SFC Cybersecurity Requirements for Hong Kong Fund Managers

If you run an SFC-licensed asset management firm in Hong Kong, you have probably searched for “the SFC cybersecurity rules” and come away frustrated — because there isn’t one tidy rulebook. The SFC’s expectations are spread across the Code of Conduct, the Fund Manager Code of Conduct, the Manager-In-Charge regime, a handful of circulars, and the supervisory signals buried in its thematic-review reports. This guide pulls them together for the people who actually have to implement them: IT leads, COOs, and the Manager-In-Charge of Information Technology.

This is general information for IT and operations leaders, accurate as at September 2026 — not legal or compliance advice. Verify against the SFC’s current codes, guidelines and circulars (linked throughout) and take professional advice before you act.

Want this tailored to your firm? Pick your licence types (Type 1, 4, 9…) in our interactive SFC Licence Navigator to see exactly which instruments apply, tick off what you already have, and download your own IT maturity assessment.

Does the SFC’s internet-trading cyber guideline apply to you?

The SFC’s most detailed cyber rulebook is the Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading — 20 baseline requirements issued in October 2017 (two-factor authentication for client logins effective 27 April 2018; the rest from 27 July 2018).

Here is the part most fund managers miss: these guidelines are scoped to internet trading. They bite on Type 1, 2 and 3 firms that run client-facing trading facilities — and on Type 9 managers only “to the extent that they distribute funds under their management through their internet-based trading facilities.” If your clients don’t log in to place their own orders, the specific 20 requirements largely don’t apply to you.

That said, they remain the best practical checklist the SFC has published, and supervisors treat them as the de-facto baseline: two-factor authentication, monitoring and surveillance, strong encryption, one-month patch cycles, daily offline backups, contingency planning for ransomware and DDoS, written incident-reporting policies, and annual staff training. Even if you’re not strictly bound, it’s a sensible standard to hold yourself to. If you outsource your IT, this baseline is also what your provider of IT support for financial services firms in Hong Kong should already be working to.

The same scope test decides whether the SFC’s phishing circular of 9 July 2026 (ref 26EC35) applies to you. For internet brokers, including Type 9 managers that distribute funds through their own online platform, it expects phishing-resistant client login, such as passkeys or device binding, by 8 July 2027 (large brokers immediately). It says SMS and email one-time passwords no longer qualify for client login, and it expects firms to alert clients to logins and new devices. It also warns that the SFC will hold a firm accountable for its clients’ losses if it fails to stop large-scale unauthorised trading after a hack.

The rules that bind every Type 9 manager

Whether or not you run a trading portal, several technology-neutral obligations apply to you in full:

• The Code of Conduct. General Principle 3 requires you to have and effectively employ the resources and procedures needed for the proper performance of your business — the hook for adequate IT and security. General Principle 9 puts primary responsibility on senior management. And paragraph 12.5 requires you to report to the SFC immediately on a material breach of the rules or a material failure of your systems. The SFC’s cyber circulars point to it for material cybersecurity incidents.
• The Fund Manager Code of Conduct (FMCC) — now in its Fifth Edition (October 2024) — sets risk-management, operations and record-keeping standards, and expressly supplements the Code of Conduct and the Internal Control Guidelines. It requires adequate policies and procedures to identify, manage and monitor your risks, and to keep proper records. IT and cyber risk are squarely in scope.

None of this prescribes a firewall brand. It does require you to manage technology and information risk competently, and to be able to prove it.

Someone must own it: the Manager-In-Charge regime

Since 2017 the SFC’s Manager-In-Charge of Core Functions (MIC) regime has required licensed firms to designate named senior individuals over eight core functions — one of which is Information Technology. The IT MIC is the person the SFC holds personally accountable for your technology function, and in practice for your cyber posture. If you have not formally appointed one, or the role is a name on a form rather than someone with real authority and the right expertise, that’s a gap to close first.

Where your data lives: the external data-storage rules

This is the rule most cloud-using managers overlook. The SFC’s circular on the use of external electronic data storage (31 October 2019, ref 19EC59) lets you keep regulatory records with external providers — including public and private cloud — but on conditions:

• You must apply to the SFC for approval of the premises (the data centre) under section 130 of the SFO.
• You must designate at least two Managers-In-Charge resident in Hong Kong who can access all regulatory records held with the provider at any time.
• You must obtain a written undertaking from the provider that it will give the SFC access to those records on request — which matters when the data centre sits outside Hong Kong.

If your records live in Microsoft 365, a fund-administration platform, or any SaaS tool, this applies. And if any of that data relates to Mainland China operations, you have a second layer to navigate — see our guide to the data laws in China and Hong Kong.

Remote working and AI: two circulars you can’t ignore

• Remote-office security (29 April 2020, ref 20EC37). Issued after attackers exploited VPN weaknesses at a licensed firm to make unauthorised fund transfers, it expects robust VPNs with strong encryption, two-factor authentication for remote logins, network segmentation, monitoring for unauthorised internal access, videoconferencing security, and staff awareness.
• Generative AI (12 November 2024, ref 24EC55). This applies to all licensed corporations — expressly including asset managers — that use generative-AI language models in regulated activities. It sets expectations across four areas: senior-management responsibility, AI model risk management, cybersecurity and data risk, and third-party provider risk. Using generative AI to produce investment recommendations or research is treated as prima facie high-risk. If your team has started using AI tools, you need a governance policy before, not after.

AI-enabled cyberattacks: the June 2026 circular

On 2 June 2026 the SFC issued a circular on AI-enabled cyberattacks (ref 26EC32) to every licensed corporation. Its focus is defending against attackers who use AI. Your own use of AI tools is mainly a matter for the November 2024 circular, although this one also warns that AI models inside your firm can widen your attack surface.

The SFC’s concern is speed. Frontier AI models can find previously unknown (“zero-day”) vulnerabilities and chain minor ones together into serious attacks, and they make phishing, social engineering and deepfake impersonation easier to run. The time between a vulnerability being disclosed and being exploited is shrinking.

Every licensed firm is expected to consider five areas when it reviews and strengthens its cybersecurity framework:

• Patching and vulnerability management, including a procedure for urgent fixes outside the normal patch cycle.
• Access and privilege controls. Design on the assumption that any account or device may be compromised, enforce least privilege, segment the network, stop content from emails, documents and websites from triggering privileged actions, and apply maker-checker controls to high-impact actions.
• Detection and monitoring, backed by better threat intelligence.
• Third-party and supply-chain risk, covering the providers your critical operations depend on, such as your IT provider, administrator and cloud services.
• Incident response and recovery: escalation and containment fast enough for an attack that moves faster than normal processes, regular testing through tabletop exercises or simulated attacks, regular backups (at least daily for firms that trade electronically), and prompt notification of material incidents to the SFC.

The foundation it asks for is an accurate, up-to-date inventory of your technology, marking what is exposed to the internet, what is business-critical and what depends on a third party. It also reminds firms that the Manager-In-Charge of Information Technology should make sure changes to the cybersecurity framework are properly reviewed and approved.

What the SFC is actually looking at

Supervisory expectations show up most clearly in the SFC’s own reviews, collected on its cybersecurity topic hub:

• The 2023-24 thematic cybersecurity review of licensed corporations (report published February 2025) catalogued real incidents from 2021–2024 — ransomware disrupting trading and back-office systems, unauthorised account access enabling fraudulent trades, and third-party vendor breaches — and flagged recurring failings: end-of-life software, weak or missing two-factor authentication, delayed patching, excessive access rights, and insufficient senior-management oversight.
• The report came with a circular to licensed corporations (6 February 2025, ref 25EC7) whose expectations took immediate effect: security patches within one month of testing, encryption of sensitive data at rest and in transit, need-to-have access with a small number of logged administrator accounts, and audit logs retained and reviewed (including your email server, if you send payment instructions by email). It strongly advises an annual technical review, including penetration testing, with the results endorsed by the Managers-In-Charge of overall management and IT. The review behind it focused on internet brokers, but the circular is addressed to all licensed corporations, says firms without internet trading are “equally susceptible”, and announced work on an industry-wide cybersecurity framework.
• The Report on Operational Resilience and Remote Working Arrangements (October 2021) sets out good practices on business continuity, disaster recovery, scenario testing and remote-working security.

Read together, these tell you what “good” looks like — and they’re the yardstick a supervisor will reach for.

Enforcement: where the real risk sits

The cyber-specific fines have clustered on the trading side: in 2022, for example, the SFC fined a futures firm HK$5 million in part for failing to implement two-factor authentication for clients’ internet-trading logins. For a typical Type 9 manager without a client portal, the bigger enforcement exposure is internal-control and risk-management failures under the FMCC — the SFC has reprimanded and fined fund managers millions for inadequate internal controls and oversight. The lesson is the same either way: even where the internet-trading guideline doesn’t strictly apply, you are held to “we manage our IT and information risk competently, and can evidence it.”

On 28 July 2026 the SFC took what is widely reported as its first ransomware-related enforcement action. It reprimanded and fined Luk Fook Securities (HK) Limited HK$2.1 million, a firm licensed for Types 1, 4 and 9, after a September 2022 attack that came in through its remote access system, hit its file, email, trading and accounting servers, and took almost three weeks to recover from. The SFC found no firewall protection or adequate network monitoring, outdated operating systems and antivirus, weak control of user and privileged accounts, credentials stored in unencrypted files, weak control of remote access and external devices, no regular staff awareness training, and inadequate backup and business-continuity arrangements. It fined the firm although there was no evidence that any client lost money.

Luk Fook ran an online trading platform, so the internet-trading guidelines applied to it. But nothing on that list is specific to trading platforms. Most of it is the same basic hygiene the February 2025 circular sets out for all licensed corporations.

A practical checklist for SFC-licensed managers

1. Appoint your IT Manager-In-Charge properly — real authority, real expertise, cyber explicitly in scope. Route changes to your cybersecurity framework through them for approval.
2. Keep an inventory of your technology, marking what faces the internet, what is business-critical and what depends on a third party. The June 2026 circular treats it as the foundation.
3. Map your regulatory records and where they sit. Get EDSP undertakings and SFC premises approval for cloud/external storage, and make sure two HK-resident MICs can reach the records at any time.
4. Enforce multi-factor authentication everywhere — email, VPN, remote access and admin accounts, preferably with an authenticator app or passkey rather than SMS codes. A Microsoft 365 security review is the quickest way to check this against the SFC baseline.
5. Eliminate end-of-life software and apply security patches within a month of testing, with a fast route for urgent fixes.
6. Least-privilege access, reviewed at least annually, with a small number of separate, logged administrator accounts.
7. Verify payment instructions out of band: call back on a known number, and require two people for new payees, bank-detail changes and large transfers. AI makes impersonation fraud easier to run.
8. Daily, tested, offline backups and a disaster-recovery / business-continuity plan, covering cyber scenarios, that you actually rehearse.
9. A written incident-response and SFC-notification policy (Code of Conduct para 12.5), tested with a tabletop exercise.
10. Diligence your IT and SaaS vendors — outsourcing the work never outsources the obligation. If you use an external provider, pick one that delivers IT support for financial services firms in Hong Kong to standards it can evidence.
11. Commission an annual technical review, including a vulnerability scan and penetration test, with the results endorsed by your Managers-In-Charge.
12. Annual staff cyber-awareness training.
13. An AI-use policy before staff adopt generative-AI tools.

Where does your firm stand? Our free Security Controls Audit measures your firm against the 24 security controls the SFC expects of licensed firms, each judged against the SFC’s own text. It takes about ten minutes, and you get each control marked in place or not, where to start, and a report to keep.

How PTS helps

PTS provides IT support and security for Hong Kong financial services firms — certified to ISO/IEC 27001 and ISO/IEC 20000, vendor-neutral, and used to operating to the standards the SFC and your investors’ operational due diligence expect. We deliver the controls these rules assume: managed cybersecurity, Microsoft 365 security reviews against the SFC baseline, managed IT services, data governance, backup and business continuity, and the evidence trail to show it. We work alongside your compliance team and legal advisers — they own the regulatory opinion; we make the systems stand up to it. We also support private equity firms and their portfolio companies.

Related reading: Hong Kong’s PDPO privacy law · data governance with Microsoft Purview · IT due diligence in M&A · data laws in China & Hong Kong

Sources

Primary SFC materials: the Code of Conduct; the Fund Manager Code of Conduct; the Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading; the Manager-In-Charge regime FAQ; the circulars on external electronic data storage (19EC59), remote-office cybersecurity (20EC37) and generative AI (24EC55); the circulars on the 2023-24 cybersecurity review (25EC7), AI-enabled cyberattacks (26EC32) and phishing-resistant authentication (26EC35); the Luk Fook Securities enforcement announcement (26PR118); the Report on Operational Resilience and Remote Working Arrangements; and the SFC cybersecurity topic hub.

Again: this is general information, not legal or compliance advice, and reflects our understanding as at September 2026. The SFC updates its codes, guidelines and circulars regularly — confirm the current position and take professional advice before acting.