# How does the Hong Kong SFC regulate AI in banking? Source: https://www.bankingnewsai.com/ai-regulation/sfc Last updated: Oct 5, 2026 The Hong Kong Securities and Futures Commission regulates AI through two circulars to licensed firms rather than an AI law. Circular 24EC55 of 12 November 2024 sets expectations for generative AI language models under four Core Principles (senior management responsibilities, AI model risk management, cybersecurity and data risk management, third-party provider risk management) and treats investment recommendations, advice and research as a high-risk use case. Circular 26EC32 of 2 June 2026 requires licensed firms to review and enhance cybersecurity against AI-enabled cyberattacks, with the Manager-in-Charge of IT ultimately responsible. They bind licensed corporations through the SFC's supervisory framework, not banks as such, which the HKMA supervises. ## At a glance | Field | Value | | --- | --- | | Full name | Securities and Futures Commission of Hong Kong | | Jurisdiction | Hong Kong SAR (regulator of licensed corporations, asset managers and SFC-licensed virtual asset trading platforms; banks are supervised by the HKMA) | | Role | Securities regulator that has issued supervisory circulars on generative AI language models and on AI-enabled cyberattacks for licensed firms | | How binding | Supervisory guidance | | Applies to | SFC licensed corporations and, for the 2026 cybersecurity circular, SFC-licensed virtual asset trading platform operators and associated entities. Banks are covered only through SFC-licensed affiliates, since banks are supervised by the HKMA | | Key document | SFC Circular 24EC55, 'Use of generative AI language models' (12 November 2024) | | Latest move | 2 June 2026: SFC Circular 26EC32 on enhanced cybersecurity measures against AI-enabled cyberattacks, addressed to licensed corporations, SFC-licensed VATPs and associated entities. | ## Overview The SFC's approach is to apply existing conduct and internal-control rules to AI. The November 2024 circular cites the Code of Conduct and the Management, Supervision and Internal Control Guidelines in its footnotes, takes effect immediately, and allows a risk-based, proportionate implementation while promising a pragmatic approach to compliance. It requires human-in-the-loop review, prompt-robustness testing and repeated disclosures for high-risk uses, and reminds firms to meet notification requirements for significant changes in business. The June 2026 circular shifts to AI as an attacker's tool. It cites the heightened cyberattack risk posed by frontier AI models and Hong Kong incident statistics, sets expectations on asset inventories, patching, access and privilege (including AI tool and connector permissions), detection, third-party supply chains and incident response, and says the SFC may issue further guidance, conduct reviews of preparedness or take supervisory action. ## Documents (2) - Jun 2, 2026 — [SFC Circular 26EC32 (AI-enabled cyberattacks)](https://www.bankingnewsai.com/ai-regulation/documents/sfc-circular-ai-enabled-cyberattacks-2026): Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities - Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks (In force) - Nov 12, 2024 — [SFC Circular 24EC55 (generative AI language models)](https://www.bankingnewsai.com/ai-regulation/documents/sfc-circular-genai-language-models-2024): Circular to licensed corporations - Use of generative AI language models (In force) ## Timeline - Jun 2, 2026 — [SFC Circular 26EC32 (AI-enabled cyberattacks)](https://www.bankingnewsai.com/ai-regulation/documents/sfc-circular-ai-enabled-cyberattacks-2026): SFC Circular 26EC32 (AI-enabled cyberattacks) — Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities - Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks — SFC Circular 26EC32 (reference SFO/IS/020/2026), issued on 2 June 2026, reminds licensed corporations, SFC-licensed virtual asset trading platforms and their associated entities to review and enhance cybersecurity against AI-enabled cyberattacks, citing the heightened attack risks posed by frontier AI models. - Nov 12, 2024 — [SFC Circular 24EC55 (generative AI language models)](https://www.bankingnewsai.com/ai-regulation/documents/sfc-circular-genai-language-models-2024): SFC Circular 24EC55 (generative AI language models) — Circular to licensed corporations - Use of generative AI language models — SFC Circular 24EC55, issued to licensed corporations on 12 November 2024 and effective immediately, sets the Hong Kong Securities and Futures Commission's expectations for the use of generative AI language models (AI LMs). ## What to watch next - Further SFC guidance or thematic reviews of licensed firms' preparedness for AI-enabled cyberattacks, which the 2 June 2026 circular says may follow. - More specific guidance on AI language model risks, which the November 2024 circular said the SFC would develop with industry if necessary. - How the SFC treats high-risk AI use cases under the notification requirements of the Information Rules. ## FAQ ### Does the SFC regulate AI use by banks? The SFC's circulars are addressed to licensed corporations and, in 2026, SFC-licensed VATPs and associated entities. Banks in Hong Kong are supervised by the HKMA, so they are within the circulars only through an SFC-licensed affiliate. ### What is a high-risk AI use case for the SFC? Generally, using a generative AI language model to give investment recommendations, investment advice or investment research to investors or clients (paragraph 8 of Circular 24EC55). The SFC expects extra measures such as a human in the loop. ### Is there a Hong Kong AI law? The SFC circulars are supervisory guidance, not legislation. They rest on existing SFC codes and guidelines and the Securities and Futures (Licensing and Registration) (Information) Rules notification requirements. Related authorities: [MAS](https://www.bankingnewsai.com/ai-regulation/mas), [Japan FSA](https://www.bankingnewsai.com/ai-regulation/japan-fsa), [FSB](https://www.bankingnewsai.com/ai-regulation/fsb), [UK (BoE / PRA / FCA)](https://www.bankingnewsai.com/ai-regulation/uk). --- Canonical page: https://www.bankingnewsai.com/ai-regulation/sfc Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.