The SFC licence navigator for small fund managers and advisers

Yes. The SFC applies the same codes to every licensed corporation and scales its expectation by size and complexity, not by whether the rules apply. Its February 2025 and June 2026 cybersecurity circulars are addressed to every licensed corporation. What changes for a small firm is depth: a short policy rather than a forty page one, a quarterly report from the provider rather than a security team.

The provider is responsible to you under its contract. You are responsible to the SFC. The SFC's review report says senior management remains responsible for overall management and supervision even when implementation is outsourced. Your IT Manager-In-Charge needs to be able to show that supervision happened, which is why PTS reports to the MIC quarterly in writing.

Not approval as such, but the EDSP circular applies. You need to have done due diligence on the provider, know where the data is held, keep retention and audit logs on, and decide whether you rely on exclusive cloud storage of regulatory records. If you do, you need the provider notice or undertaking arrangements and two named MICs in Hong Kong with full access.

The 2020 remote working circular expects two-factor authentication for staff logins, the February 2025 circular expects strong authentication and encourages firms to stop using SMS one-time passwords, and the internet trading guidelines mandate it for client logins where clients transact online. For internet brokers the July 2026 circular goes further: client login should be phishing-resistant by 8 July 2027, using passkeys or bound devices rather than SMS or email one-time passwords. A licensed corporation without MFA in 2026 would have no defence after an incident.

The February 2025 circular sets the standard at deployment within one month of completing testing for security patches, and expects end-of-life software to be removed. The June 2026 circular adds a route for urgent fixes outside the normal cycle.

The February 2025 circular expects an annual technical review including vulnerability scanning and penetration testing, endorsed by management. For a small firm that means an external test of the internet-facing footprint and the Microsoft 365 tenant. If clients transact online, the portal and its APIs are tested too. PTS delivers testing through its external testing partner at a fixed price for a defined scope.

Two things. Under the November 2024 circular, govern your own use: which tools, on which accounts, what must never be entered, and human review of anything that reaches a client. Advisory firms using AI for recommendations or research are in the high risk category. Under the June 2026 circular, assess how prepared you are for AI-enabled attacks against you: deepfake voice and video, polished phishing and faster exploitation of vulnerabilities.

Code of Conduct 12.5 requires immediate reporting of a material breach or a material failure of systems, and the SFC's cyber circulars apply it to material cybersecurity incidents. Incidents likely to be material include a compromised mailbox, ransomware, loss of a device with unencrypted data, a fraudulent payment, or a system failure that stops the firm operating. Report immediately on becoming aware, even before the facts are complete. Self-reporting is a mitigating factor in enforcement.

It can, where the topic is relevant to the individual's role and the firm records it properly. ROs need 12 CPT hours a year including two on regulatory compliance; other licensed individuals need 10. PTS training sessions produce a signed record for the CPT log.

Be the person the SFC holds accountable for IT. In practice: receive and read the provider's reports, sign off access reviews, own the incident plan, make sure the EDSP arrangements are in place, and be able to explain the firm's controls in an inspection. In a small firm this is usually a Responsible Officer, supported by the provider.

Most records seven years under the Keeping of Records Rules, some two. Emails and messages containing orders, instructions or advice are records. Set Microsoft 365 retention to match and have a policy for personal messaging apps.

The Business and Risk Management Questionnaire is the SFC's annual return on how a licensed corporation is run. Every licensed corporation files it through WINGS with the audited accounts, within four months of the financial year end, so 30 April for a December year end. The current form comes from circular 24EC68 and has a section for every firm plus sections by business line. Its technology questions ask whether IT is outsourced and to whom, who oversees the provider, whether IT staff are trained, how online banking credentials and tokens are protected, whether there is a business continuity plan and whether it was drill-tested this year, how and how often systems and data are backed up, and whether any system incident occurred: an unplanned outage, hacking, ransomware, data loss or leakage. Firms offering internet trading answer a further block on two-factor authentication, monitoring and client notifications.

Senior management signs the BRMQ, and the SFC uses it to decide which firms to inspect and what to ask. An answer that says backups are taken and the continuity plan was tested is a representation to the regulator, so the evidence behind it needs to exist on the day of filing: backup reports, a restore test record, the drill report, the provider agreement and the MIC's supervision notes. PTS's quarterly IT report to the Manager-In-Charge is written so that each BRMQ technology question can be answered from it, with the evidence attached.

Yes. Since the December 2024 edition of the form, the asset management section asks whether the firm uses AI or machine learning in its regulated activities, traditional or generative, third-party or in-house, in which functions and at which stages of the investment process. A truthful answer needs an inventory of the AI tools staff actually use, which is also the first thing the November 2024 generative AI circular expects. Firms that answer no while staff use ChatGPT or Copilot on work accounts are the ones an inspection catches out.

The IT MIC and their reports, the provider agreement, where records are stored, MFA status, admin access and reviews, patching evidence, backup and restore tests, the incident plan, training records and the BCP. The Evidence pack tab is that list.

Microsoft protects its platform, not your data against deletion, ransomware or a compromised administrator. The June 2026 circular expects regular backups as part of recovery, and the review report lists backup resilience as an area needing improvement. A separate backup with an annual restore test is the proportionate answer.

Most likely nothing until something happens. Then the firm faces the SFC's question of whether controls were adequate, with the July 2026 Luk Fook case as the reference point: a reprimand and a HK$2.1 million fine for basic control failures exposed by a ransomware attack, although there was no evidence that clients lost money. Investor due diligence is the nearer term cost: allocators walk away from firms that cannot evidence the basics.