What does SFC Circular 26EC32 (AI-enabled cyberattacks) say about AI in banking?

What are the key points of SFC Circular 26EC32 (AI-enabled cyberattacks)?

• Background: frontier AI models can plan and execute multi-step actions autonomously, find previously undetected vulnerabilities, chain lower-risk vulnerabilities and operate across interconnected systems; the circular cites HKCERT figures of 15,877 cybersecurity incidents in 2025 against 12,536 in 2024.
• Senior management accountability: the MIC-IT must ensure changes to the cybersecurity framework are reviewed and approved and enhancements implemented properly and promptly.
• Asset inventory: keep an accurate, up-to-date inventory of technology assets, identify externally exposed and business-critical components, and keep it current enough for same-day prioritisation and containment decisions.
• (A) Patching: enhance and expedite patching and vulnerability management, with procedures for urgent fixes outside routine cycles and resources for a surge in patching.
• (B) Access and privilege: design on the assumption any user, device, privileged account or network component may be compromised; least privilege including connector and tool permissions, micro network segmentation where feasible, treat external content as potentially adversarial and prevent it from altering system instructions or triggering privileged actions, and maker-checker controls for high-impact actions.
• (C)-(E): strengthen detection of anomalies in client trading and system activity and threat intelligence; assess AI-enabled threats at third-party service providers; and test incident response through tabletop exercises or simulated attacks, plan containment and exploit-interruption strategies, and back up records regularly.
• Licensed firms using AI language models should address related cyber risks (adversarial attacks, data leakage, system prompt override) in their cybersecurity framework, factoring in the core principles of the SFC's November 2024 circular.
• The SFC may issue further guidance, conduct reviews of preparedness or take supervisory action; material cybersecurity incidents must be notified to the SFC as the Code of Conduct (paragraph 12.5(e)) and VATP Guidelines (paragraphs 16.7(b) and (c)) require.

What did SFC Circular 26EC32 (AI-enabled cyberattacks) change for banks?

It extends the SFC's November 2024 generative AI circular from AI model risk to AI as an attacker's tool. It sets supervisory expectations for patching speed, asset inventories, privilege design (including AI tool and connector permissions), supply chain and incident response, and puts accountability on the MIC-IT, within a wave of 2026 frontier-AI cyber advisories from financial regulators including MAS, Japan's FSA and the NYDFS.

What does SFC Circular 26EC32 expect firms to do about AI-enabled cyberattacks?

SFC Circular 26EC32 of 2 June 2026 expects licensed corporations, SFC-licensed virtual asset trading platforms and associated entities to assess their preparedness for AI-enabled cyberattacks and enhance their cybersecurity frameworks in five areas: patching and vulnerability management; access and privilege controls (assume compromise, least privilege, segmentation, treating external content as adversarial, maker-checker); detection and monitoring; third-party supply chain risk; and incident response and recovery. Firms should keep technology asset inventories current enough for same-day prioritisation, and senior management including the MIC-IT is ultimately responsible. It also reminds firms using AI language models to address their cyber risks under the SFC's November 2024 circular. It is addressed to SFC licensed firms, not banks as such.

The circular is a supervisory reminder grounded in the SFC's engagement with licensed firms and key internet trading platform providers on preparedness. It cites a rise of about 27% in Hong Kong cybersecurity incidents (from 12,536 in 2024 to 15,877 in 2025, according to HKCERT) as context, and explains that the shrinking interval between vulnerability disclosure and exploitation shortens the window for patching.

It sits beside the SFC's November 2024 circular on generative AI language models: that circular deals with the risks of the firm's own AI use, and this one with AI as an attacker's capability, while reminding firms that AI language model use introduces additional exploitable risks such as adversarial attacks, data leakage and system prompt override. The SFC may follow with further guidance or reviews.

WHAT THIS MEANS IN PRACTICE

• Confirm the asset inventory identifies externally exposed and business-critical components and can support same-day decisions.
• Review patch SLAs and emergency change procedures, and budget for a surge in patching.
• Review agent, connector and tool permissions for any AI tools with access to systems, and apply least privilege.
• Check third-party providers' readiness for AI-enabled threats in contracts and assessments.
• Run a tabletop or simulated attack and record the result for the MIC-IT.