Hong Kong SFC warns licensed firms on AI-enabled cyber threats

The Securities and Futures Commission (SFC) today issued a circular calling on licensed firms to strengthen cybersecurity measures against emerging threats enabled by frontier artificial intelligence (AI) models. the action follows cyberattacks continue to evolve locally and globally, with Hong Kong recording a 27% increase in overall cyberattack incidents last year to 15,877, according to data from the Hong Kong Computer Emergency Response Team Coordination Centre.

The SFC warns that fast-advancing frontier AI models have the potential to enable more frequent, targeted, and sophisticated cyberattacks, which could result in significant operational disruptions and risks for licensed firms, their staff, and clients. Recent advancements in AI have made it easier for malicious actors to identify and exploit system vulnerabilities at a faster pace, coordinate attacks across multiple interconnected systems, and orchestrate large-scale attacks.

The proliferation of AI-enabled tools lowers barriers for malicious actors to engage in phishing, social engineering, deepfake impersonation, and reconnaissance. Consequently, licensed firms are exposed to heightened cybersecurity risks.

The SFC urges licensed firms, especially internet brokers and virtual asset trading platforms, to implement robust and up-to-date measures to protect their systems, prevent unauthorized access or disclosure of confidential client information, and safeguard client assets against misappropriation.

The circular sets out areas for licensed firms to review and enhance their cybersecurity frameworks, including patching and vulnerability management, detection and monitoring measures, as well as incident response and recovery. Dr Eric Yip, the SFC's Executive Director of Intermediaries, stated that cybersecurity risk remains a top supervisory focus and that senior management should shoulder primary responsibilities in gatekeeping firms' cyber resilience and the security of client assets.

The SFC will continue to engage with the industry, technology service providers, and local and overseas regulators on this issue. As part of its ongoing efforts, the SFC will organize webinars to raise industry awareness, conduct thematic reviews to assess licensed firms' preparedness and resilience in responding to cybersecurity incidents and attacks, and take appropriate supervisory action in response to these evolving risks.