Nothing new off the wire — and one mandatory Saturday left
Some weeks the regulator says nothing, and that is genuinely the news. The SFC’s circular list has not moved since 29 July, so this issue is about the clocks that were already running — one of which stops this Saturday. This issue was put to bed on Thursday 13 August; if something lands over the weekend it leads next Monday.
One mandatory Saturday left: HKEX Post Release Test 2 is on 22 August
Circular 26EC44, issued on 21 July, set out HKEX’s Post Release Tests ahead of the phased production launch of its upgraded backbone network for the securities market systems. The SFC described the schedule as tentative: PRT 1 on Saturday 8 August and PRT 2 on Saturday 22 August, both mandatory, with an optional PRT 3 on Saturday 5 September.
PRT 1’s date has now passed. PRT 2 is the last compulsory session on that schedule, and after it the only rehearsal left is one nobody is obliged to attend.
- Who's in scope: Exchange Participants and China Connect Exchange Participants are required to take part in PRT 1 and PRT 2. Other Relevant Regulated Intermediaries — SFC-licensed corporations and registered institutions caught by the Hong Kong Investor Identification Regime that use the SFTP channel to submit BCAN-CID Mapping Files and Reporting Forms to the Stock Exchange’s data repository — are invited, and non-EP RRIs may join voluntarily. The SFC encourages them to.
- What to do: confirm, in writing and from the person who will actually be at the keyboard on the day, that your firm is booked into PRT 2. If a vendor owns that connectivity, “they handle it” is not a record.
- By when: Saturday 22 August. The circular says further details on schedule and logistics would follow, and points firms to HKEX’s own circular dated 21 July 2026 and to subsequent SFC and HKEX communications — so check those before you rely on the dates above.
- TechnologyThe twelve-month clock on phishing-resistant login is still ticking. Circular 26EC35 gives internet brokers and SFC-licensed VASPs until 8 July 2027 to implement robust authentication for client login and device binding — but large internet brokers are expected to implement immediately, and firms that anticipate difficulty meeting the deadline are told to notify their case officer straight away, not at the end.
- ConductSame circular, the bit that is not on a 2027 timetable: the SFC expects firms to review their client notification, monitoring and surveillance measures and their hacking-incident response and reporting procedures and make the necessary enhancements immediately, and to raise client awareness of phishing as soon as practicable. Note too that the SFC does not consider OTP — email or SMS — to be phishing-resistant.
- AMLFATF’s June 2026 statements, relayed by the SFC in 26EC39, remain the current list: countermeasures for the DPRK and Iran, enhanced due diligence proportionate to risk for jurisdictions including Myanmar. If you have not re-run client and transaction exposure against it since mid-July, that is a twenty-minute job with a dated file note at the end of it.
- ProductsStill worth reading if you touch listed products: the SFC’s updated framework for authorising listed structured funds (26EC43, revised 24 July) covers leveraged and inverse products and the new Defined Outcome Listed Structured Funds category, and supersedes the two May 2020 L&I circulars.
Money that arrives, sits still, and leaves
No disciplinary action to report, so a supervisory observation from the Record that has aged well. On 17 November 2025 the SFC issued Circular 25EC62, telling licensed corporations, SFC-licensed VASPs and associated entities that it had observed illicit actors using licensed firms and virtual asset platforms for the layering stage of money laundering: frequent and swift deposits and withdrawals in client accounts that were never actually used for trading, with signs of smurfing — the same value broken into many smaller movements to stay under the radar.
The pattern is worth sitting with, because it is invisible to most of the controls a small firm actually runs. Onboarding due diligence will not catch it: the client passed, and the client is real. Suitability will not catch it: there are no trades to assess. What catches it is a monitoring rule nobody enjoys writing — funds in and out within a short window with little or no trading in between — plus somebody senior who reads the exceptions. The SFC used that circular to reiterate that senior management carry the responsibility for detecting and preventing this. If your Responsible Officers, MLRO and Managers-In-Charge cannot point to the report that would have surfaced a dormant-but-busy account this quarter, the honest position is that you would not have seen it either.
A quiet fortnight is a good week to close something old rather than start something new. See you next Monday.
Get next Monday’s briefing in your inbox.
Five minutes, every Monday, 7:30am HKT. Free, unsubscribe anytime.
