Assume the account is compromised: the half of the AI-cyber circular nobody circulated
Nothing came off the SFC’s circular wire between 5 and 11 October. The most recent circulars are still the three of 30 September, which Nº008 covered. So this issue does what a quiet week is for: it picks one piece of open guidance and reads the part that got skipped.
Design as if one account is already compromised
On 2 June 2026 the SFC issued Circular 26EC32 to licensed corporations, SFC-licensed virtual asset service providers and their associated entities, asking them to review and enhance their cybersecurity measures against attacks assisted or accelerated by frontier AI tools. Earlier issues here covered the patching and asset-inventory half. Two other sections are just as specific and get less airtime: access and privilege controls, and incident response and recovery.
On access, the circular says firms should design system controls on the assumption that any user, device, privileged account or network component may be compromised. It lists what that means in practice:
- enforce least-privilege access to all business critical components, including limiting connectors and tool permissions to what the use case needs, and safeguard privileged accounts;
- enhance firewalls and network segmentation, with micro network segmentation where feasible to limit lateral movement;
- treat external and untrusted inputs — content from apps, emails, documents and webpages — as potentially adversarial, so they cannot directly alter system instructions or trigger privileged actions;
- apply maker-checker controls for high-impact actions.
On response, it warns that AI-enabled attacks may unfold faster than traditional detection and response can handle, and that relying on post-incident investigation or normal escalation channels may let the attack continue or worsen. Firms should have escalation and reporting mechanisms and consider pre-planned containment strategies, including the ability to block malicious activity, isolate affected systems and restrict access rapidly. They should test the plans through tabletop exercises, simulated attacks or other appropriate means, back up business records, client and transaction databases and supporting documentation regularly, and promptly notify the SFC of material cybersecurity incidents.
- Who’s in scope: licensed corporations, SFC-licensed VASPs and their associated entities. The circular puts ultimate responsibility on senior management, including the Manager-in-Charge of Information Technology (MIC-IT).
- What to do: review your access, privilege, containment and recovery arrangements against the circular’s sections, using the examples in its Appendix.
- By when: no date is given. The SFC says it may issue further guidance, conduct reviews of preparedness, or take supervisory action where appropriate.
- ConductClosing the loop on last week: 26EC60 requires consent records and the written log to be kept for as long as the person is a client and at least two years after, centrally and securely stored, with phone or electronic records backed up. Name the owner of that store before the first consent arrives.
- TechnologyThe hard date still running is 8 July 2027, the end of the 12-month implementation period in 26EC35 for robust client login authentication and device binding at internet brokers and SFC-licensed VASPs. Large internet brokers were expected to implement immediately.
- Products26EC55 (3 September) still expects managers of SFC-authorised funds with direct or indirect private market exposure to review each fund and update offering documents and key facts statements as soon as practicable. No date, so the clock is yours to set.
- AMLThe simplified eDDA deposit controls in 26EC51 (20 August) are still open: assess the risks of your own arrangements, including impersonation and unauthorised setup requests, and implement mitigating measures.
When the regulator can pause your listing application
No disciplinary action to report, so another supervisory warning from the Record, with a different angle from the one this section took in Nº005. On 30 January 2026 the SFC issued Circular 26EC4 to licensed corporations carrying out sponsor work, after it and the Stock Exchange observed declining quality in draft listing documents. Two consequences it spelled out are easy to miss. If a listing document is unreasonably lengthy, the regulators may put the vetting process on hold, and the SFC would generally expect the main body of a listing document not to exceed 300 pages, excluding experts’ reports in the appendices. Materially incomplete or unsatisfactory responses to regulators’ comments can also suspend vetting, which may delay the listing timetable, and the SFC said it would notify its regulatory counterparts.
The accountability sits with management. The circular says a sponsor’s Management is ultimately responsible for supervising sponsor work and cannot abrogate that responsibility by delegating operations. The internal reviews it required of selected sponsors had to be signed off by the Managers-In-Charge of Overall Management Oversight, and the SFC said it may inspect the results in its thematic inspections.
You may never sponsor a listing. The control that would have caught the problem is the one the circular names: a record of all sponsor work that shows why each transaction team was chosen and that enough resources were allocated to each engagement. If a regulator pauses your file, that record is the first thing it will ask for.
A quiet week is the cheapest time to rehearse the bad one. See you next Monday.
Get next Monday’s briefing in your inbox.
Five minutes, every Monday, 7:30am HKT. Free, unsubscribe anytime.
