Compliance guides
Technology regulation,in plain language.
Guides to the technology and cybersecurity expectations of the SFC, MAS, VARA and other regulators in our markets, updated as new circulars and guidance are published.
- SFC · Hong Kong
SFC cybersecurity requirements for licensed corporations: an IT guide
What the SFC's guidelines, Code of Conduct and circulars expect of licensed corporations on access, monitoring, cloud, backups and incident reporting.
Updated 15 October 2026 → - MAS · Singapore
MAS TRM Guidelines and Cyber Hygiene Notice: a guide for IT
What MAS's Technology Risk Management Guidelines, Cyber Hygiene Notice and TRM Notice ask of IT teams at Singapore financial institutions.
Updated 15 October 2026 → - VARA · UAE (Dubai)
VARA technology and information security rules: a guide for IT
What VARA's Technology and Information Rulebook asks of Dubai VASPs: governance, keys and wallets, testing, incident notification and outsourcing.
Updated 15 October 2026 →
These guides summarise regulators’ publications for information. They are not legal or regulatory advice; read the documents in full and take advice from your compliance team.