SFC circular to licensed corporations on the use of generative AI language models

What it is

On 12 November 2024 Hong Kong’s Securities and Futures Commission issued a circular to licensed corporations on the use of generative AI language models. It followed an SFC engagement with a cross section of firms that found them using these models for client enquiry chatbots, summarising information, generating research reports, identifying investment signals and writing code.

The circular names the risks the SFC is concerned about. Output can be inaccurate, biased, unreliable or inconsistent, including hallucination and drift over time. There is a heightened risk of cyberattack, data leakage and breaches of privacy and intellectual property law. And firms depend on a small number of external model providers, which creates concentration and resilience risk. An appendix lists non-exhaustive risk factors for firms to consider.

Who it applies to

Licensed corporations that offer services or functionality provided by AI language models, or by third-party products built on them, in relation to their regulated activities. It applies whether the model is developed or provided by the firm, a group company, an external provider or open source. Firms may apply it in a risk-based way, in proportion to the materiality and risk of each use case.

What it requires

Core Principle 1, senior management responsibilities. Senior management should make sure effective policies, procedures and internal controls, and adequate oversight by qualified people, are in place across the model lifecycle from development to decommissioning. The governance framework should identify high-risk use cases by considering potential harm to clients. Staff in business, risk, compliance and technology need competence in AI, data science and model risk. A firm can delegate functions such as validation to its group, but stays responsible.

Core Principle 2, AI model risk management. Firms should validate models before use and after material changes, run end-to-end testing from user input to output, including retrieval and content filtering components, and keep monitoring performance. Model development functions should be segregated from validation where practicable. Results should be documented. The SFC warns that relying on public benchmark results may not be enough. Where the model faces clients, the firm should prominently disclose that the client is dealing with AI and that output may not be accurate.

For high-risk use cases the SFC expects more.

• Validation and monitoring aimed at factual accuracy appropriate to the use case.
• A human in the loop reviewing output for factual accuracy before it reaches the user.
• Testing that output holds up under prompt variations.
• The AI disclosure made whenever the client interacts with the model.

Core Principle 3, cybersecurity and data risk. Controls should cover adversarial attacks on the model and its training data, with periodic adversarial testing where practicable. Non-public data should be encrypted at rest and in transit, browser extension risk managed, training data quality and bias addressed, and the PCPD’s AI Model Personal Data Protection Framework given due regard.

Core Principle 4, third-party provider risk. Firms should perform due diligence and ongoing monitoring of model providers, assess the provider’s own model risk management where they can, allocate cybersecurity responsibilities clearly, keep an inventory of third-party software in the model architecture, and have contingency plans if the AI service is disrupted.

Notification. Firms that intend to use AI language models in high-risk use cases are reminded of their duty to notify the SFC of significant changes in the nature of their business under the Information Rules, and are encouraged to discuss plans early.

Key dates

• 12 November 2024. Circular issued.
• 2 June 2026. The SFC issued a further circular to licensed corporations, licensed virtual asset trading platforms and associated entities on enhanced cybersecurity measures against AI-enabled cyberattacks. It points to the heightened risk from frontier AI models, which can find and chain vulnerabilities quickly, and expects firms to keep their technology asset inventories current enough for same-day prioritisation. It repeats the notification reminder for high-risk AI language model use.

How it relates to other frameworks

Banks that are registered institutions for securities business also answer to the HKMA, whose ART guidance of October 2026 covers the wider AI lifecycle. The SFC circular cites the NIST taxonomy of adversarial machine learning and the OWASP LLM checklist as references on attacks, and its lifecycle controls map well to the NIST AI RMF. Singapore’s MAS AI Risk Management Guidelines take a similar risk-based approach for groups operating in both markets.

A note on this page

This is Aicura’s reading of the SFC circular. It is not legal or regulatory advice and it is not the circular itself. Read the primary source on the SFC website, and take advice on how it applies to your firm.