If your firm is licensed by Hong Kong's Securities and Futures Commission (SFC), your IT team works under a set of SFC guidelines and circulars on cybersecurity. Reading them all takes time. This checklist turns them into practical points your IT team, or your IT provider, can work through and tick off.
Every point comes from our full guide, SFC cybersecurity requirements for licensed corporations, which quotes the SFC documents and links to each one. The reference in brackets after each point shows where it comes from.
Before you start: who this applies to. The most detailed rules, the 2017 Cybersecurity Guidelines, are for firms that offer internet trading. Later circulars, such as the June 2026 circular on AI-enabled attacks, are addressed to all licensed corporations. The 2017 Guidelines "do not have the force of law", but the SFC says that not following their spirit may reflect on a firm's fitness and properness. Check with your compliance team which documents apply to you.
1. Access and sign-in
- Two-factor sign-in for clients' internet trading accounts (Guidelines 1.1).
- A plan to move clients from SMS and email one-time passwords to passkeys or device binding. The July 2026 circular says OTP is not phishing-resistant and gives 8 July 2027 as the latest date for internet brokers; large internet brokers are expected to act immediately.
- Phishing-resistant multi-factor sign-in on admin, cloud and privileged accounts, with access granted only when needed (June 2026 circular, Appendix).
- Staff access on a need-to-have basis, with access to critical systems reviewed at least once a year, and the review kept on file (Guidelines 2.2).
- Admin accounts kept few, and their use logged and monitored (February 2025 circular).
- Remote access only through VPN or VDI with multi-factor sign-in; no permanent access for IT vendors (February 2025 circular, Appendix).
- Client sessions time out, and clients cannot switch the timeout off (July 2026 circular).
2. Monitoring and logs
- Monitoring that spots unauthorised access to clients' trading accounts (Guidelines 1.2).
- Prompt alerts to clients for logins, password resets and trades, sent through a different channel from the one used to log in (Guidelines 1.3), plus alerts for new devices and passkey changes (July 2026 circular).
- Logs kept and reviewed for all critical servers, network devices and databases. If email carries payment instructions, the email server counts as a critical server (February 2025 circular).
- Logs collected in one place (a SIEM), with alerts for the red flags the SFC names, such as several clients changing to the same mobile number.
- Audit logs of electronic trading activity kept for at least two years (Code of Conduct, Schedule 7).
3. Systems, patching and encryption
- A DMZ with multi-tiered firewalls in front of internet-facing systems (Guidelines 2.1).
- Security patches applied within one month of testing (Guidelines 2.4), with a fast route for urgent fixes outside the normal cycle (June 2026 circular).
- No end-of-life software on critical servers and databases, and an IT asset inventory reviewed at least once a year (February 2025 circular, Appendix), current enough for same-day decisions in an incident (June 2026 circular).
- Unneeded service ports closed on servers (February 2025 circular).
- A vulnerability scan and a penetration test at least once a year, with the results endorsed by the Managers-In-Charge of overall management oversight and of IT (February 2025 circular).
- Data encrypted in transit, including inside your own network, and at rest (February 2025 circular).
- Two-person checks (maker-checker) for high-impact actions (June 2026 circular).
4. IT providers and cloud
- A written service-level agreement for any outsourced internet trading activity (Guidelines 2.10).
- A register of IT providers, with due diligence on their cybersecurity and SLAs that cover how they report security incidents to you (February 2025 circular, Appendix).
- The cloud root account locked down with two-factor sign-in and IP restrictions; API keys rotated, with no permanent keys (February 2025 circular, Appendix).
- Regulatory records in the cloud checked with compliance. If records are kept only with an external provider, SFC approval under section 130 of the Securities and Futures Ordinance may be needed (2019 circular). Keep your own encryption keys and an exit plan.
5. Backups and records
- Business records, client and transaction data, servers and documentation backed up to an offline medium at least daily (Guidelines 2.8).
- Offline, write-once (WORM) and air-gapped daily backups (February 2025 circular, Appendix), with restores tested, not just the backup jobs.
- Backup copies kept available when you need them (June 2026 circular).
6. Incidents
- Written escalation and reporting steps (Guidelines 3.2), naming who decides on containment and who contacts the SFC.
- Contingency plans for denial-of-service attacks and for losing all records and client data, for example to ransomware (Guidelines 2.9).
- Containment steps agreed in advance, such as isolating computers and disabling accounts (June 2026 circular).
- Incidents reported to the SFC immediately: material system failures (Code of Conduct 12.5(e)) and hacking incidents, with a root cause analysis (July 2026 circular).
- A yearly tabletop exercise or simulated attack, for example a ransomware or account-takeover scenario (June 2026 circular).
7. People and governance
- A cybersecurity risk framework set by the responsible officers, who stay accountable even when tasks are delegated (Guidelines 3.1).
- Regular reports to the Manager-In-Charge of IT (MIC-IT) on vulnerabilities, patching, incidents and tests (February 2025 circular).
- Security awareness training for all staff at least once a year, including phishing, with attendance records (Guidelines 3.3; February 2025 circular, Appendix).
- No links to login or trading pages in emails and text messages to clients (May 2025 circular).
How to use this checklist
Go through it with the person who runs your IT, mark each point done, partly done or not done, and keep the evidence: access reviews, patch reports, backup restore tests, training records. For the exact wording and the source documents, see our SFC cybersecurity guide. For background on what the SFC found in its review of licensed corporations, see SFC Cybersecurity Review 2023/24: key findings.
How Dual Layer IT can help
We are ISO/IEC 27001:2022 certified, and our controls are built on ISO/IEC 27001, NIST CSF and CIS and mapped to the SFC's guidelines.
- IT compliance audits: we go through this checklist with you and list the gaps by priority.
- Cybersecurity: multi-factor sign-in, logging and 24/7 monitoring, vulnerability scans, penetration testing and incident plans.
- Managed IT: patching, backups and access reviews, with the records your auditors ask for.
Working with hedge funds, brokers or asset managers? See IT support for financial firms.
This checklist summarises SFC publications for information. It is not legal or regulatory advice; read the documents in full and take advice from your compliance team.
