Hong Kong SFC & HKMA mandate stronger defenses against AI cyber threats

On June 10, 2026, Hong Kong's Securities and Futures Commission (SFC) and the Hong Kong Monetary Authority (HKMA) released circulars urging licensed firms and authorized institutions to urgently strengthen their cyber resilience against AI-enabled cyberattacks. The regulators explicitly cite the accelerating capabilities of frontier AI systems, which they expect will dramatically increase both the scale and speed of malicious attacks. Financial entities are now required to conduct thorough assessments of their existing defenses to anticipate and mitigate these evolving threats.

The joint directive marks a significant regulatory shift, as it acknowledges that traditional cybersecurity measures may be insufficient against AI-powered attack vectors such as automated social engineering, adaptive malware, and real-time vulnerability exploitation. The SFC and HKMA are demanding proactive risk assessments, enhanced monitoring systems, and upgraded incident response protocols. This move aligns with global trends where financial hubs like Singapore and the UK have issued similar guidance. For Hong Kong's financial sector, which processes trillions in assets, compliance will require substantial investment in both technology and staff training. The circulars emphasize that firms must not only protect their own systems but also ensure third-party vendors meet comparable cybersecurity standards.