The 5-minute Monday briefing for Hong Kong’s small licensed firms.

On 2 June 2026 the SFC issued Circular 26EC32 to licensed corporations, SFC-licensed virtual asset service providers and their associated entities, asking them to review and enhance their cybersecurity measures against attacks assisted or accelerated by frontier AI tools. Earlier issues here covered the patching and asset-inventory half. Two other sections are just as specific and get less airtime: access and privilege controls, and incident response and recovery.

On access, the circular says firms should design system controls on the assumption that any user, device, privileged account or network component may be compromised. It lists what that means in practice:

• enforce least-privilege access to all business critical components, including limiting connectors and tool permissions to what the use case needs, and safeguard privileged accounts;
• enhance firewalls and network segmentation, with micro network segmentation where feasible to limit lateral movement;
• treat external and untrusted inputs — content from apps, emails, documents and webpages — as potentially adversarial, so they cannot directly alter system instructions or trigger privileged actions;
• apply maker-checker controls for high-impact actions.

On response, it warns that AI-enabled attacks may unfold faster than traditional detection and response can handle, and that relying on post-incident investigation or normal escalation channels may let the attack continue or worsen. Firms should have escalation and reporting mechanisms and consider pre-planned containment strategies, including the ability to block malicious activity, isolate affected systems and restrict access rapidly. They should test the plans through tabletop exercises, simulated attacks or other appropriate means, back up business records, client and transaction databases and supporting documentation regularly, and promptly notify the SFC of material cybersecurity incidents.

• Who’s in scope: licensed corporations, SFC-licensed VASPs and their associated entities. The circular puts ultimate responsibility on senior management, including the Manager-in-Charge of Information Technology (MIC-IT).
• What to do: review your access, privilege, containment and recovery arrangements against the circular’s sections, using the examples in its Appendix.
• By when: no date is given. The SFC says it may issue further guidance, conduct reviews of preparedness, or take supervisory action where appropriate.