Hong Kong’s SFC was among the first securities regulators anywhere to issue dedicated generative-AI guidance. The result is one of the clearer supervisory positions in Asia: no new statute, but specific written expectations that examiners can hold firms to.

What the SFC’s generative AI circular requires

High-risk uses of generative AI need stronger controls, and the SFC names AI output reaching a client as advice as high-risk. The SFC’s circular to licensed corporations of November 2024 applies a risk-based lens to generative AI. Uses classed as high-risk (notably generating investment recommendations or advice to clients) attract stronger expectations around senior management responsibility, model testing, output review and third-party vendor risk [1].

Naming it matters. Where other regulators leave “high-risk” to interpretation, the SFC put the core advisory activity (AI output reaching a client as a recommendation) explicitly in the top tier. A licensed firm using a language model anywhere near client-facing advice should assume the strongest expectations apply: senior management owns it, the model is tested, the output is reviewed, and the vendor is diligenced.

HKMA guidance on generative AI for banks

Banks have their own parallel track. The HKMA issued parallel guidance for banks on consumer-protection aspects of generative AI in August 2024, alongside a sandbox for supervised experimentation. Between the two regulators, Hong Kong’s position is unusually legible: the expectations are written down, they are specific, and they arrived early.

Hong Kong’s 2026 moves on agentic AI

Through 2026 Hong Kong’s regulators turned their attention to AI agents. In March 2026 the HKMA, SFC, Insurance Authority and MPFA jointly launched GenA.I. Sandbox++, extending the banks-only sandbox across all financial sectors, and its first cohort, announced in August 2026, is explicitly focused on agentic AI: 36 use cases across 30 institutions. The privacy regulator matched the move: the PCPD published a supplement on protecting personal data in the use of agentic AI in August 2026, extending its 2024 model framework, and has been running AI compliance checks across organisations since early 2026.

For a licensed firm the message is that the supervisory infrastructure for AI agents is being built now, and the firms experimenting inside governance, rather than ahead of it, are the ones the regulators are designing for.

What a Hong Kong licensed firm should do now

Put the standard controls in place and add model testing for any high-risk use. The SFC’s expectations map directly onto the core set of controls in the overview: a named accountable senior manager, meaningful review of client-facing output, vendor due diligence, and the records to evidence all of it, plus Hong Kong’s particular emphasis on model testing for high-risk uses.

For firms serving clients across borders from Hong Kong, the usual layering applies: the SFC circular sets the local floor, and EU-resident or US-resident clients bring GDPR, EU transparency obligations and SEC substantiation expectations on top; the mechanics are in AI governance for cross-border financial advisers. A baseline built to the strictest regime satisfies the SFC’s circular almost by construction.

This article is for informational purposes only and does not constitute regulated financial advice, legal advice, or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.

Sources

[1] Securities and Futures Commission of Hong Kong, ‘Circular to licensed corporations — Use of generative AI language models’, 12 November 2024. Available at: https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/openAppendix?refNo=24EC55&appendix=0