pc
nid 92915
Jun 03, 2026
pthandapani@vixio.com
Hong Kong
News - Securities and Futures Commission
financial services
100% of draft length
draft in Generated
Generated
2269 charsHong Kong Securities and Futures Commission Urges Licensed Firms to Strengthen Cybersecurity Against AI-Enabled Threats
On June 2, 2026, the Securities and Futures Commission (SFC) issued a circular urging licensed firms to strengthen their cybersecurity measures against emerging threats enabled by frontier artificial intelligence (AI) models. The circular follows a significant increase in cyberattack incidents in Hong Kong, which recorded a 27 percent rise to 15,877 incidents in 2025 from 12,536 in 2024, according to data from the Hong Kong Computer Emergency Response Team Coordination Centre.
The SFC warned that fast-advancing frontier AI models have the potential to enable more frequent, targeted and sophisticated cyberattacks, which could result in significant operational disruptions and risks for licensed firms, their staff and clients. Recent advancements in AI have made it easier for malicious actors to identify and exploit system vulnerabilities at a faster pace, coordinate attacks across multiple interconnected systems and orchestrate large-scale attacks. The proliferation of AI-enabled tools has lowered barriers for engaging in phishing, social engineering, deepfake impersonation and reconnaissance activities.
The SFC urged licensed firms, especially internet brokers and virtual asset trading platforms, to implement robust and up-to-date measures to protect their systems, prevent confidential client information from unauthorised access or disclosure, and safeguard client assets against misappropriation. The circular sets out areas for licensed firms to review and enhance their cybersecurity frameworks, including patching and vulnerability management, detection and monitoring measures, and incident response and recovery procedures. Dr Eric Yip, the SFC's Executive Director of Intermediaries, said senior management of licensed firms should shoulder primary responsibilities in gatekeeping firms' cyber resilience and the security of client assets.
The SFC will continue to engage with the industry, technology service providers and local and overseas regulators on this issue. The SFC will organise webinars to raise industry awareness, conduct thematic reviews to assess licensed firms' preparedness and resilience in responding to cybersecurity incidents and attacks, and take appropriate supervisory action in response to these evolving risks.
Agent draft
Not run yet.
Published
2267 charsHong Kong Securities and Futures Commission Urges Licensed Firms to Strengthen Cybersecurity Against AI-Enabled Threats
The Securities and Futures Commission (SFC) of Hong Kong has issued a circular to licensed corporations (LCs), SFC-licensed virtual asset service providers (VATPs), and associated entities regarding enhanced cybersecurity measures to address evolving risks arising from artificial intelligence (AI)-enabled cyberattacks.
The circular prescribes:
Preparedness and accountability mandating that licensed firms assess their preparedness for AI-enabled cyberattacks and address existing system vulnerabilities. The SFC emphasizes that senior management, particularly the Manager-in-Charge of Information Technology (MIC-IT), is ultimately responsible for managing the firm's cybersecurity risks and ensuring that enhancements are implemented properly and promptly.
Patching and vulnerability management requiring firms to enhance and expedite their patch management processes to minimize the window of exposure, given that AI tools can rapidly identify new vulnerabilities. Firms are advised to accelerate the remediation of known vulnerabilities—such as decommissioning legacy systems and replacing unsupported software—and to prioritize patching using a risk-based approach.
Incident response and contingency planning advising firms to update their incident handling procedures to clearly define roles, responsibilities, and escalation protocols across all relevant teams (including IT, risk management, and compliance). Firms should also establish pre-authorized containment actions to effectively counter the rapid speed at which AI-assisted attacks can unfold.
System and network defenses instructing firms to enhance firewalls and implement micro network segmentation where feasible to limit the lateral movement of threats across networks. Furthermore, firms must treat all external and untrusted inputs as potentially adversarial to prevent them from directly altering system instructions or triggering privileged actions.
The SFC notes that these comprehensive measures are particularly expected of LCs engaged in electronic trading, large retail brokers, depositaries of SFC-authorized collective investment schemes (Type 13), and VATPs, while other licensed firms should apply them based on the nature, scale, and complexity of their specific operations.