PTS audits the IT and cybersecurity of SFC-licensed corporations in Hong Kong against the SFC’s own text: 24 controls drawn from the Code of Conduct, the internet-trading guidelines, the external data-storage circular and the 2025 and 2026 cybersecurity circulars, each marked in place or not, with a gap register, rectification statements for the Manager-In-Charge of Information Technology, and an evidence pack that answers the annual Business and Risk Management Questionnaire and investor due diligence. Fixed fee, three to four weeks for most firms, carried out by an ISO/IEC 27001 and ISO/IEC 20000 certified provider.
The SFC does not publish one IT rulebook. Its expectations sit across the Code of Conduct, the Fund Manager Code of Conduct, the Manager-In-Charge regime, the internet-trading guidelines and a run of circulars, and the people who have to answer for them (the MIC-IT, the COO, the Responsible Officers) rarely have an IT background. Our guide to SFC cybersecurity guidelines for fund managers explains the rules; the SFC Licence Navigator shows which apply to your licence types; the free Security Controls Audit lets you self-assess in ten minutes. This page is the paid audit: PTS engineers check the systems and the evidence behind the answers, and give the firm a position it can defend.
Judged against the SFC’s text, not a generic checklist
Each of the 24 controls is anchored to the code, guideline or circular that asks for it, and the finding says whether the gap is one the SFC expects closed or one where PTS’s own standard asks more than the SFC does. The distinction matters when the MIC signs.
Outputs the firm can use the same week
A control-by-control finding, a gap register with an owner and a target date for each gap, a 90-day, six-month and twelve-month roadmap, rectification statements written to be signed, and the evidence pack filed for the BRMQ, the prime broker and the allocators.
Kept live, not filed away
The firm’s register of controls, gaps and evidence is kept in PTS ARCA, our compliance-assessment system, so the next questionnaire, inspection or due-diligence request starts from a current record rather than last year’s PDF.
Certified, vendor-neutral, technologists not lawyers
ISO/IEC 27001 and ISO/IEC 20000 certified, no platform agenda, and clear about the boundary: we audit the technology and the controls; your compliance adviser owns the regulatory opinion.
Free tools, before you commission anything
Which SFC rules apply to your firm, and where does it stand?
Pick your licence types in the SFC Licence Navigator to see the IT and cybersecurity obligations for your combination. Then take the Security Controls Audit to self-assess against the same 24 controls this audit verifies. Both give you a report to keep or send to us.
Does the SFC require an IT audit?
Not in those words. No single SFC rule says “commission an annual IT audit”. What the SFC does expect is that every licensed corporation can show it has the capability and the controls the Code of Conduct demands, that a named Manager-In-Charge owns information technology, that cybersecurity is reviewed regularly and endorsed by senior management, and that the firm can answer the technology section of the annual Business and Risk Management Questionnaire truthfully. Firms that run internet-trading facilities carry the explicit requirements of the hacking-risk guidelines and the 2026 phishing circular on top.
In practice the audit is how a firm evidences that oversight. It is also what prime brokers and allocators are asking for in operational due diligence, in increasing detail, and what the SFC’s own inspection teams work through when they visit. The Luk Fook case in July 2026, the SFC’s first ransomware enforcement, turned on basic controls: remote access to an unsupported Windows server, legacy systems left unpatched, access management and monitoring. The fine was HK$2.1 million; there was no evidence that clients lost money, and the firm had reported the incident the same day.
What the SFC IT audit covers
The audit works through 24 controls in five groups. The controls are PTS’s, built on what the SFC asks of licensed firms, and each is judged on the SFC’s own text.
1. Test and find weaknesses
Vulnerability scanning and external penetration testing of internet-facing systems, phishing simulation, and whether findings from previous tests were fixed and retested. Where testing is in scope, it is carried out by PTS’s accredited testing partners under our management; see penetration testing.
2. Control who gets in
Multi-factor authentication on email, remote access and administrator accounts, with authenticator apps or passkeys rather than SMS codes; least-privilege access reviewed at least annually; separate, logged administrator accounts; the joiner and leaver process; and, for firms with an online client platform, the client-login controls the SFC now expects, including phishing-resistant login by 8 July 2027.
3. Protect the data
Encryption at rest and in transit; daily backups held offline and actually restored in a test; where regulatory records live, including the undertakings and approvals the external data-storage circular requires when records sit with a cloud or external provider; and whether two Hong Kong-resident Managers-In-Charge can reach those records at any time.
4. Detect and respond
Monitoring and alerting on the systems that matter, end-of-life software and patch timing, a written incident-response plan that includes how and when the SFC is notified, a tested business-continuity and disaster-recovery plan with cyber scenarios, and the out-of-band verification of payment instructions that the 2026 circular on AI-enabled attacks names.
5. Govern and oversee
A properly appointed MIC-IT with cyber in scope, a technology inventory that marks what is internet-facing, business-critical or third-party dependent, due diligence on IT and SaaS providers, annual staff awareness training, and an AI-use policy before staff adopt generative AI tools.
Tell us your licence types, headcount and what is driving the audit
Two business days to a fixed-fee proposal, or a few questions first if we need to see more. No obligation.
How the audit runs
1. Scoping
A short call to confirm licence types, whether clients trade or subscribe through your own online platform, the systems and providers in use, and what is driving the audit: a board or MIC request, due diligence, a licence application, an SFC enquiry or a routine review. The scope and the fixed fee follow from that.
2. Evidence and interviews
Interviews with the MIC-IT, the COO and whoever runs the IT, and collection of the policies, registers and records that exist. A control with no evidence is recorded as needing an answer, never assumed in place.
3. Configuration review and testing
Hands-on review of the Microsoft 365 or Google tenant, identity and access, endpoints, backups, network and remote access, and the trading and market-data connections. Vulnerability scanning and penetration testing where they are in scope.
4. Findings against each control
Every control marked in place, a gap where the SFC expects it, below PTS’s standard, or not arising for your licence combination, with the SFC text it rests on and what we saw.
5. Report, register and roadmap
The written report for the MIC and the board, the gap register with owners and dates, the roadmap in 90-day, six-month and twelve-month phases, and the rectification statements drafted for signature.
6. Remediation and retest
PTS fixes the gaps under a separate scope, or your existing provider does, and the retest closes them in the register. The register then stays current in PTS ARCA for the next questionnaire or review.
Who the audit is for
- Type 9 asset managers and hedge funds, including new managers preparing a licence application, where the audit doubles as the IT section of the launch plan. See IT for hedge funds in Hong Kong.
- Family offices that hold an SFC licence, where the licensed entity’s systems have to be separable from the family’s. See family office IT.
- Type 1, 2 and 4 brokers and advisers, where internet trading brings the hacking-risk guidelines and the phishing circular into scope.
- Family offices with a licensed arm, where the licensed entity’s controls have to be separable from the family’s. See family office IT.
- Private equity and other licensed advisers facing investor operational due diligence. See private equity IT.
Our commercial approach
The audit is a fixed-fee statement of work, scoped on the call and quoted within two business days. Testing by our accredited partners is itemised separately where it is in scope. Remediation is a separate decision, quoted after the report, so the audit’s findings are never shaped by the work that might follow. We do not publish fees because the scope varies with licence types, systems and whether testing is included; the proposal states the scope, assumptions and exclusions in a form you can put in front of the board.
SFC IT audit FAQs
How long does an SFC IT audit take?
Three to four weeks from the scoping call to the report for a firm of up to about 50 staff with one office and a cloud-based environment, with the penetration test running in parallel where it is in scope. Larger or multi-site firms take longer, and we say so at scoping.
Is this an SFC-approved or SFC-required audit?
No. The SFC does not approve auditors and does not prescribe a named IT audit. This is PTS’s audit, built on the SFC’s own codes, guidelines and circulars, carried out to our ISO/IEC 27001 and ISO/IEC 20000 disciplines. It gives the firm evidence of the oversight the SFC expects; it is not a regulatory opinion, and your compliance adviser remains responsible for that.
If PTS already runs our IT, is your audit independent?
Not in the formal sense, and we say so in the report. Where the firm needs an independent review, for example after an incident or at an investor’s request, we recommend a third-party reviewer and prepare the control evidence for them. Where PTS does not run your IT, the audit is independent of the provider whose work it examines.
Does the audit answer the BRMQ technology questions?
Yes. The annual Business and Risk Management Questionnaire asks a set of technology and cybersecurity questions, and the audit’s findings map onto them so the Responsible Officers answer from evidence rather than recollection.
Will the audit satisfy our prime broker’s or investors’ due diligence?
It gives you what their questionnaires ask for: documented controls, policies written for your firm, asset and access registers, restore-test records and a named provider with an auditor’s certificate. Whether a particular allocator is satisfied is their decision, but the firms that fail due diligence are almost always the ones that cannot evidence what they say.
What happens to the gaps the audit finds?
Each gap gets an owner and a target date in the register, and the roadmap puts it in the first 90 days, months three to six or months six to twelve. PTS can carry out the remediation under a separate scope, or your provider can; either way the retest closes the gap in the register.
What is PTS ARCA?
PTS ARCA is our compliance-assessment system. The audit’s controls, findings, gaps and evidence are recorded in it for your firm, so the register stays current between reviews and the next questionnaire or inspection starts from a live record. Access for the firm is arranged as part of the engagement.
Do you audit firms outside financial services?
Yes. The same 24 controls serve as a benchmark for any Hong Kong company, without the SFC references. The free Security Controls Audit is the self-assessment version, and our cybersecurity team carries out the paid audit for unregulated firms.
Does the audit cover our Mainland China or Singapore offices?
Yes, where they are in scope. Our Shanghai entity and Singapore office cover the local systems, and the report records the cross-border data and connectivity position alongside the Hong Kong controls. See China IT.