PTS sets up and runs IT for hedge funds and SFC-licensed asset managers in Hong Kong: a hardened Microsoft 365 tenant, managed devices, trading and market-data connectivity, communications retention and business continuity built on a launch timeline, the evidence pack that prime brokers and allocators ask for in operational due diligence, an IT audit against the SFC’s own circulars, and a discreet managed service once you are trading. ISO/IEC 27001 and ISO/IEC 20000 certified, in Hong Kong since 2001.
A new manager in Hong Kong is examined by three parties before the first trade: the SFC as it considers the licence application, the prime broker and fund administrator as they onboard the fund, and allocators running operational due diligence, in which IT and information security are now a substantial section. All three want the same things, and none of them want to hear that the setup is “being sorted out”. We build it to look institutional to all three without an institutional budget, and we keep it that way as the firm grows.
Launch IT on the licence timeline
Tenant, identity, devices, connectivity, Bloomberg or Refinitiv, the OMS and the prime-broker links, stood up in the order the application and the onboarding need them, with the policies and registers written as the systems go in rather than afterwards.
Due diligence answered with evidence
Information-security, incident-response, business-continuity, third-party and AI-use policies written for your firm; asset, access and restore-test registers; and a provider with an auditor’s certificate. The questionnaire is answered from records, not promises.
Audited against the SFC’s own text
Our SFC IT audit checks 24 controls against the Code of Conduct, the internet-trading guidelines and the cybersecurity circulars, with a gap register the Manager-In-Charge can sign and a record that stays current in PTS ARCA.
Run quietly afterwards
A fixed monthly managed service: helpdesk in English, Cantonese and Mandarin, patching, monitoring, backups, joiners and leavers, and the annual re-audit, so the controls that passed at launch still hold in year three.
Free tools for SFC-licensed firms
Which SFC rules apply to a Type 9 manager, and where does your firm stand?
The SFC Licence Navigator maps your licence types to the IT and cybersecurity obligations that apply, with a roadmap. The Security Controls Audit scores the firm against the 24 controls the SFC expects in about ten minutes. Keep the reports or send them to us.
Launching a hedge fund in Hong Kong: the IT the licence and the launch need
The SFC’s licence application asks the firm to set out its internal controls, including its systems, record-keeping and business continuity, and to identify its Managers-In-Charge, among them the Manager-In-Charge of Information Technology. The prime broker and administrator need secure, resilient connections and named contacts. The allocators need the questionnaire answered. We run the IT workstream of the launch to those three deadlines.
A hardened Microsoft 365
The tenant configured to Microsoft and CIS security baselines from the start: sign-in with an authenticator app or passkey rather than SMS codes, conditional access, legacy sign-in switched off, audit logging on, sensitivity labels and data loss prevention for the research and investor material, and an independent backup held outside Microsoft with a tested restore. See Microsoft 365 setup.
Managed devices and access
Encrypted, centrally managed laptops and phones that can be wiped remotely, separate administrator accounts, least-privilege access, and an access register updated at every joiner and leaver.
Trading, market data and prime-broker connectivity
Secure, resilient connections to the prime broker, the fund administrator, the order and execution management system and market data, with Bloomberg or Refinitiv terminals set up and supported, and a fallback path for the connection the desk cannot do without.
Records and communications retention
Capture and retention of order-related communications and the records the Code of Conduct and the Fund Manager Code of Conduct expect, configured so they can be produced quickly when the SFC or an investor asks, and held where the external data-storage circular allows.
Fraud and impersonation controls
Email authentication (SPF, DKIM and DMARC), anti-phishing, and a call-back and two-person rule for new payees, bank-detail changes and large transfers. The SFC’s June 2026 circular warns that AI makes deepfake impersonation and phishing easier to run, and names maker-checker on high-impact actions as a control.
Business continuity with cyber scenarios
A continuity and disaster-recovery plan that covers ransomware and a loss of the office as well as a typhoon, rehearsed rather than filed, with an incident-response plan that says how and when the SFC is notified.
Launching, or being asked hard questions about the IT you already have?
Tell us the licence types and the timeline. Two business days to a costed proposal, or a few questions first. No obligation.
Operational due diligence: what allocators and prime brokers now ask
Operational due diligence questionnaires have grown a technology section that reads like an audit: who runs your IT and how are they audited, is multi-factor authentication enforced and how, where is data stored and who can reach it, when was the last restore test, when was the last penetration test and who endorsed the results, how are payment instructions verified, what is the AI policy. Allocations are lost on weak answers more often than managers realise, because nobody tells them that was the reason.
We give you the evidence pack: policies written for your firm rather than downloaded, the registers, the test records, and an answer to “who runs your IT” that is an ISO/IEC 27001 and ISO/IEC 20000 certificate rather than an assurance. The certificate covers how we run your IT, not your firm as a whole, and your questionnaire should say exactly that.
The SFC IT audit for fund managers
Once the firm is trading, the question changes from “is it set up” to “can we show it is still right”. Our SFC IT audit checks the firm against 24 controls drawn from the SFC’s own text, in five groups: testing, access, data, detection and response, and governance. Each control is marked in place, a gap where the SFC expects it, below PTS’s standard, or not arising for your licence combination. The firm receives the report, a gap register with owners and dates, a roadmap in 90-day, six-month and twelve-month phases, and rectification statements the MIC-IT can sign. The register is kept current in PTS ARCA, so the BRMQ, the next due-diligence round and any SFC visit start from a live record.
If you later distribute your funds through your own online platform, the SFC’s internet-trading rules start to apply, including phishing-resistant client login by 8 July 2027; the audit’s scope changes with it. For the regulatory detail, see our guide to SFC cybersecurity guidelines for fund managers. Your compliance adviser owns the regulatory opinion; we make the systems stand up to it.
Managed IT for hedge funds after launch
Most managers of two to fifty people do not want an IT department and should not need one. Under a managed IT service PTS runs the helpdesk, the devices, the tenant, the patching, the monitoring and the backups, handles joiners and leavers, keeps the registers current, and re-runs the audit annually. Service hours are 09:00 to 18:00 Hong Kong time on business days as standard, with the trading-day cover the desk needs agreed separately. Our engineers work in English, Cantonese and Mandarin, and the same team covers Mainland China and Singapore for managers with research or operations staff there. Brokers and multi-strategy firms with a trading floor are covered on our financial services IT page. Governed AI is now a standard allocator question too; Microsoft 365 Copilot in Hong Kong is the route we deploy for GPT and Claude at work.
Why hedge funds choose PTS
We have done this for the SFC’s own scrutiny
We build and run IT for licensed corporations and have taken firms through licence applications, prime-broker onboarding and allocator due diligence, building the controls and records that SFC reviews examine.
Certified, so the answer to “who runs your IT” holds up
ISO/IEC 27001 and ISO/IEC 20000, audited externally every year.
Vendor-neutral and discreet
No platform agenda, no resale targets, and the confidentiality a firm whose edge is information expects from everyone it lets near its systems.
Priced for an emerging manager
A fixed monthly retainer sized to the team and growing with assets under management, with launch and audit work quoted as fixed-fee projects. We do not publish rates; we give you a costed proposal within two business days of understanding the firm.
Hedge fund IT FAQs
We are launching a hedge fund in Hong Kong. How fast can you set up our IT?
Quickly, and in the order the licence application and the prime-broker onboarding need. A secure Microsoft 365 environment, identity, devices, backup and a documented security posture are typically in place within weeks; trading connectivity, Bloomberg and the OMS follow the vendors’ own lead times, which we manage alongside. The timeline is agreed at the first conversation.
What IT does the SFC expect of a small Type 9 manager?
A named Manager-In-Charge of Information Technology, controls proportionate to the firm’s size and complexity under the Code of Conduct and the cybersecurity circulars, proper record-keeping including where regulatory records are stored, a tested business-continuity plan, and the ability to report material incidents promptly. The internet-trading guidelines apply to a Type 9 manager only where it distributes funds through its own online platform. Our SFC Licence Navigator sets this out for your licence combination; the regulatory opinion is your compliance adviser’s.
Can you get us through prime-broker and investor operational due diligence?
We give you the evidence: documented controls, policies written for your firm, asset, access and restore-test registers, penetration-test results endorsed by your MICs, and a provider with an auditor’s certificate. Whether an allocator is satisfied is their call, but the managers who fail are the ones who cannot evidence what they say.
Do you support Bloomberg, Refinitiv and order management systems?
Yes. We set up and support Bloomberg and Refinitiv terminals, order and execution management systems and the resilient connectivity the front office relies on, and we work with your prime broker’s and administrator’s technology teams on the links between you.
Can you handle communications recording and record retention?
Yes. We configure capture and retention of order-related communications and the records the SFC expects, held where the external data-storage circular allows, so they can be produced quickly when required.
Do you provide the compliance function or the regulatory opinion?
No. We are technologists. We build and audit the systems and controls and produce the evidence; your compliance adviser or outsourced compliance firm owns the regulatory opinion, and we work alongside them routinely.
Do you work with family offices that also hold an SFC licence?
Yes. We keep the licensed entity’s systems and controls separable from the family’s, and the audit covers the licensed arm. See family office IT.
Do you cover our research or operations staff in Mainland China or Singapore?
Yes. Our Shanghai entity and Singapore office support the local staff and systems, including the licensed connectivity a global Microsoft 365 tenant needs from inside the Mainland. See China IT.