Every issue, on the record.

009

12 October 2026

Assume the account is compromised: the half of the AI-cyber circular nobody circulated

The SFC published nothing new this week, so the Record's still-open guidance is the news. Circular 26EC32 tells licensed firms to design controls on the assumption that any user, device or privileged account may already be compromised, and to be able to block, isolate and restrict access fast. Most of the attention went to patching; the access and incident-response sections are the ones a one-person team can test this month.

008

5 October 2026

Futures clients, consent and the 2028 clock

After a month of silence the SFC issued three circulars on 30 September, and two of them start a clock. The investor identification regime for the exchange-traded derivatives market (HKIDR-DM) is scheduled for the second quarter of 2028, but obtaining client consent and updating client identification data are already listed tasks from Q3 2026. The consent rules are the part you can act on this quarter.

007

21 September 2026

The agenda is the message: cyber and scams, 28 September

Nothing has come off the SFC's circular wire since 4 September. The one dated item left standing is the SFC's own brokers' forum on Monday 28 September, and what it is about — supervisory observations and regulatory updates focused on cybersecurity and anti-scam measures — is the clearest statement of where supervisory attention is pointed that you will get this month.

006

7 September 2026

Private markets in a public fund, and the line at 50%

Circular 26EC55, issued 3 September, tells managers of SFC-authorised funds that any direct or indirect exposure to private credit or private equity must be spelled out in the offering document and KFS — how much, through what, and what can go wrong — and that once total exposure reaches 50% of NAV the fund is a complex product.

005

24 August 2026

You send the request, so you own the authorisation

Circular 26EC51, issued 20 August, tells licensed corporations, SFC-licensed VASPs and associated entities that where a payer bank does not ask the account owner to confirm a simplified eDDA setup, the firm that initiated it carries primary responsibility for proving that authorisation — and should verify who owns the account before the money moves.

004

17 August 2026

Nothing new off the wire — and one mandatory Saturday left

No SFC circular has landed since 29 July, but HKEX's Post Release Test 2 on Saturday 22 August is still mandatory for Exchange Participants and China Connect Exchange Participants under Circular 26EC44 — and it is the last compulsory rehearsal before the backbone cutover.

003

3 August 2026

Four regulators mapped the system's cyber wiring — and the vendors kept repeating

Joint Circular 26EC45 reports the first run of the HKMA–SFC–IA–MPFA Cyber Mapping exercise: no new systemic surprises, but recurring reliance on the same specialist third-party providers — and the Authorities will now use that map in day-to-day supervision.

002

27 July 2026

HKEX's mandatory network tests: two August Saturdays you can't skip

Circular 26EC44 sets HKEX's Post Release Test dates for the securities-market backbone upgrade — PRT 1 on 8 August and PRT 2 on 22 August are mandatory for Exchange Participants.

001

13 July 2026

Phishing-resistant logins are now the SFC's baseline

Circular 26EC35 sets the SFC's expected standards for internet brokers and VASPs: robust login authentication, device binding, and surveillance for hijacked accounts.