Hong Kong SFC — Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading

Why does it matter?

The Guidelines are the SFC's minimum standard for protecting clients' internet trading accounts, and the SFC checks them in thematic reviews and cites them in circulars. Senior management cannot hand off accountability: delegation is allowed in writing, but overall accountability stays with the responsible officers or executive officers (3.1).

Key benefits include:

• Two-factor login comes first

Requirement 1.1 calls for two-factor authentication for login to clients' internet trading accounts, using any two of what a client knows, has or is.

• Clients are told quickly

Requirement 1.3 requires prompt notices of logins, password resets, trade executions, transfers to unregistered third-party accounts and changes to account information, sent through a channel different from the one used for login.

• Patches have a clock

Requirement 2.4 says to implement security patches or hotfixes within one month following completion of testing.

• The SFC tests firms against it

Its February 2025 thematic review reported unqualified two-factor authentication, delayed patching, weak encryption algorithms, excessive administrator access and missing audit trails.

• Phishing-resistant login is next

The SFC's 9 July 2026 circular says OTP does not meet its expectation for login and device binding, and sets 8 July 2027 as the latest date for the change.

How does it work?

The Guidelines open with a scope statement (paragraphs 1 to 5) and then list the 20 requirements. Group 1 covers client accounts: two-factor authentication, monitoring and surveillance, prompt notification, data encryption, protection of login passwords, and password policies and session timeout. Group 2 covers infrastructure: network, user access, remote connection, patching, end-point protection, unauthorized installation, physical security, backup, contingency planning and third-party providers. Group 3 covers governance, incident reporting, staff training and client alerts.

The SFC says the controls can reduce or mitigate hacking risks but cannot eliminate them, that they are minimum standards and not exhaustive, and that firms should implement measures commensurate with their structure, business operations and needs (paragraph 5). A firm reviews the user access list of critical systems and databases at least yearly (2.2), takes backups in an off-line medium at least daily (2.8) and gives all internal system users cybersecurity awareness training at least yearly (3.3).

The 2025 and 2026 circulars add expectations on top of the text. The 2 June 2026 circular on AI-enabled cyberattacks asks licensed firms to keep an accurate technology asset inventory, expedite patching, apply least-privilege access and review incident response, and holds the Manager-in-Charge of Information Technology ultimately responsible.

Key Elements

• Account protection (1.1 to 1.6)

Two-factor authentication, monitoring to detect unauthorized access, client notifications, strong encryption of credentials and trade data in transit, system-generated passwords sent through a channel free from staff intervention, and password and session timeout controls.

• Network and access controls (2.1 to 2.3)

A secure network with a Demilitarized Zone and multi-tiered firewalls around critical systems, need-to-have user access reviewed yearly, and security controls over remote connections.

• Patching and endpoint control (2.4 to 2.6)

Patches implemented within one month after testing, anti-virus and anti-malware kept current on critical servers and workstations, and controls to prevent unauthorized installation of hardware and software.

• Physical security, backup and contingency (2.7 to 2.9)

Physical access controls for critical components, daily off-line backups with a roll-back method for major changes, and contingency plans that cover distributed denial-of-service attacks and total loss of records through ransomware.

• Third-party providers (2.10)

A formal service-level agreement that lets the firm meet Paragraph 18 and Schedule 7 of the Code of Conduct and these Guidelines, reviewed and revised regularly.

• Cybersecurity management and supervision (3.1 to 3.4)

Responsible officers define the cybersecurity risk management framework, approve policies and budget and run a regular self-assessment. Written incident escalation procedures, yearly staff training and client cybersecurity alerts complete the group.

What does it cover?

The Guidelines apply to persons engaged in internet trading who are licensed by or registered with the SFC for Type 1 (dealing in securities), Type 2 (dealing in futures contracts), Type 3 (foreign exchange trading, licensed traders only) or Type 9 (asset management, only for funds distributed through internet-based trading facilities). Internet trading means order instructions sent through an internet-based trading facility (Code of Conduct paragraph 18.2(f)).

What are its objectives?

The Guidelines pursue three practical aims for internet trading firms.

Protect clients' internet trading accounts with two-factor authentication, monitoring, notifications, encryption and password controls (1.1 to 1.6).

Secure the infrastructure that carries trading and settlement: network, access, patching, backup and third-party arrangements (2.1 to 2.10).

Place cybersecurity oversight with responsible officers, with incident reporting, training and client alerts (3.1 to 3.4).

Framework in Context

The Guidelines sit under the SFC's Code of Conduct framework and were issued after consultation. The Hong Kong Monetary Authority issued a parallel circular to registered institutions on the same day. Later SFC circulars (6 February 2025, 2 June 2026 and 9 July 2026) apply and extend them for internet brokers and virtual asset service providers. The SFC says its controls can reduce but not eliminate hacking risks, so firms add measures that suit their own business.

Common Framework Mappings

Organizations commonly map established international standards and regulatory regimes to the SFC guidance to harmonize controls, demonstrate compliance across jurisdictions, and simplify audits and vendor assessments.

Mapped frameworks include:

EU DORA

ISO 27001:2022

ISO 27002:2022

ISO 27017

ISO 27018

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5

SWIFT CSCF