Hong Kong’s SFC was among the first securities regulators anywhere to issue dedicated generative-AI guidance, and the result is one of the clearer supervisory positions in Asia: no new statute, but specific written expectations that examiners can hold firms to.

The SFC circular: a risk-based lens with named high-risk uses

The SFC’s circular to licensed corporations of November 2024 applies a risk-based lens to generative AI. Uses classed as high-risk (notably generating investment recommendations or advice to clients) attract stronger expectations around senior management responsibility, model testing, output review and third-party vendor risk [1].

The naming matters. Where other regulators leave “high-risk” to interpretation, the SFC put the core advisory activity (AI output reaching a client as a recommendation) explicitly in the top tier. A licensed firm using a language model anywhere near client-facing advice should assume the strongest expectations apply: senior management owns it, the model is tested, the output is reviewed, and the vendor is diligenced.

The HKMA’s parallel track for banks

The HKMA issued parallel guidance for banks on consumer-protection aspects of generative AI in August 2024, alongside a sandbox for supervised experimentation. Between the two regulators, Hong Kong’s position is unusually legible: the expectations are written down, they are specific, and they arrived early.

The 2026 layer: agentic AI moves to the front

Hong Kong’s machinery kept moving through 2026, and the direction is agents. In March 2026 the HKMA, SFC, Insurance Authority and MPFA jointly launched GenA.I. Sandbox++, extending the banks-only sandbox across all financial sectors, and its first cohort, announced in August 2026, is explicitly focused on agentic AI: 36 use cases across 30 institutions. The privacy regulator matched the move: the PCPD published a supplement on protecting personal data in the use of agentic AI in August 2026, extending its 2024 model framework, and has been running AI compliance checks across organisations since early 2026.

For a licensed firm the signal is clear: the supervisory infrastructure for AI agents is being built now, and the firms experimenting inside governance, rather than ahead of it, are the ones the regulators are designing for.

What this means in practice

The SFC’s expectations map directly onto the converged core in the overview: a named accountable senior manager, meaningful review of client-facing output, vendor due diligence, and the records to evidence all of it, plus Hong Kong’s particular emphasis on model testing for high-risk uses.

For firms serving clients across borders from Hong Kong, the usual layering applies: the SFC circular sets the local floor, and EU-resident or US-resident clients bring GDPR, EU transparency obligations and SEC substantiation expectations on top; the mechanics are in AI governance for cross-border financial advisers. A baseline built to the strictest regime satisfies the SFC’s circular almost by construction.

This article is for informational purposes only and does not constitute regulated financial advice, legal advice, or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.

Sources

[1] Securities and Futures Commission of Hong Kong, ‘Circular to licensed corporations — Use of generative AI language models’, 12 November 2024. Available at: https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/openAppendix?refNo=24EC55&appendix=0