign-off from senior management. High-priority categories need to demonstrate the full appendix control set.
Operational Next Step: Convene senior management and the Manager-in-Charge of IT to run a gap review against the circular's appendix, prioritize patching, detection and incident-response upgrades for AI-enabled threats, and record the review and any framework changes for supervisory inspection.
Last Verified: July 10, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	Hong Kong	The SFC moved cybersecurity expectations to explicitly cover frontier-AI-enabled attack techniques. It tells firms to reassess frameworks against threats that were previously theoretical: AI systems that autonomously discover zero-day vulnerabilities, chain multiple lower-risk flaws, orchestrate attacks across interconnected systems, and generate convincing phishing, social-engineering and deepfake impersonation at low cost and high speed. The circular ties these threats to concrete control domains and to named lines of accountability.	Chief information security officers, Managers-in-Charge of IT, and senior management at SFC-licensed brokers, asset managers, depositaries and virtual asset platforms; compliance and risk officers responsible for internal controls; and technology vendors and outsourced service providers whose systems sit inside a licensed firm's attack surface.	Issued and in effect. The circular was published on 2 June 2026 and firms are expected to act on it now. It is a standing supervisory expectation rather than a consultation or a proposal.

Source File

Instrument: Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities on enhanced cybersecurity measures to address evolving risks arising from artificial-intelligence-enabled cyberattacks
Authority: Securities and Futures Commission (SFC), Hong Kong
Date: Issued 2 June 2026; effective on issuance
Citation: SFC Circular ref 26EC32, announced under news reference 26PR77 (2 June 2026)
Primary Source: https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/doc?refNo=26PR77 (circular text at https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/openFile?refNo=26EC32)
Corroboration: Davis Polk, Hong Kong SFC calls for enhanced cybersecurity measures to combat AI-enabled cyberattacks (2026); Charltons, New SFC Requirements for Cybersecurity to Counter AI-enabled Cyber Threats; Gibson Dunn; RSM Hong Kong.

Frequently Asked Questions

Is the SFC AI cybersecurity circular legally binding?

It is a supervisory circular, in effect from 2 June 2026. It does not create new primary legislation, but it sets the SFC's expectations under existing conduct and internal-control requirements, and licensed firms are expected to comply. Inadequate cybersecurity can lead to supervisory and disciplinary consequences.

Who does the circular apply to?

Licensed corporations, SFC-licensed virtual asset trading platforms and their associated entities. Firms in electronic trading (especially large retail brokers), Type 13 depositaries, and virtual asset trading platforms are expected to implement all of the appendix controls.

What AI-enabled threats does it name?

Frontier AI models that autonomously find zero-day vulnerabilities and chain lower-rated flaws into high-impact attacks, attacks orchestrated across interconnected systems, and low-cost AI tools that power phishing, social engineering and deepfake impersonation.

Who is responsible inside a licensed firm?

Senior management holds ultimate responsibility for cybersecurity risk, and the Manager-in-Charge of Information Technology is responsible for ensuring adequate review and approval of changes to the firm's cybersecurity framework.

What is the immediate action?

Run a documented framework review against the circular's appendix, covering patch and vulnerability management, detection and monitoring, and incident response for AI-enabled threats, with change approval through the Manager-in-Charge of IT and senior management sign-off.