Contact Us
SFC · Hong Kong

SFC cybersecurity requirements for licensed corporations: an IT guide

What the SFC's guidelines, Code of Conduct and circulars expect of licensed corporations on access, monitoring, cloud, backups and incident reporting.

Updated Dual Layer IT

ShareLinkedInEmail

Hong Kong's Securities and Futures Commission (SFC) sets out its cybersecurity expectations for licensed corporations (LCs) in guidelines, the Code of Conduct and a series of circulars. The most detailed rules are for "internet brokers": firms that offer internet trading under Type 1, 2 or 3 regulated activity, or Type 9 where they distribute funds under their management online (2017 Cybersecurity Guidelines, paragraph 3). Several other documents apply to LCs more widely.

For IT teams, note that the 2017 guidelines "do not have the force of law", but "a failure to follow the spirit of these Guidelines may reflect adversely on the person's fitness and properness" (paragraph 4).

The key documents

  • Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading (27 October 2017), called the "Cybersecurity Guidelines" in later circulars. Baseline controls for internet trading. PDF
  • Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (January 2026 edition). Paragraph 12.5 (notifications), paragraph 18 and Schedule 7 (electronic trading). PDF
  • Management, Supervision and Internal Control Guidelines (April 2003). Section IV covers information management. PDF
  • Use of external electronic data storage (circular, 31 October 2019). Cloud and external storage of regulatory records. PDF
  • Management of cybersecurity risks associated with remote office arrangements (circular, 29 April 2020). VPNs, remote access, videoconferencing. PDF
  • Operational resilience and remote working (circular to intermediaries, 4 October 2021). Resilience standards (Appendix A) and remote working standards (Appendix B). Appendices
  • Cybersecurity review of licensed corporations (circular, 6 February 2025). Expected standards on phishing, end-of-life software, remote access, third-party providers and cloud (Appendix). Circular, Appendix
  • Phishing detection and prevention (circular, 21 May 2025). PDF
  • Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks (circular, 2 June 2026). For LCs, SFC-licensed virtual asset service providers and associated entities. Circular, Appendix
  • Implementing (i) robust authentication methods to reduce and mitigate hacking risks from phishing attacks and (ii) adequate monitoring and surveillance measures to identify suspicious activities (circular, 9 July 2026). For internet brokers and SFC-licensed virtual asset service providers. PDF

Access control and authentication

What the documents say. An LC "should implement two-factor authentication for login to clients' internet trading accounts" (Cybersecurity Guidelines, 1.1). The July 2026 circular states: "The SFC does not consider OTP to be a phishing-resistant authentication solution". It says OTPs should not be used for client login or device binding (paragraphs 5 and 7), and gives passkeys and bound devices as examples of robust methods (paragraph 8). Internet brokers are expected to implement robust authentication "no later than 8 July 2027", and "large internet brokers are expected to implement these solutions immediately" (paragraph 21(c)). Clients should not be allowed to disable session timeout, with the idle period limited "for example, to within 30 minutes" (paragraph 11).

For staff, access should be granted "on a need-to-have basis", with user access lists for critical systems reviewed "at least on a yearly basis" (Guidelines, 2.2). System admin accounts should be limited and their use "logged and monitored" (February 2025 circular, item (d)). Remote access should be allowed only "via VPN or other technical solutions that provide the same security protection, such as Virtual Desktop Infrastructure", with multi-factor authentication. Third-party providers should not be given "permanent access rights" (February 2025 Appendix). The June 2026 Appendix suggests "phishing-resistant multi-factor authentication on administrative, cloud and privileged accounts" and just-in-time access (section (B)).

What this means for your IT

  • Plan the move from SMS and email OTP to passkeys or device binding, before 8 July 2027.
  • Put phishing-resistant MFA on admin, cloud and privileged accounts first.
  • Review access to critical systems every year, and keep the records.
  • Route remote access through VPN or VDI with MFA. Give vendors time-limited access only, and log their sessions.

Monitoring, detection and logging

What the documents say. LCs should have "an effective monitoring and surveillance mechanism to detect unauthorised access to clients' internet trading accounts" (Guidelines, 1.2). Clients should be alerted promptly to logins, password resets, trades and other activity, and "The channel of notification to clients should be different from the one used for system login" (1.3). The July 2026 circular adds alerts for "logins from new devices, binding of new device and creation or revocation of passkeys" (paragraph 13). It also expects transaction monitoring and timely review of login and device-binding logs (paragraph 16).

The February 2025 circular asks LCs to "retain and review the logs for the activities in all critical servers, network devices and databases" (item (e)). Where email carries payment instructions, "the email server is considered to be a critical server" (footnote 11). One red flag it gives is "multiple clients changed their mobile phone number to the same phone number" (item (f)). Schedule 7 to the Code calls for audit logs of electronic trading system activity, kept "for a period of not less than 2 years" (1.3.1(c), 1.3.2(b)).

What this means for your IT

  • Send critical server, firewall, database and email server logs to a central log platform (a SIEM).
  • Write alerts for the SFC's red flags, such as several clients sharing one phone number.

Infrastructure and system security

What the documents say. The Guidelines expect "a Demilitarised Zone (DMZ) with multi-tiered firewalls" (2.1). Security patches should be applied "within one month following the completion of testing" (2.4). The February 2025 circular asks LCs to "disable all unnecessary service ports in their servers". It strongly advises regular technical reviews, including vulnerability scanning and penetration testing, "(at least annually)", particularly for large internet brokers (item (a)). It also says "both data-in-transit (including data transmitted within the internal network of LCs) and the data-at-rest should be encrypted" (item (c)). Its Appendix asks LCs to "cease the use of EOL software on all critical system servers and databases" and to review the IT asset inventory "at least annually". The June 2026 circular asks for inventories current enough for "same-day prioritisation and containment decisions" (paragraph 6). It also asks for a process for "urgent and critical fixes that fall outside routine patching cycles" (paragraph 9) and "maker-checker controls for high-impact actions" (paragraph 11).

What this means for your IT

  • Keep one asset inventory with end-of-life dates, and mark which systems are internet-facing or business-critical.
  • Set patch targets, with a fast route for critical fixes.
  • Book a yearly vulnerability scan and penetration test, with results endorsed by the Managers-In-Charge of Overall Management Oversight and of IT (MIC-IT), as the February 2025 circular says.
  • Encrypt data inside the network as well as at the edge.

Third parties and cloud

What the documents say. Outsourced internet trading activities need "a formal service-level agreement" (Guidelines, 2.10). The February 2025 Appendix asks for a list of third-party providers and due diligence on their cybersecurity, and asks that SLAs cover "the reporting procedures for cybersecurity incidents". For cloud, it asks for controls on the root account "such as two-factor authentication and IP whitelisting". Firms should "change API keys regularly, and avoid using permanent keys", and keep daily offline backups that are "Write-Once-Read-Many (WORM)" and "air-gapped".

Under section 130 of the Securities and Futures Ordinance, "a licensed corporation shall not, without the SFC's prior written approval, use any premises for keeping records or documents relating to the carrying on of the regulated activity for which it is licensed" (2019 circular, paragraph 3). That circular's general controls apply whether or not records are kept only with the provider (paragraph 11). They include encryption or equivalent safeguards, keeping "possession of the encryption and decryption keys" (paragraph 14), a clear split of security responsibilities (paragraph 17) and an exit strategy (paragraph 20). The June 2026 Appendix suggests assessing providers against frameworks "such as ISO/IEC 27001", COBIT and NIST (section (D)).

What this means for your IT

  • Keep a register of IT providers and when each was last assessed.
  • Check that SLAs cover security measures and incident notification.
  • Lock down the cloud root account, rotate API keys, and test restores from immutable offline backups.
  • Ask compliance whether any regulatory records exist only in the cloud.

Data, backups and records

What the documents say. Business records, client and transaction databases, servers and documentation should be backed up "in an off-line medium on at least a daily basis" (Guidelines, 2.8). The Internal Control Guidelines call for "the integrity, security, availability, reliability and thoroughness of all information" (Section IV). The June 2026 circular asks firms to "ensure the availability of the backup copies" (paragraph 17).

What this means for your IT

  • Check daily backups, keep one copy offline, test restores, and keep a rollback method for major changes.

Incident handling and reporting

What the documents say. A firm should report to the SFC immediately upon "any material failure, error or defect in the operation or functioning of its trading, accounting, clearing or settlement systems or equipment" (Code of Conduct, 12.5(e)). The Guidelines ask for written escalation and reporting procedures (3.2). They also ask for contingency plans covering DDoS and "total loss of business records and client data resulting from cyber-attacks (eg, ransomware)" (2.9). The July 2026 circular asks for hacking incidents to be reported "to the SFC immediately", with root cause analysis (paragraph 18). It warns that "the SFC will hold the relevant firm accountable for the losses suffered by its clients" where a firm fails to prevent, detect and stop large-scale unauthorised transactions (paragraph 25). The June 2026 circular asks for "pre-planned containment and exploit-interruption strategies" (paragraph 15). It also asks for testing through "tabletop exercises, simulated attacks or other appropriate means" (paragraph 16).

What this means for your IT

  • Write a runbook that names who decides on containment and who contacts the SFC.
  • Pre-approve containment steps such as isolating hosts and disabling accounts.
  • Run a yearly tabletop exercise on a ransomware or account-takeover scenario.

Governance, people and testing

What the documents say. Responsible officers or executive officers in charge of internet trading should set out a cybersecurity risk management framework; tasks can be delegated in writing, but "overall accountability remains with the responsible officer(s) or executive officer(s)" (Guidelines, 3.1). The February 2025 circular states that "senior management, in particular the MIC-IT, is ultimately responsible for the identification, monitoring and mitigation of the cybersecurity risks faced by LCs". All internal system users should have awareness training "at least on a yearly basis" (Guidelines, 3.3), and "phishing should be included as one of the training topics" (February 2025 Appendix). The May 2025 circular reminds LCs not to send messages "with embedded hyperlinks that direct clients to their websites or mobile applications to undertake transactions" (item 1).

What this means for your IT

  • Give the MIC-IT a regular report on vulnerabilities, patching, incidents and tests.
  • Run yearly training that covers phishing, and keep the attendance records.
  • Remove links to trading or login pages from client emails and SMS messages.

How Dual Layer IT can help

Dual Layer IT is ISO/IEC 27001:2022 certified, and our engineers hold CISSP, CISM and CISA certifications.

  • IT compliance audits: we check your controls against the SFC documents above and list the gaps by priority.
  • Cybersecurity: we set up and run MFA, logging, vulnerability management and incident response planning.
  • Managed IT: we handle patching, backups and access reviews, and keep records of the work.

Frequently asked questions

Do the Cybersecurity Guidelines apply if we do not offer internet trading?

They apply to firms engaged in internet trading (paragraph 3), but the June 2026 circular is addressed to all LCs. Its Appendix says firms in electronic trading, particularly large retail brokers, are "generally expected to implement all of the following measures", and other firms should consider them. In February 2025 the SFC said it planned to "develop an industry-wide cybersecurity framework to provide guidance to all LCs" (February 2025 circular, "Way forward"). Check the SFC website for updates.

Can we keep using SMS one-time passwords?

For client login and device binding at internet brokers, the July 2026 circular says OTP should not be used (paragraph 7). It sets 8 July 2027 as the latest date for robust authentication, and large internet brokers should act immediately (paragraph 21(c)). Firms still using OTP in the meantime should strengthen monitoring for irregular logins and unauthorised trading (paragraph 22).

Do we need SFC approval to use the cloud?

Section 130 approval for the provider's data centre is needed if regulatory records are kept exclusively with an external provider (2019 circular, paragraphs 7 and 8). The extra requirements do not apply if a full identical set is also kept at approved premises in Hong Kong, for example where the cloud is only used for backup (2019 circular, paragraph 6). The general controls in section E apply in both cases.

How quickly should a cyber incident be reported?

The Code of Conduct says "immediately" for material system failures (12.5(e)). The July 2026 circular says the same for hacking incidents (paragraph 18). The June 2026 circular asks firms to "promptly notify the SFC of material cybersecurity incidents and attacks" (paragraph 18).

Sources

This page summarises SFC publications for information. It is not legal or regulatory advice; read the documents in full and take advice from your compliance team.

Send us a message

All fields are required unless marked optional.

Thank you.

Your message has reached our team. A consultant or engineer will reply within two business days.