In April 2026, Anthropic reported that its Claude Mythos Preview model demonstrated capabilities in identifying and exploiting zero-day vulnerabilities11 in major operating systems and web browsers when directed to do so. Meanwhile, Hong Kong recorded 15,877 cybersecurity incidents in 2025, more than 26% year-on-year increase22. The need for robust cybersecurity protection across infrastructures has never been higher in view of heightened cyberattack risks posed by frontier artificial intelligence (AI) models. Against this backdrop, financial services regulators are increasingly concerned about the compression of cyberattack timelines, made possible by the growing capabilities and sophistication of AI-enabled tools. AI-enabled tools significantly accelerate the speed and increase the scale and efficiency in vulnerability discovery and exploitation, and in launching cyberattacks. On 2 June 2026, the Securities and Futures Commission (SFC) issued a circular (Circular) to licensed corporations, SFC-licensed virtual asset service providers and their associated entities (collectively, “Licensed Firms”). In the Circular, the SFC reminds Licensed Firms to review and enhance their cybersecurity measures to address evolving threats posed by AI-enabled cyberattacks, and provides practical guidance on enhancing resilience and response strategies. Key takeaways Accountability of senior management. The senior management, including the Manager-in-Charge of Information Technology (MIC-IT), of a Licensed Firm is ultimately responsible for managing cybersecurity risks. Frontier AI models increase sophistication and frequency of cyberattacks. Frontier AI models are capable of: detecting zero-day vulnerabilities systematically identifying and chaining up multiple “lower risk-rated” vulnerabilities33 planning and executing complex, multi-step actions autonomously Used together, these AI-enabled tools amplify and multiply the disruptive impact of cyberattacks by: discovering and exploiting software or system vulnerabilities which have escaped the attention of or been neglected by their providers or users orchestrating large scale attacks across multiple interconnected systems significantly reduce the cost and technical resources for threat actors by phishing, social engineering, deepfake impersonation and reconnaissance Cybersecurity safeguards should be robust, up-to-date and implemented promptly. To address the evolving AI-enabled cyber risks, Licensed Firms should assess their preparedness and review whether their existing cybersecurity prevention, detection, response and recovery controls and procedures remain relevant and effective. In particular: as a foundation, a Licensed Firm should maintain an accurate and up-to-date inventory of its technology assets and components, including hardware, software, network infrastructure, databases and cloud services, and identify externally exposed or third-party dependent, business critical assets or components. This facilitates the Licensed Firm to prioritise and direct remediation and protective resources and measures to the highest risk areas promptly and effectively MIC-IT should ensure that changes to the cybersecurity framework of the Licensed Firm are adequately reviewed and approved and that enhancements to its cybersecurity measures are implemented properly and promptly software patching and change management processes should be enhanced to expedite patch and vulnerability management processes to minimise the window of exposure to potential attacks Additional risks associated with use of AI language models. The SFC reminds Licensed Firms that use AI language models in their operations to address the increased and additional cyberattack risks arising from AI-assisted adversarial attacks against AI language models, data leakage and system prompt override. Any Licensed Firm that intends to adopt AI language models in its high-risk use cases is required to comply with the notification requirements under the Securities and Futures (Licensing and Registration) (Information) Rules, Cap. 571S. Five areas for review and enhancement. The SFC identifies the following areas for review and enhancement by Licensed Firms: patching and vulnerability management—a Licensed Firm should: review and enhance its patching and vulnerability management processes take prompt actions to address known vulnerabilities implement adequate policies and procedures for handling urgent and critical fixes outside routine patching cycles, especially those affecting its business critical assets or components allocate sufficient resources to handle potential surges in patching demands access and privilege controls—a Licensed Firm should: design system controls based on a “zero-trust” assumption, i.e. any user, device, privileged account or network component may be compromised implement robust access and privilege controls and minimise attack surfaces detection and monitoring—a Licensed Firm should: strengthen its threat detection and monitoring of anomalies in client trading activities and system activities improve its threat intelligence gathering capability third-party supply chain risk management—a Licensed Firm should ensure proper management of cybersecurity risks associated with third-party service providers, and: implement proper procedures to address AI-enabled threats targeting third-party service providers that support its critical operations and business critical assets or components, strengthen its third-party supply chain risk governance enhance initial and ongoing assessments on third-party service having regard to the latest threat landscape incident response and recovery—a Licensed Firm should: review and enhance its cybersecurity incident handling procedures and contingency plans to effectively handle AI-enabled cyberattacks that may result in unauthorised access to its network and system, leakage of sensitive information, and significant disruption of services establish adequate escalation and reporting mechanisms and consider pre-planned containment and exploit-interruption strategies including the ability to block malicious activities, isolate affected system and restrict access rapidly, to counter the speed of AI-enabled attacks and inadequacy of traditional detection-and-response processes promptly notify the SFC of material cybersecurity incidents and attacks implement backup strategies backing up business records, client and transaction databases and supporting documentation on a regular basis, and implement proper measures to ensure the availability of the backup copies  Action points and takeaways for Licensed Firms The Circular is a timely reminder that Licensed Firms should review and assess the effectiveness of their existing cybersecurity frameworks and controls, and make necessary changes or enhancements to address more frequent, more targeted, speedier cyberattacks with more extensive disruptive impact enabled or assisted by AI tools. Licensed firms should seek advice and assistance from IT security experts as necessary. Tackling the human weakness From our experience in handling cybersecurity incidents, the human element remains a primary risk factor. While AI-enabled tools significantly amplify technical threat capabilities, the fundamentals have not changed. Human behaviour remains one of the most common root causes of cybersecurity breaches. Phishing, social engineering, deepfake impersonation of senior management or trusted counterparties, and insider threats continue to be among the most prevalent initial attack vectors, and AI-enabled tools are making these techniques more convincing and scalable than ever. Licensed Firms should treat the human element as a core and distinct component of their cybersecurity risk programme, implementing regular and targeted staff awareness training, simulated phishing exercises, robust behavioural controls around privileged accounts and clear protocols for verifying requests involving sensitive data or financial transactions. Building a robust cybersecurity programme In building a robust cybersecurity programme, Licensed Firms should also take a holistic view of their attack surface, one that extends well beyond patching and technical vulnerabilities. The attack surface of every organisation is different but key considerations include: The implementation of strong access control frameworks and privileged access management (PAM) to restrict, monitor and audit the use of elevated accounts; Proper network segmentation and micro-segmentation to contain lateral movement in the event of a breach; The ring-fencing of backup environments so they cannot be reached or compromised during an active attack; and Rigorous third-party vendor management to address supply chain risks, including AI-enabled threats targeting critical service providers. As the Circular expressly identifies, robust access and privilege controls, zero-trust network architecture and comprehensive third-party supply chain risk governance are all essential components of a sound cybersecurity framework. Crucially, however, no cybersecurity programme can be truly effective if it is applied as a generic standard—there is no one-size-fits-all. Each Licensed Firm should develop and maintain a programme that is calibrated to its specific operational profile, risk environment, and in particular the human element unique to that organisation: the behaviour, culture, security awareness and risk appetite of the people who operate within it. Practice makes perfect—conducting realistic tabletop exercises and simulated attack scenarios Cybersecurity risk is qualitatively different from other operational risks faced by Licensed Firms and should be treated accordingly. Unlike most categories of business disruption, a serious cyberattack has the potential to cripple an organisation with exceptional speed, simultaneously impairing its ability to operate systems, communicate internally and externally, access its own data and serve clients, while also exposing confidential information and client assets to ongoing harm. The velocity at which a cyber crisis can escalate, and the volume of concurrent workstreams that must be managed in parallel, encompassing technical containment and eradication, digital forensics, parallel regulatory and legal analysis, client and counterparty notifications, ransom negotiation considerations, crisis communications and regulatory reporting can rapidly overwhelm even a well-resourced organisation that has not prepared adequately. Critically, these workstreams compete simultaneously for senior management attention and decision-making capacity, with each hour of delay potentially compounding the harm. Licensed Firms must therefore go beyond having an incident response plan on paper. A plan that has never been tested is of limited value when a real crisis strikes. Firms should regularly rehearse their response capabilities through realistic tabletop exercises and simulated attack scenarios—conducted not only with internal teams, but alongside their external Digital Forensics and Incident Response (DFIR) providers and breach counsel. This practice ensures that roles, escalation pathways, decision-making authority, regulatory notification obligations and timelines, and external communications strategies are thoroughly understood and internalised before a crisis occurs, not discovered for the first time in the midst of one. Conclusion Cybersecurity is a governance and business resilience issue on a firm level, and not merely an IT issue. Senior management of a Licensed Firm is ultimately responsible to the SFC for managing cybersecurity risks. The SFC may issue further guidance, conduct reviews to assess Licensed Firms’ preparedness and resilience in responding to cybersecurity incidents, and take supervisory action where appropriate. Reading materials SFC urges licensed firms to guard against emerging AI-enabled cyber threats

The Securities and Futures Commission (SFC) rolled out its tokenisation-related regulatory framework in November 2023, focusing on primary dealing of tokenised SFC-authorised investment products (Tokenised Products).11 On 20 April 2026, the SFC launched a new regulatory framework to pilot 24/7 secondary trading of Tokenised Products by the public. The latest move is to catalyse the next phase of growth of Hong Kong’s digital asset ecosystem with robust investor safeguards. Supported by potential use of regulated stablecoins and tokenised deposits to facilitate round-the-clock liquidity, secondary trading further integrates Tokenised Products with the broader Web3 ecosystem in Hong Kong. The demand of investors reacting to an increasingly fast-moving and uncertain market environment can be better met. Key takeaways In its Circular on intermediaries engaging in tokenised securities-related activities, dated 2 November 202322, the SFC made two important clarifications: Whether a tokenised security is a complex product or not is based on the assessment of the complexity of its underlying traditional security. The tokenisation of traditional securities, on its own, will not turn a non-complex traditional security to a complex product. As tokenised securities are fundamentally traditional securities with a tokenisation wrapper, the SFC is of the view that there would be no need to impose a mandatory Professional Investor-only restriction on the distribution and marketing of security tokens. The above clarifications smooth the path for the secondary trading of Tokenised Products. The SFC expects the initial batch of products to focus on tokenised money market funds. The SFC will review the operation of these funds and consider expanding the product scope in due course. Drawing on the experiences of Hong Kong’s robust exchange-traded fund market and SFC-licensed virtual asset trading platform operators (SFC-licensed VATPs), the SFC prescribes the requirements for secondary trading in its Circular on secondary trading of tokenised SFC-authorised investment products dated 20 April 202633 and updates its Circular on tokenisation of SFC-authorised investment products44. The requirements aim to support fair and orderly secondary trading of Tokenised Products. The requirements cover trading channel; fair pricing; liquidity provision; disclosure and client onboarding; and notification. The requirements are principally designed to facilitate on-platform secondary trading of SFC authorised open ended funds. The SFC may consider accepting other types of products with modified requirements as appropriate. Trading channel SFC-licensed VATPs: May offer secondary trading of Tokenised Products retail investors via on-platform trading (i.e. on-screen auto-matching trading); Should execute an on-platform trade of Tokenised Products for a client only if the client’s account has sufficient capital or product holdings of equivalent trading fungibility to cover that trade. On-platform trading of Tokenised Products should follow the existing trading operation, rules and risk control measures applicable to SFC-licensed VATPs’ on-platform trading of virtual assets under the Guidelines for Virtual Asset Trading Operators (VATP Guidelines)55. Tokenised Product providers and SFC-licensed VATPs: Should work together to ensure that the on-platform trading arrangements are satisfactory, including operational processes, risk controls and system readiness. Fair pricing SFC-licensed VATPs should implement effective risk management and supervisory controls to ensure fair pricing of Tokenised Products for on-platform trading, including: Alerting investors where the price to be executed would deviate significantly from the product’s real-time or near real-time indicative net asset value (NAV) per unit, based on a threshold reasonably set considering the product’s features (Price Deviation Alert). An SFC-licensed VATP should ensure that the Price Deviation Alert is displayed on its investor trading interface when the price to be executed deviates from the indicative NAV by more than the pre-set threshold; Informing investors that they may choose to subscribe or redeem at NAV in the primary market instead of trading in the secondary market and the resulting implications including, where applicable, subscription or redemption in the primary market is subject to normal trading hours; the use of liquidity risk management tools; and forward pricing that a subscription or redemption of fund units is executed at the next calculated NAV, which may be higher or lower than the prevailing secondary market prices; and Implementing system controls, automated pre-trade and regular post-trade monitoring and other controls reasonably designed to prevent excessive price fluctuations and market manipulation, and to identify suspicious market manipulative or abusive activities. An SFC-licensed corporation or registered institution which facilitates or directs its clients’ on-platform trading of Tokenised Products on SFC-licensed VATPs (Connecting Broker) should: Display the Price Deviation Alert on its trading interface and inform investors about the primary market alternative discussed above. The SFC expects Connecting Brokers to comply with paragraph 18 and Schedule 7 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission. Liquidity provision A Tokenised Product provider should: Use its best endeavours to arrange that each Tokenised Product has at least one market maker and that at least one market maker will give at least three months’ notice prior to terminating the market making arrangement; Closely monitor the secondary trading activities and liquidity of its Tokenised Products, maintain close dialogue with market makers engaged by it, establish appropriate business contingency plans, and take necessary remedial actions in the best interests of investors; Appoint SFC‑licensed corporations or registered institutions as distributors for its Tokenised Products to process creation and redemption requests from third-party investors, save for prescribed remote scenarios discussed in Question 1 of the Frequently Asked Questions on Exchange Traded Funds and Listed Funds66; and Put in place arrangements with SFC-licensed VATPs to facilitate the transfer of Tokenised Products across primary and secondary markets. An SFC-licensed VATP should: Conduct due diligence and regular monitoring of the performance of all market makers of the Tokenised Products admitted to its platform against the agreed terms; and be reasonably satisfied that they remain competent and properly resourced to duly discharge the market making functions; Ensure all such market makers maintain appropriate commitment to bid‑ask spreads, quote size of market making orders, minimum time for which a market making order is maintained and participation rates; Liaise with such market makers to rectify when they fall short of the obligations; and Specify in its arrangements with market makers: the eligible criteria and obligations applicable to market making for Tokenised Products; and arrangements in case a market maker is no longer available for a particular product. Disclosure and client onboarding Tokenised Product provider should ensure that the offering documents of a Tokenised Product offering secondary trading, including the product key facts statement, clearly set out: Associated risks with secondary trading of the Tokenised Product, including: liquidity risk price deviation risk price fragmentation risk market maker reliance risk Key information of: trading channels market making arrangements indicative ranges of fee items applicable to secondary trading, and a remark directing investors to the relevant SFC-licensed VATP’s website for details on secondary training arrangements; Circumstances for suspension of secondary trading of the Tokenised Product; and The list of market makers for the Tokenised Product (with a remark directing investors to a website for the latest list), and any affiliated entities of the Tokenised Product provider acting as the market makers, along with disclosures on the associated potential conflicts of interest. SFC-licensed VATPs and Connecting Brokers should maintain or provide access to online dedicated interfaces (e.g. website or app) to: Disclose information of trading arrangements, including trading channel, market making arrangement, eligibility criteria of market makers, fee schedules and price quotation / bid-ask spread; Disseminate real‑time or near‑real‑time indicative NAV per unit (typically updated at least every 15 seconds during trading hours), and last NAV per unit of the Tokenised Product with data source and update frequency; and Prominently highlight the risks associated with secondary trading of the Tokenised Product, such as liquidity and price deviation risks, price fragmentation risks and market maker reliance risks. SFC-licensed VATPs and Connection Brokers should obtain clients’ confirmation that they understand these risks, before onboarding them for secondary trading of the Tokenised Product. Notification Tokenised Product providers should: Give the SFC early alerts of any untoward circumstances relating to the Tokenised Products under their management, including issues which may adversely affect operations, secondary trading and liquidity of their Tokenised Products; and Immediately notify the SFC and investors as soon as practicable if: primary or secondary trading of the Tokenised Products is suspended or ceases, or market making activities cease, are disrupted or suspended. These notifications should include an assessment of the impact on the Tokenised Products, remedial actions and an appropriate contingency plan. Prior consultation, application and approval Tokenised Product providers should: Consult with the SFC in advance on new investment products with tokenisation features (whether primary dealing and/or secondary trading) that need the SFC’s authorisation; Consult with and obtain prior approval from the SFC before introducing tokenisation features for existing SFC-authorised investment products (whether primary dealing and/or secondary trading); and Consult with the SFC before making material changes to the secondary trading arrangement previously approved by the SFC, including changes to trading mechanism, Price Deviation Alert, market making arrangement and addition of trading channels. Intermediaries engaging in secondary trading of Tokenised Products (including SFC-licensed VATPs and intermediaries that intend to engage in OTC secondary trading) should: Notify and discuss their proposals with their case officers at the SFC (and also notify the HKMA where the intermediary is a registered institution) before engaging in secondary trading business for the first time; The above prior notification should be made as soon as practicable, and the SFC expects the intermediaries to notify the SFC in parallel when the Tokenised Product providers make prior consultations with the SFC on the matters above; and Notify their case officers at the SFC (and also notify the HKMA where the intermediary is a registered institution) if material changes are subsequently made to the arrangements communicated. Further reading Circular on secondary trading of tokenised SFC-authorised investment products (20 April 2026) Circular on tokenisation of SFC-authorised investment products (20 April 2026) Circular on tokenisation of SFC-authorised investment products (2 November 2023) Circular on intermediaries engaging in tokenised securities-related activities (2 November 2023)

While the Hong Kong Government was set to roll out legal basketball betting in late 2026, it unexpectedly halted its implementation in mid-April 2026 allegedly due to concerns over the surge of prediction markets. This marks a U-turn from the introduction and passing of the Betting Duty (Amendment) Bill 2025 in September 2025 to legalise basketball betting under a regulatory regime modelling the football betting regime. Basketball betting In June 2025, the Betting Duty (Amendment) Bill 202511 was gazetted with a view to introducing a regulatory framework with respect to basketball betting. One of the policy objectives is to combat illegal betting activities in Hong Kong.22 Following public consultation, the Bill was passed in September 2025. The new regime on basketball betting closely mirrors that for football betting. Under the Betting Duty Ordinance (Cap. 108): The Secretary for Home and Youth Affairs is granted power to issue a licence to a company to conduct betting on the results of, or contingencies relating to, basketball matches and to impose licensing conditions to minimize the negative impact of gambling on the public, including conditions relating to the categories of matches on which betting may be conducted. On the calculation and collection of betting duty, just as football betting, the betting duty is charged at 50% on the net stake receipts derived from authorised betting on basketball matches. However, the new regime was put on hold following the government’s announcement in mid-April 2026, citing that the introduction of basketball betting would be deferred pending a more in-depth review of the impact of the rapidly emerging overseas “prediction market” platforms, particularly those associated with illegal sports betting. The government stated that it was not an appropriate time to introduce a new betting product in Hong Kong, as there are concerns that more people may be drawn into illegal gambling.33 Meanwhile, other lawful gaming products in Hong Kong such as horse racing, football betting and Mark Six remain operative. Bearing in mind legal football betting has been in place for over two decades, it is not apparent how legalising another type of sport betting will promote illegal gambling. Nonetheless, in light of the government’s recent announcement, the timeline for implementing basketball betting regime remains uncertain. Prediction markets? Prediction market is a platform enabling bets to be placed on the outcomes of a future event, which can be a sport, political or economic event, and even weather-related changes. Bets are often placed by buying typically binary “yes” or “no” event contracts. The contract concludes once the future event is determined. According to the Investor and Financial Education Council (IFEC), an independent public organisation and a subsidiary of the Securities and Futures Commission of Hong Kong (SFC),  the trading price of a contract fluctuates and is influenced by the buying and selling activities of participants.44 Some platforms for prediction markets are built on blockchain and allow trading with cryptocurrencies.55 Hong Kong regulators caution: Prediction markets could cross into illegal gambling In April 2026, the IFEC warned that trading activities in prediction markets may constitute illegal gambling.66 The authority further noted that products under the prediction markets are not protected by the Securities and Futures Ordinance or any laws and regulations administered by the SFC. In particular, the Chief Executive of Hong Kong described prediction markets to be “more than gambling; it is to do with a lot of speculation that sometimes makes use of virtual assets.”77 Whether or not products traded on prediction markets fall under the ambit of the Gambling Ordinance (Cap. 148) has not been judicially tested in Hong Kong. The general position is that gaming involving an element of chance is unlawful unless licensed by the government or otherwise excepted under the statute. Betting with a bookmaker, whether or not the bet is received within or outside Hong Kong, is also prohibited. Regulatory outlook The government’s recent announcement reflects an unsettled legal status with respect to trading on the prediction markets. Specifically, the IFEC stated that “the trading activities and contracts of prediction markets are not investment products”.88 The precise boundary between high risk investment products and, at the opposite end of the spectrum, unlawful gambling remains to be delineated. Companies that have adopted, or are exploring the integration of, prediction markets in their businesses should remain vigilant and take a proactive approach to identifying and managing regulatory exposure and stay closely attuned to shifts in the regulatory landscape. In view of the recent halt of the legalisation of basketball betting, it is possible that an overhaul of the gaming legalisation which will cover both sports betting and prediction markets is under consideration.