Hong Kong SFC Cyber Security Requirements Explained

Hong Kong brokers and asset managers do not answer to one cyber rulebook from the Securities and Futures Commission: they answer to a 2017 guideline, a 2019 cloud storage circular and a run of circulars from 2025 and 2026 that keep raising the bar. The SFC regulates licensed corporations and virtual asset trading platforms, and its cyber expectations sit in guidelines and circulars rather than in a single statute. This guide sets out what each instrument requires, the deadlines that are still running (including the move away from one-time passwords by 8 July 2027), how the SFC supervises and enforces, and where service accounts, keys and AI tools fit. It is written for MICs of IT, compliance officers, CISOs and engineers at SFC-licensed firms and their technology providers. Banks are supervised by the HKMA and are covered in the HKMA Cyber Resilience Assessment Framework Guide, which this page does not repeat.

Status line: sources checked on 14 November 2026 against sfc.hk, the SFC e-Distribution circular archive and the Hong Kong Government news archive. Circulars are added often, so check the SFC circulars page before relying on a deadline.

Key takeaways

The 2017 internet trading guidelines are the baseline. Twenty baseline controls apply to firms trading online under regulated activity Types 1, 2, 3 and 9, with two-factor login in force since 27 April 2018 and the rest since 27 July 2018.
One-time passwords are being retired. Circular 26EC35 of 9 July 2026 says the SFC does not treat OTP as phishing resistant and requires passkeys or bound devices for login and device binding no later than 8 July 2027, immediately for large internet brokers.
Cloud record keeping needs SFC approval. The October 2019 circular on external electronic data storage requires section 130 approval, two Hong Kong based Managers-In-Charge who hold the keys, and a full read-only audit trail.
AI-enabled attacks changed the 2026 baseline. Circular 26EC32 of 2 June 2026 asks for an asset inventory good enough for same-day containment decisions, zero trust design, maker-checker for high-impact actions and prompt reporting of material incidents.
Accountability is personal. The MIC of IT carries ultimate responsibility for cyber risk, and the SFC says it may hold firms accountable for client losses where large-scale unauthorised trading is not prevented, detected or stopped.

The instruments at a glance

The SFC's requirements are cumulative: each circular builds on the 2017 guidelines rather than replacing them.

Instrument	Date	Who it covers	What it adds
Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading	Issued 27 October 2017; 2FA from 27 April 2018, other items from 27 July 2018	Licensed or registered persons carrying on internet trading (Types 1, 2, 3 and 9)	20 baseline controls in three sections: client account protection, infrastructure security, governance
Circular on use of external electronic data storage (19EC59)	31 October 2019; existing arrangements to file by 30 June 2020	Licensed corporations keeping regulatory records with cloud or data centre providers	Section 130 SFO approval, MIC key custody, audit trail, exit and due diligence duties
Cybersecurity review of licensed corporations (25EC7)	6 February 2025	All licensed corporations, especially internet brokers	Review findings and expected measures (a) to (f); encouragement to stop SMS OTP
Circular on preventing unauthorised trading (25EC33)	6 June 2025	Licensed corporations	SMS Sender Registration, suspicious transaction reports, client outreach after phishing
Enhanced cybersecurity measures for AI-enabled cyberattacks (26EC32)	2 June 2026	Licensed corporations, SFC-licensed virtual asset trading platforms and associated entities	Inventory, patching, zero trust, third party, incident response and AI model risk
Robust authentication and monitoring (26EC35)	9 July 2026; authentication deadline 8 July 2027	Internet brokers and SFC-licensed virtual asset service providers	Passkeys or bound devices, device limits, session timeout, immediate incident reporting

Paragraph 4 of the 2017 guidelines says they do not have the force of law, but a failure to follow their spirit may reflect on a firm's fitness and properness. Paragraph 5 calls them minimum standards. That is the lever: licensing consequences, not a fine schedule written into the guidelines.

Internet trading guidelines: the 20 baseline controls in practice

The FAQ the SFC published alongside the guidelines answers most interpretation questions. The table pairs each section with what supervisors look for.

Para	Requirement	Interpretation and evidence
1.1	Two-factor authentication for client login	Principle based; dual passwords count as one factor and do not qualify (FAQ Q2). Now tightened by 26EC35.
1.2	Monitoring and surveillance for unauthorised access	FAQ examples: one IP address logging in to many client accounts; one account accessed from different countries in a short time.
1.3	Prompt client notification of login, password reset, trade execution, third party fund transfers and changes to client details	Sent through a channel different from the login channel; clients may opt out of trade alerts only, after risk disclosure and signed acknowledgement. Login alerts may be dropped only under the three FAQ Q4 conditions.
1.4	Strong encryption of credentials and trade data in transit, and of stored login passwords	The FAQ treats the DMZ as part of the internal network.
1.5 to 1.6	System-generated passwords, delivered without human intervention; password length, complexity, history, lockout and session timeout	Remind clients who have not changed passwords for more than 90 calendar days (FAQ Q6); lockout, exponential back-off or brute-force detection (FAQ Q7).
2.1 to 2.3	DMZ and multi-tier firewalls; need-to-have access with at least annual review of critical systems and databases; restricted remote access	Access review records, firewall rule reviews, remote access approvals.
2.4	Patch evaluation and testing, implementation within one month of completing testing	Restated in 25EC7 measure (b).
2.5 to 2.7	Anti-malware on servers and workstations, no unauthorised hardware or software, physical security	Endpoint coverage reports, allow-listing evidence.
2.8 to 2.9	Daily backup to offline media; roll-back for major changes; contingency plans covering DDoS and ransomware	Offline includes a remote backup server securely segregated from production (FAQ Q8).
2.10	Formal service level agreements with third party providers	Reviewed regularly, quantitative where possible.
3.1 to 3.4	Responsible officer defines the cyber risk framework; written incident escalation and reporting procedures; annual staff training; client reminders	Board or responsible officer approvals, written delegations, training records.

From OTP to passkeys: circular 26EC35

The SFC first encouraged firms to stop using SMS OTP in February 2025. In July 2026 it made the change mandatory for internet brokers and virtual asset service providers, after phishing accounted for 57% of incidents reported to HKCERT in 2025, according to the SFC's announcement.

Scope of the control (para 5): robust authentication applies to client login and to device registration and binding. Existing clients do not have to rebind devices already bound.
What qualifies (paras 7 to 9): OTP is not accepted for these steps. Passkeys and bound devices are the examples given, and either can satisfy the "what the client has" factor.
Device limits (para 10): generally no more than three passkeys and/or three devices per account, with requests above that assessed before approval.
Sessions (para 11): clients must not be able to disable session timeout; idle timeout is limited (30 minutes is the example), and longer periods need close monitoring of login, logout and trading records.
Alerts (para 13): notify clients of successful logins and high-risk events such as new-device logins, new bindings and passkey creation or revocation.
Monitoring (para 16): transaction monitoring with thresholds and red flags, plus login and device-binding monitoring backed by adequate logs.
Response and reporting (paras 17 to 18): halt unauthorised activity, protect client assets, notify affected clients and report hacking incidents to the SFC immediately, followed by root cause analysis.

Timing (para 21): notification, monitoring and response improvements immediately; client awareness as soon as practicable; robust authentication as soon as practicable and no later than 8 July 2027, immediately for large internet brokers. A firm that cannot meet a deadline must tell its case officer immediately (para 23). For the authentication design itself, see the Passwordless and Passkeys Guide and the Phishing-Resistant MFA Guide.

Decision guidance: passkeys or device binding

Factor	Passkeys	Bound device
Phishing resistance	Credential works only with the site or app it was registered for, as the circular notes	Depends on how securely device attributes are enrolled and checked
Best fit	Web platforms and mixed device estates	Mobile-first brokers with their own app
Hard part	Recovery when a client loses all passkeys; synced passkey policies	Rebinding flow, which attackers target with social engineering
Controls the SFC names	Three-passkey limit, creation and revocation alerts	Three-device limit, new-binding alerts

Whichever method is chosen, the recovery and rebinding path decides real resistance. If recovery falls back to SMS OTP, the attacker phishes the recovery instead of the login. Treat recovery as a high-risk event under para 13 and consider the client confirmation step that para 15 strongly encourages.

Cloud and external data storage: the 2019 circular

A licensed corporation that keeps regulatory records only with an external electronic data storage provider (EDSP), such as a public cloud, needs prior written approval of the premises under section 130 of the Securities and Futures Ordinance. The duties are unusually specific and most of them are identity controls.

Requirement	Circular paragraph	What to build
Hong Kong EDSP, or undertaking from a non-Hong Kong EDSP using the Appendix 1 template	7(a), 7(b)	Contract file with the signed undertaking submitted with the application
Records available to the SFC on demand, reproducible from approved Hong Kong premises	7(d), 7(f)	Tested retrieval runbook; access unaffected by where hardware sits
Detailed read-only audit trail of every read, write and modify, uniquely identifying each user	7(e), footnote 11	Retained for the record retention period with timestamp, file, event type, user ID and user location
At least two Managers-In-Charge in Hong Kong with access to all records	7(g)	MICs (or delegates) hold all digital certificates, keys, passwords and tokens
Encryption keys accessible to the SFC on demand	14	Key management design that does not lock the regulator out
User access controls, public cloud responsibility split, contingency and exit plans, concentration risk	15, 17, 19, 20, 22	Shared responsibility matrix, exit runbook, provider concentration review
30 calendar days' notice before terminating, novating or assigning the service agreement	10	Contract change control that triggers the SFC notice

Sections C and D of the circular do not apply where a full identical set of records is also kept at approved Hong Kong premises (para 6), but section E (due diligence, governance, access control, exit) applies either way. For a cross-regulator view, see the Financial Cloud Outsourcing Rules Map.

The 2025 and 2026 review circulars

What the SFC found (25EC7)

The February 2025 circular reported eight material cyber incidents at licensed corporations between 2021 and 2024, including two ransomware attacks that disrupted all IT systems and a vendor network compromise that interrupted back-office services. Recurring gaps were two-factor authentication, server and firewall configuration, patching delays, encryption, admin access and missing audit trails. Expected measures were network intrusion prevention with unnecessary ports disabled, patching within one month of testing, encryption at rest and in transit, few and monitored admin accounts, retained and reviewed logs, and client account monitoring for red flags such as many accounts sharing one phone number. Large internet brokers are strongly advised to run at least annual technical reviews endorsed by the MIC of Overall Management Oversight and the MIC of IT.

AI-enabled attacks (26EC32)

Inventory (para 6): an accurate inventory of hardware, software, networks, databases and cloud services, flagging externally exposed, business-critical and third-party-dependent assets, good enough for same-day prioritisation and containment.
Patching (para 9): out-of-cycle policy for urgent fixes and resources for patching surges. See the Patch Management Guide.
Access (paras 10 to 11): assume any user, device, privileged account or network component may be compromised; least privilege, protected privileged accounts, micro-segmentation, external inputs treated as adversarial, and maker-checker for high-impact actions.
Third parties (para 13): initial and ongoing assessment of providers supporting critical operations.
Response (paras 14 to 18): pre-planned containment, regular tabletop or simulated attack testing, at least daily backups for electronic trading firms and platforms (footnote 8), and prompt notification of material incidents under Code of Conduct paragraph 12.5(e) or the VATP guidelines.
AI language models (para 8): adversarial attacks, data leakage and system prompt override belong in the cyber framework, and high-risk AI use cases carry notification duties under paragraph 30 of the SFC's 12 November 2024 circular on generative AI.

The June 2025 circular (25EC33) added practical anti-phishing steps after lookalike-site attacks: register for the SMS Sender Registration Scheme, report suspicious transactions to the Joint Financial Intelligence Unit and run client outreach.

Where service accounts, keys and AI agents fit

None of the SFC texts says "non-human identity", but several obligations cannot be met without governing them.

Key and token custody: the EDSP circular puts every certificate, key, password and token for record storage with the two MICs or their delegates. Cloud root accounts, KMS administrators and backup service credentials are in that set. See the Service Account Security Guide.
Admin and privileged access: 25EC7 measure (d) and 26EC32 para 11 apply to automation accounts that can change trading or client data, not only to people. See the Privileged Access Management Guide.
Audit trail attribution: footnote 11 requires each user to be uniquely identified. Shared integration accounts break that requirement.
Maker-checker: an AI agent or script that can amend client particulars or move funds is a "high-impact action" path, and the 26EC32 instruction that external inputs must not alter system instructions applies directly to agents reading emails or documents.
Inventory: same-day containment needs to know which API keys reach which systems and providers.

Supervision and enforcement

The guidelines and circulars are supervisory instruments. Non-compliance is assessed through fitness and properness, on-site inspections and thematic reviews, and the SFC can use its wider disciplinary powers against licensed corporations and responsible officers. Two newer signals matter. First, 26EC35 para 25 says the SFC may hold firms accountable for client losses if large-scale unauthorised transactions are not prevented, detected or stopped. Second, senior management responsibility is named: the MIC of Overall Management Oversight and the MIC of IT for 26EC35, and the MIC of IT as ultimately responsible in 26EC32. For banks registered with the SFC, the HKMA issued a parallel circular in 2017 asking registered institutions to align internet trading security with the guidelines.

Detection and measurement

Authentication migration: percentage of active clients on passkeys or bound devices, tracked monthly against the 8 July 2027 deadline.
Alert coverage: share of para 13 high-risk events (new device, new binding, passkey change) that produced a client notification within minutes.
Patch latency: days from test completion to deployment, against the one-month rule, with out-of-cycle fixes measured separately.
Privileged account count: human and machine admin accounts on trading and back-office systems, trending down.
Audit trail completeness: percentage of EDSP access events with all footnote 11 fields and a unique user.
Incident clock: time from detection of a hacking incident to SFC notification.

Common failure patterns

Recovery by SMS: passkeys at login but SMS OTP for device rebinding or recovery, which leaves the phishing path open.
Login alerts on the login channel: sending notifications inside the app the attacker has just entered, contrary to para 1.3.
Keys outside Hong Kong control: cloud keys administered only by a regional team, so the two MICs cannot meet para 7(g).
Shared admin and integration accounts: audit trails that cannot name a user, a finding the SFC raised in 25EC7.
End-of-life systems and unpatched VPNs: named in 25EC7 as possible contributors to the reported attacks.
Untested contingency for vendor outage: one firm in the 2025 review lacked a plan when its vendor's network was compromised.

Framework mapping

SFC requirement	NIST CSF 2.0	ISO/IEC 27001:2022 Annex A
MIC accountability, responsible officer framework	GV.RR-01	5.2, 5.4
Inventory for same-day containment	ID.AM-01	5.9
2FA, passkeys, device binding	PR.AA-03	8.5
Least privilege, admin restriction, annual review	PR.AA-05	5.15, 5.18, 8.2
Daily offline backup	PR.DS-11	8.13
Login and transaction monitoring	DE.CM-01	8.16
Provider SLAs, EDSP undertakings	GV.SC-05	5.20, 5.23
Client and SFC incident notification	RS.CO-02	5.24, 5.26

Implementation plan

Map your instruments. Record which circulars apply by licence type, whether you are a large internet broker, and whether any records sit only with an EDSP.
Act on the immediate items. Under 26EC35 para 21(a), upgrade notifications, monitoring and incident reporting now; write the SFC reporting step into the incident runbook.
Build the inventory. Include cloud services, third party connections and machine credentials, tagged by exposure and criticality.
Pilot robust authentication. Roll out passkeys or binding to staff and a client pilot group, keep OTP only as a time-limited fallback with extra monitoring, and set a rollback trigger (for example, failed login rate above an agreed threshold).
Fix recovery and rebinding. Apply the three-device limit, alerts and client confirmation before production rollout.
Close EDSP gaps. Confirm approvals, MIC key custody, undertakings and the audit trail fields.
Test and evidence. Run a ransomware and vendor-outage tabletop, restore from offline backup, and file the results for the MIC of IT.

Practitioner checklist

List every SFC circular that applies to the firm and its owner.
Set a dated plan to replace OTP for login and binding before 8 July 2027.
Send login and high-risk alerts on a channel separate from login.
Cap passkeys and bound devices at three per account and review exceptions.
Confirm section 130 approval and two Hong Kong MICs for any EDSP-only records.
Remove shared admin and integration accounts from trading and record systems.
Deploy patches within one month of testing and track out-of-cycle fixes.
Back up daily to segregated offline storage and test restores.
Add AI model risks and agent permissions to the cyber framework.
Rehearse reporting a hacking incident to the SFC immediately.

Standards and references

Related NHI Mgmt Group resources: HKMA Cyber Resilience Assessment Framework Guide · Financial Services Cyber Regulation Map · Account Takeover Prevention Guide · Hong Kong PDPO Guide. This guide summarises the Hong Kong SFC's cyber security requirements for licensed corporations and is not legal advice.

Hong Kong SFC Cyber Security Requirements: internet trading, cloud storage and phishing rules