top of page

ComplianceOne Newsletter – July 2026


The topics discussed in this monthly newsletter are as follows: 


Market News

  1. Hong Kong’s AUM grew 20% to record high: SFC’s 2025 survey on asset and wealth management

  2. The Hong Kong Securities & Futures Professional Association Urges the SFC to Optimize the CVAP Examination and Raises Concerns over Operating Costs under New VA Policies

  3. SFC welcomes new initiatives to advance Hong Kong’s fixed income and currency markets

  4. Research Paper No.79: Half-yearly Review of the Global and Local Securities Markets


Enforcement News

  1. SFC Suspends Wong Tim Hi for Nine months

  2. SFC reprimands and fines Victory Securities Company Limited $1.7 million and suspends its responsible officer for regulatory breaches

  3. SFC reprimands and fines China Industrial Securities International Asset Management Limited HKD 6.8 million for failing to properly identify and address red flags in dubious arrangements and other failures in managing private fund

  4. SFC reprimands and fines Bright Smart Securities International (H.K.) Limited HKD 2.8 million for internal control failures in monitoring suspicious trades

  5. SFC reprimands and fines Luk Fook Securities (HK) Limited HKD 2.1 million for inadequate cybersecurity control to fend off cyberattack

  6. Market Misconduct Tribunal finds Sir Dickson Poon culpable of insider dealing ahead of disclosure of HKD 1.15 billion corporate windfall

  7. A 26-year-old Hong Kong trader is rumoured to have embezzled HKD 150 million by trading Hynix ETFs


Regulatory Updates

  1. SFC and CSRC hold high-level enforcement cooperation meeting

  2. SFC and Securities Commission Malaysia sign MoU to expand mutual recognition of funds and facilitate simplified dual IPO listing framework

  3. SFC mandates phishing-resistant authentication methods for internet brokers and VATPs to protect client accounts

  4. SFC enhances regulatory framework for daily leveraged and inverse products to ensure orderly market trading




Markets News


1. Hong Kong’s AUM grew 20% to record high: SFC’s 2025 survey on asset and wealth management


The SFC’s Asset and Wealth Management Activities Survey 2025 confirms that Hong Kong had a record-breaking year. Total assets under management rose 20% year on end to $42.2 trillion, surpassing the previous peak in 2021, driven by a near tripling of net fund inflows (+193%). Growth was based across every major segment: asset management and fund advisory, private banking and private wealth management, and trust services.

 

Metric

2025

YoY Change

Total AUM

HKD 42,202 billion

+20%

Net Fund inflows

HKD 2,065 billion

+193%

Asset Management & Fund Advisory AUM

HKD 30,957 billion

+19%

Private Banking & Private Wealth Management AUM

HKD 12,945 billion

+24%

Assets held under Trusts

HKD 6,214 billion

+8%

Mainland-related firms’ AUM

HKD 3,949 billion

+28%

Registered open-ended fund companies

676

+43%

Type 9 licensed corporations

2,358

+7%

Type 9 licensed individuals

15,747

+5%

Total industry headcount

56,557

+5%


This survey points to a maturing, institutionally oriented and geographically diversified industry. International investors continued to account for the majority of AUM (54%), while asset managers increasingly allocated capital globally. 56% of Hong Kong managed assets were invested outside the Mainland and Hong Kong, with bonds recording double-digit growth for a second consecutive year. The report is indicative of high growth in Hong Kong’s fund ecosystem as SFC-authorised fund NAV rose 38% alongside registered OFC’s rising 43%. Single-family office population also grew to over 3,380 (rising roughly 680 over two years). Mainland-related firms outperformed the broader market, and mutual market access schemes (Stock Connect, ETF Connect, WMC, MRF) all saw expanded two-way activity.


SIGNIFICANCE:

Following the release of strong growth data, expect continued momentum on OFC reform, ETF related product rules and mainland connectivity. The standout signals such as the 43% jump in YoY OFC Growth signals Hong Kong’s domestic fund structures are gaining strong market traction and displacing traditional offshore vehicles for regional strategies. Additionally, the rise in mainland-affiliated asset net inflows (80%) underscores the continuing importance of “Southbound” capital corridor and cross-boundary connect schemes. Licensed firms growing 7% to 2,358 and licensed individuals rising to 15,747. This expands the addressable market for compliance and legal teams while heightening competition for qualified regulatory talent.



2. The Hong Kong Securities & Futures Professional Association Urges the SFC to Optimize the CVAP Examination and Raises Concerns over Operating Costs under New VA Policies


The Hong Kong Securities and Futures Professional Association (HKSFPA) met with the Legislative Council’s Deputy Commissioner for Financial Affairs and the Treasury, Mr. CHAN Joseph, and senior SFC officials including the executive director of intermediaries, senior director, and the head of the fintech group on 03 July 2026. The two sides exchanged ideas on a four core issues including the latest policies on virtual assets (VA), the licensing regime, operating costs, and the industry-wide Certification Programme for Virtual Asset Professionals (CVAP).


Numerous policy changes were discussed, including the removal of the previous 10% minimum exemption for virtual asset management and an immediate effective date of new rules without a transition period. However, arrangement details are yet to be clarified. Representatives of the HKSFPA stated plainly that new regulatory provisions are based on principle and lack operational guidance, placing significant operational and compliance pressures on firms engaged or entering into the virtual asset businesses.


CVAP Examination Reform Commitments

Commitment

Detail

Separation of course and examination

  • HKSI will decouple mandatory coursework from the examination.

  • Candidates will be able to sit the exam without attending compulsory classes, reducing talent training costs for firms

Examination Fee Reduction

  • Standalone exam will be supported by official study materials

  • Fees will be reduced to align with existing SFC examination benchmarks (HKSI Paper 2&3)

 

VATP Issues and Recommendations

Issue

Industry Concern

Recommendation

Hardware Security Modules (HSM)

HSM Supply is near monopolized driving high costs and limited bargaining power for intermediaries.

Regulators should adopt “technology neutral” principle and accept Multi-Party Computation (MPC).

Hot/cold Wallet Ratio Requirement

Hot wallet cap at 2% of total client assets and minimum 3 persons required per asset transfer requires significant manpower and time costs in daily operations.

Review and optimize ratio while maintaining risk controls.

Insurance Coverage

50% cold wallet insurance coverage is required with only 2 insurers that currently underwrite VA insurance. This creates extremely high premiums, reportedly demanding as high as 50% profit margins.

Encourage regulators to engage insurance industry to revise coverage ratios and introduce more rational actuarial models.

On-chain transfer fees

Substantial gas fees are generated by real-time individual transfers.

Allow batch processing within a compliant framework to reduce operational burden and transfer costs.

 

Beyond the discussion of CVAP and VA operating costs, the association raised five structural regulatory questions seeking further clarity. Firstly, to clearly delineate technology services and regulated activities. It aims to foster innovation by enhancing licensing transparency and expediting product approvals, while simultaneously clarifying market arrangements for tokenized assets. Furthermore, it will define the regulatory division of labor for VA payments and establish clear guidelines for private equity fund self-custody arrangements.

 

Key Area

Industry Concern/ Recommendation

Technology vs Regulated Activities

Urges clearer delineation of regulated activities; pure tech service providers not handling client assets or charging fees should not face unnecessary licensing burdens. Requests categorical guidance for models like tech access, system development, trading support and advisory.

Licensing Approval Transparency

Notes SFC manpower constraints causing uncertain VASP processing times; recommends adopting phased frameworks (e.g. “serviced offices“ model) and clearer timelines aid resources and capital planning.

Innovative Products & Tokenized Assets

Retail market limited to 5 spot pairs with no shorts/hedging; SFC’s Feb 2026 perpetual contract framework for pros lacks timelines/pilot details. Urges faster derivatives approval and clarity on price discovery, offshore data and trading hours for cross-market tokenized assets.

VA Payment Regulatory Division

Concerns over firms with only MSO (Customs) licenses conducting large-scale VA payments; MSO does not cover VA businesses. Urges clarification of inter-agency responsibility and clear policy direction/timeline.

Private Fund Self-Custody

Lack of guidance on SFC notification, mandatory requirement (asset segregation, authority management), risk controls and audit standards for self-custody arrangements. Expect specific guidance to build internal compliance.


SIGNIFICANCE:

The two CVAP commitments are near-term improvements that will directly reduce training costs for VATPs seeking to bring practitioners into regulatory compliance. Firms should factor these changes into their CVAP planning timelines once implementation details are published by HKSI and the SFC. Licensed VATPs and firms preparing to apply for VATP status should monitor HKSI and SFC announcements for the revised CVAP examination structure and fee schedule. For operating firms, internal review of operating costs through compliance channels will be beneficial. Technology service providers operating adjacent to the VA regulatory perimeter should seek legal advice on whether their business models fall within the definition of regulated activities.



3. SFC welcomes new initiatives to advance Hong Kong’s fixed income and currency markets


On 7 July 2026, the SFC jointly announced eleven measures alongside the People’s Bank of China (PBOC) and Hong Kong Monetary Authority (HKMA) to advance the Hong Kong fixed income and currency (FIC) markets and offshore RMB ecosystem. The SFC’s commentary focused on two initiatives directly within its regulatory remit.


The centrepiece is a new electronic FIC trading platform to be developed by the China Foreign Exchange Trade System (CFETS) in collaboration with Hong Kong Exchanges and Clearing Limited (HKEX). The platform will be registered and operated in Hong Kong making the SFC its primary regulatory and thus requiring participants of the platform to have relevant SFC licenses. The platform is built around four key principles: adherence to international market standards; openness to international institutional participation’ alignment with Hong Kongs broader financial ecosystem and market-driven focus on improving trading efficiency and transparency while reducing transaction costs. A launch timeline will be announced in due course.


Beyond the FIC trading platform, a second initiative was welcomed by the SFC to expand the range of eligible collateral for HKEX’s two clearing houses (HKFE Clearing Corporation Limited and The SEHK Options Clearing House Limited) to onshore China Government Bonds and policy banks through Northbound Bond Connect. Target is set for end of year 2026. Additional plans to enhance Swap Connect by adding seven-day fixing repo rate for depositary institutions as a reference rate for RMB interest rate swaps are planned for Q4 2026. HKEX also confirmed it will launch five-year China government bond futures contracts on 3 August 2026, providing global investors with an offshore hedging too.

 

SIGNIFICANCE:

The FIC Trading Platform invites global banks, fund managers, and other institutional participants to access Chinese fixed income and currency markets through a Hong Kong regulated, internationally friendly venue. Institutions planning to participate in said platform need to obtain or extend SFC licenses to cover relevant regulatory compliance. The collateral eligibility expansion for Northbound Bond Connect holdings and the 7-day Fixing Depository-Institutions Repo Rate (FDR007) Swap Connect enhancements should be noted by treasury and fixed income desks to factor into their hedging and collateral strategies.



4. Research Paper No.79: Half-yearly Review of the Global and Local Securities Markets


On 30 July 2026, the SFC issued a report analysis on Global and Hong Kong market performance, trading activity, and cross-border connectivity trends in H1 2026 against a backdrop of heightened geopolitical tensions, US monetary policy uncertainty, and divergent AI-driven rallies across markets. Key highlights include performance of global markets and trading and fund-raising activities in the first half of 2026:


Overseas and Mainland China indices delivered positive H1 2026 performance, led by Nasdaq and SZCOMP, while Hong Kong benchmarks underperformed sharply. The disconnect reflects stronger AI-driven momentum in overseas markets and weaker technology exposure within local Hong Kong indices.



SIGNIFICANCE:

Markets face ongoing volatility from lingering Middle East conflicts, higher-for-longer US rates, stretched overseas valuations, and revealed global debt levels. Geopolitical and trade policy uncertainty remain key headwinds to investors sentiment. By explicitly stating that Hong Kong lacks the AI/semiconductor heavyweights propping up US markets, the SFC is managing expectations. It is an admission that the local market is more vulnerable to geopolitical shocks and old-economy headwinds. The SFC anticipates stress in the second half of 2026 and is laying the groundwork for why it will enforce stricter margin, liquidity, and risk controls because the fundamental market structure does not offer the same tech shield as the NASDAQ.




Enforcement News


5. SFC Suspends Wong Tim Hi for Nine months


The SFC suspended Mr. Wong Tim Hi (also known as Timmy Wong) (Wong) (CE No: ACN818), a former licensed representative of Yuanta Securities (Hong Kong) Company Limited, for nine months from 3 June 2026 to 2 April 2027. The disciplinary action followed Wong’s misconduct between June 2016 and May 2017, during which Wong allowed two third parties to effectively take control of four client accounts without written authorisation from the account holders. His involvement was active, sharing confidential client account information directly with those third parties, including account details, transaction records, fund balances and fund movement data without client knowledge or consent.

 

This case is linked to a larger market manipulation scheme involving shares of Ching Lee Holdings Limited (HK Stock Code: 8318), where three individuals – including one of the third parties operating through client accounts – were convicted of conspiracy to carry out false trading between 52 and 80 months in May 2024. The SFC took into account Wong’s remorse, acceptance of the sanction, and otherwise clean record in, sentencing him to a nine-month suspension rather than a longer or permanent ban.


*For more details, please click on the Statement of Disciplinary Action for Wong’s case.

 

SIGNIFICANCE:

Firms should utilize this case to reinforce training on specific prohibition against sharing client account information with third parties, including family members, friends or referrers of the client. Written third-party authorisation must be obtained and retained on file before any access is granted. Firms should also note that long enforcement horizons are the norm, not the exception as represented by this case. Additionally, being a peripheral participant in a scheme that later produces criminal convictions does not insulate a licensed individual from regulatory consequence.



6. SFC reprimands and fines Victory Securities Company Limited $1.7 million and suspends its responsible officer for regulatory breaches


On 24 July 2026, the SFC reprimands Victory Securities (Hong Kong) Limited (Victory) and ordered it to pay a fine of HKD 1.7 million for regulatory breaches related to client due diligence failures and temporarily suspended its responsible officer Mr. CHIU Che Leung (CE No: AAF386) for three months from 22 July 2026 to 21 October 2026.

 

The SFC found that in October 2019, Victory accepted account opening documents from a client including purported broker statement as proof od shareholding without conducting adequate scrutiny. The firm failed to verify the authenticity of these documents before executing sell orders, breaching the Code of Conduct and AML/CFT regulations regarding KYC and due diligence obligations.

 

Client Onboarding and Red Flags

A client opened an account on 29 October 2019​ intending to sell shares held elsewhere. The client provided broker statements as proof of holdings, but the claimed share value was incommensurate with the client’s declared financial profile—a clear red flag under CDD and AML expectations.

Failure to Scrutinize

Victory executed sell orders without making adequate enquiries or obtaining satisfactory explanations for the discrepancies before acting on the client’s instructions.

Possible False Documents

Subsequent information suggested the client may have submitted false documents​ to facilitate a transaction, yet Victory did not report​ the suspicious or potentially fraudulent conduct to the SFC as required.

 

*For more details, please click on the Statement of Disciplinary Action for Victory’s case.


SIGNIFICANCE:

This case serves as a reminder to the industry that the cost of compliance failures goes far beyond fines; they also include license risks, reputational damage, and loss of customer trust. Licensed corporations should take this opportunity to conduct a comprehensive review of existing KYC, transaction monitoring, and suspicious transaction reporting mechanisms, ensuring effective collaboration among frontline staff, compliance departments, and management to avoid repeated failures.



7. SFC reprimands and fines China Industrial Securities International Asset Management Limited HKD 6.8 million for failing to properly identify and address red flags in dubious arrangements and other failures in managing private fund


On 27 July 2026, the SFC publicly reprimanded and fined China Industrial Securities International Asset Management Limited (CISIAM)​ (CE NO: AZB374) HKD6.8 million​ for regulatory failures as manager of a private fund set up for Tahoe Life Insurance Company Limited​ between August 2019 and September 2020.

 

At the request of Tahoe Life’s Chief Investment Officer, CISIAM executed a chain of unnecessarily complex trades—buying structured notes linked to debt issued by a Tahoe Life related company, then moving those notes into a different manager’s fund. The structure added cost and risk, had no clear commercial rationale, and raised red flags about hidden asset flows/ connected-party dealing. CISIAM did not exercise independent investment discretion, skipped adequate due diligence, and failed to identify or challenge the red flags. It also let the fund breach its own investment restrictions/ objectives and had no effective risk identification, management, or monitoring framework.

 

As Mr. DUIGNAN Michael, SFC Director of Enforcement, said: “Fund managers must remain vigilant and must not allow their services to be used as a conduit for facilitating misconduct. Before proceeding with a proposed fund arrangement, a fund manager should critically assess an investor driven proposal for potential red flags and ensure that any legitimate concerns have been satisfactorily addressed. Those who fail to make reasonable enquiries may face serious regulatory consequences.” 

 

*For more details, please click on the Statement of Disciplinary Action for CISIAM’s case.


SIGNIFICANCE:

This SFC has moved from guidance to enforcement on its long-standing rule that a licensed asset manager may not act as a passive execution conduit for client-driven, structurally complex arrangements and the penalty lands on both the licensed corporation and its senior individuals, even when an institutional client hands a detailed trade idea to the fund manager, the licensed corporation still owe the fund independent investment judgement. “We just followed the client’s instruction” is explicitly rejected by the SFC as a defence.



8. SFC reprimands and fines Bright Smart Securities International (H.K.) Limited HKD 2.8 million for internal control failures in monitoring suspicious trades


On 27 July 2026, the SFC reprimanded and fined Bright Smart Securities International (H.K.) Limited (BSSIHK) (CE NO: AEZ575) HKD 2.8 million for failing to maintain adequate and effective internal controls to monitor and detect client wash trades.


From 01 November 2023 to 13 September 2025, BSSIHK’s weak controls allowed 1,021 pairs of wash trades across 615 clients accounts, involving 763 stocks and warrants. Before March 2024, BSSIHH relied mainly on post-trade monitoring and manual review, so clients could complete wash trades before detection. On March 2024, BSSIHK introduced a pre-trade interception arrangement, but it was manual, not automated, and only triggered after a second instance of wash trading was already detected. However, this fix was still inadequate.


*For more details, please click on the Statement of Disciplinary Action for BSSIHK’s case.


SIGNIFICANCE

This BSSIHK case is significant to every SFC licensed corporation because it reframes wash-trades surveillance from a back-office nice-to-have into a core licensing obligation under the Code of Conduct. The SFC did not allege BSSIHK itself traded fraudulently, it penalized the broker for letting clients do it through deficient controls. That distinction is what makes the precedent matter to all licensees. A licensed corporation is responsible for maintaining the system that would have prevented the client abuse, independent of intent.



9. SFC reprimands and fines Luk Fook Securities (HK) Limited HKD 2.1 million for inadequate cybersecurity control to fend off cyberattack


On 28 July 2026, the SFC has reprimanded and fined Luk Fook Securities (HK) Limited (LFSHK) (CE No: ACU547) HKD 2.1 million for failing to maintain adequate and effective cybersecurity controls, a lapse that left LFSHK unable to withstand a 19 September 2022 ransomware attack and took roughly three weeks to fully recover core systems.


Cybersecurity System Deficiencies on LFSHK

Insufficient Network Security Controls

Inadequate Controls over Remote Access

Inadequate User Access and Privileged Account Management

Poor Password Management Practices

Use of Unsupported Legacy Systems

Lack of Control over External Device Security

Outdated Antivirus Protection

Insufficient Cybersecurity Awareness Training


*For more details, please click on the Statement of Disciplinary Action for LFSHK’s case.


SIGNIFICANCE

Cyber resilience is a Code of Conduct obligation, not an IT-department footnote. Senior management owns the design, testing and currency of controls outdated patches, unencrypted secrets, and “we restored in phases” are no longer acceptable narratives. With the SFC’s newer guidance pushing automated threat detection, OTP retirement and AI-era hardening, LFSHK sets the baseline enforcement benchmark for every Type 1/ Type 7/ VATP-adjacent licensee.



10. Market Misconduct Tribunal finds Sir Dickson Poon culpable of insider dealing ahead of disclosure of HKD 1.15 billion corporate windfall


On 31 July 2026, the Market Misconduct Tribunal (MMT) rules that Sir Dickson Poon and his vehicle equity advantage engaged in insider dealing by buying 2.76 million Dickson Concepts (International) Limited (Dickson Concepts) (HK Stock Code: 113) shares in late 2019 while sitting on price-sensitive news: PayPal’s USD 4 billion acquisition of Honey Science Corporation would deliver HKD 1.15 billion cash into Dickson Concepts, a gain of HKD 929 million over book value. He withheld the information from the board until late December, causing both personal trading violations and a corporate disclosure failure under Section 270 and Section 307B of the SFO. The MMT did not find Pearson Poon, also an executive director, liable for the company’s breach since he only relied on his father and the senior management to assess price sensitive information.


As Mr. DUIGNAN Michael, the SFC’s Executive Director of Enforcement, says “The Tribunal's findings reinforce two sacrosanct principles of Hong Kong's securities market: namely, insiders, particularly senior professionals on whom others rely, must not trade while in possession of material non-public information, and listed companies must disclose price-sensitive information as soon as reasonably practicable. Since a fair and orderly market depends on investors having equal and timely access to material information, the SFC will continue to take resolute action against insider dealing and corporate disclosure failures that undermine market integrity and investor confidence.”


SIGNIFICANCE

This case tells every SFC licensee that MNPI must reach beneficial owners and control-person vehicles, that pre-disclosure trading is culpable regardless of issuer silence, and that reliance defences survive only with documented governance and not with organizational hierarchy. This MMT ruling is a compliance benchmark that reinforces three layers of exposure: personal trading by connected persons, institutional handling of client/MNPI, and the duty to police disclosure pipelines of listed issuers that SFC-licensed corporation advise or trade for.



11. A 26-year-old Hong Kong trader is rumoured to have embezzled HKD 150 million by trading Hynix ETFs


On 27 July 2026, a 26-year-old trader at Chief Wealth Investment Limited (rumoured to be subsidiary of Chief Group) was arrested for the theft after allegedly misappropriating HKD 50 million of company funds from January to July 2026 into a margin account and used the funds to purchase CSOP 2x Leveraged SK Hynix ETF (XL2CSOPHYNIX) (HK Stock Code: 07709), a double-leveraged derivative tracking the South Korean memory-chip maker. The combined effect of margin financing and the ETF’s built-in 2x daily leverage amplified losses sharply when the semiconductor sector corrected in July.


The ETF had surged to a record high of HKD 193.65 per share at the end of June 2026 but plunged to HKD 52.58 by July 20, a drop of more than 72%. Due to the leveraged involved, the HKD 50 million principal translated into a marked-to-market loss approximately HKD 150 million. According to police, the positions remain open, meaning the final loss could still fluctuate with market movements.


SIGNIFICANCE

This case is not merely a theft case; it is a control-design failure. Paragraph 4.3 of SFC’s Code of Conduct requires licensees to prevent unauthorized trading through marker-checker fund transfers, hard pre-trade limits on margin utilization, and mandatory approval gates for leveraged products. Though Chief Wealth Investment Limited is not a licensed corporation, when a single individual can convert HKD 50 million into HKD 150 million of contingent liability without triggering any alert, the firm’s internal controls and authority-setting procedures are, by definition, inadequate.




Regulatory Updates


12. SFC and CSRC hold high-level enforcement cooperation meeting


The SFC and China Securities Regulatory Commission (CSRC) convened for their 17th high-level enforcement meeting in Hong Kong, attended by Mr. DUIGNAN Michael, the SFC’s Executive Director of Enforcement, and Mr. LI Yubai, the CSRC’s Director-General of the Enforcement Bureau. The meeting covered three substantive areas: sharing updates on enforcement priorities and trends in both jurisdictions, discussion of important cross-boundary enforcement cases including experience sharing on investigatory assistance, and exploration of ways to further deepen collaboration in combating cross-boundary securities crimes and misconduct.


Mr. Duignan emphasised that continuing to deepen enforcement cooperation and information sharing between the two regulators will enhance effectiveness in enforcement and contribute to stable and orderly development of financial markets in both jurisdictions.


SIGNIFICANCE

As market integration deepens, regulatory enforcement is increasing. This meeting singles that neither regulator treat the Hong Kong-Mainland border as a shield for market misconduct. The focus on expanding information exchange means investigative lead times for cross-border market manipulation, insider trading or fraudulent disclosures will continue to shorten. Increased coordination increases probability of concurrent or joint enforcement actions spanning both jurisdictions.



13. SFC and Securities Commission Malaysia sign MoU to expand mutual recognition of funds and facilitate simplified dual IPO listing framework


The SFC and the Securities Commission Malaysia (SC) signed a Memorandum of Understanding on 23 July 2026 to expand cross-border capital market connectivity between Hong Kong and Malaysia across two distinct channels: an expanded mutual recognition of funds (MRF) scheme and a new simplified dual IPO listing framework.


MRF Scheme OverviewThe SFC and SC signed an MoU to enable Malaysian and Hong Kong funds to be offered across both markets through a streamlined authorization process.

Expanded Product Scope

MRF now covers non-Islamic Exchange Traded Funds (ETFs) (including futures-based, leverages & inverse and commodity ETFs) and REITs, significantly broadening the range of cross-border investment products.

Fund Eligibility

Malaysian funds must remain authorized and supervised by the SC, satisfy MRF eligibility requirements, and obtain a SC certification before applying for SFC authorization.

Distribution Requirements

Malaysian funds offered in Hong Kong must be distributed through SFC-licensed or registered intermediaries and appoint a Hong Kong representative in accordance with the UT code.

Regulatory Cooperation

The SFC and SC will strengthen supervisory cooperation through information sharing, ongoing oversight, and coordinated regulatory action to support investor protection.

Market impact

Allows greater cross-border capital flows, expands investment opportunities and improves connectivity between Hong Kong and Malaysian asset management markets.

 

Expansion of Fund Eligibility in Malaysian Markets

ETFs

MRF now covers a wider range of Hong Kong ETFs including:

  • Passive index-tracking ETFs

  • Futures-based leveraged & inverse ETFs

  • Synthetic ETFs

  • Commodity ETFs

  • Country-specific government bond/fixed income ETF

Listed REITs

Eligible Hong Kong listed REITs can be offered under the MRF, provided they satisfy minimum market capitalization, regulatory track record and public float/security holding spread requirements.

Fund Structure

Eligible funds may now be constituted as Open-ended Fund Companies (OFCs), unit trusts or other forms of collective investment schemes recognized under Hong Kong law.


*For more details, please click on the Mutual Recognition of Funds (MRF) between Malaysia and Hong Kong and Cross-listings of Malaysian real Estate Investment Trust in Hong Kong.


SIGNIFICANCE

The introduction of new product scopes creates new distribution channels for Hong Kong and Malaysian ETF managers seeking listing venues mutually. Additionally, the simplified dual IPO framework addresses the historical dual listing process between Hong Kong and Malaysia, dramatically reducing paperwork hassles and legal costs, the pipeline of dual listings between Malaysian companies seeking access to Hong Kong’s investor base and vice versa is likely to accelerate. This positions Hong Kong as a gateway to mainland Chinese capital for Malaysian issuers and investors, while positioning Malaysia as a gateway for Southeast Asian capital for Hong Kong-listed companies. The SFC Chairman, Dr. WONG Kelvin’s framing of the two markets as “Vital financial gateways connecting global capital with Chinese Mainland and Southeast Asia” is a precise articulation of this complementarity.



14. SFC mandates phishing-resistant authentication methods for internet brokers and VATPs to protect client accounts


On 09 July 2026, the SFC issued a landmark circular tightening cybersecurity rules for licensed virtual asset trading platforms (VATPs/VASPs) and internet brokers—driven by a sharp rise in phishing-related breaches. In 2025 alone, phishing made up 57% of all cybersecurity incidents reported to Hong Kong Computer Emergency Response Team (HK-CERT), with large-scale SMS phishing campaigns enabling account takeovers via man-in-the-middle attacks that intercepted OTPs.

 

The core message is clear: OTPs sent via email or SMS are no longer acceptable for client login or device binding. The SFC is mandating a shift to Fast Identity Online (FIDO) certified, phishing-resistant passkeys​ paired with robust device binding, backed by proactive threat monitoring and strict incident response obligations.

 

Key Requirements

Passkey rollout

All clients must transition to passkeys within 12 months, by 8 July 2027. New clients enroll during standard KYC onboarding; existing clients with no bound device post-deadline must complete biometric, ID document, or in-person verification to set up new credentials.

Device Binding

Accounts must be tied to specific hardware attributes, with prohibited weak verification methods and approved checks including biometric matching, ID verification, or in-person validation.

Enhanced monitoring

Firms must track logins, device binding, and transactions in real time, with mandatory alerts for new device logins, passkey changes, high-risk transactions (withdrawals, contact updates, password resets), and unusual geographic or behavioural patterns.

Accountability

Senior management—specifically the Managers-in-Charge (MICs) for Overall Management Oversight and Information Technology—bear personal liability for timely implementation and preventing client losses.

 

Larger VASPs are expected to deploy controls immediately, while all firms may continue using OTPs during the 12-month transition—but only with heightened monitoring and under close regulatory scrutiny. No deadline extensions will be granted without prior SFC approval.

Beyond compliance, this is a strategic opportunity: moving away from vulnerable legacy authentication to a modern, passkey-based framework significantly reduces breach risk and builds stronger client trust—a clear competitive advantage in a crowded market.

 

As Dr. YIP Chi-hang, Executive Director of the SFC’s Intermediaries Division, emphasized: “Protecting customer accounts requires a comprehensive approach combining prevention, detection, response, and education. Licensed companies should strengthen their first line of defence, remain vigilant, and respond promptly.”

 

*For more details, please click on the circular.


SIGNIFICANCE

This circular marks a new phase in the SFC's cybersecurity regulation of licensed corporations, requiring a shift from passive defense to a proactive, comprehensive, and accountable security system. Licensed corporations should treat this as a strategic priority rather than just a matter of IT compliance, and plan and implement relevant upgrades early to avoid regulatory penalties and protect client trust.



15. SFC enhances regulatory framework for daily leveraged and inverse products to ensure orderly market trading


On 24 July 2026, the SFC issued an update on regulatory framework for daily leveraged and inverse (L&I) products authorized for retail sale in Hong Kong. The SFC now permits L&I products with leverage ratios other than the traditional fixed arrangement of 2x for leveraged products and -2x for inverse products. Product providers may propose more tailored daily rebalanced leverage, subject to SFC approval.

Item

New Requirement

Expanded Product Scope

Moves beyond traditional Index L&I Products to include Single Stock L&I​ (initially offshore mega-caps, now including HK-listed mega-caps per 2026 updates) and Defined Outcome Funds​ (options-based, capped upside/downside).

Stricter Naming & Branding

L&I Products cannot​ be called "ETFs." Mandatory formats include "Daily (2x)" and distinct "L" or "I" prefixes with unique stock code ranges on HKEX.

Flexible Leverage Structure

Introduces dynamic leverage​ (e.g., dropping from 2x to ~1.1x during stress). Providers must publish the next day’s target leverage on the product/HKEX websites daily after market close.

Capacity Monitoring & BCP

Continuous monitoring of swap/broker capacity is now a live obligation. For Single Stock L&I: requires proven track record, robust BCPs with specific triggers (volatility, capacity), and pre-agreed stop-loss mechanisms.

Enhanced Disclosures

Heavy emphasis on Product KFS​ warnings (not for long-term holding, roll costs, volatility). Mandates a Performance Simulator​ (except for pure delta-one) with historical data and clear narratives.

Market Making & Margin

Zero Tolerance on Market Makers:​ If all market makers resign, the product must terminate. HKEX monitors performance strictly. No Margin Financing:​ HKEX advises against providing margin financing for these products.

Distribution Obligations

Reaffirms application of Code of Conduct 5.1A–5.3​ (Derivative Products). Emphasizes investor education, staff training, and acting in the client’s best interest (prohibiting gearing-on-gearing).

 

*For more details, please click on the revised circular.


SIGNIFICANCE

This circular is a market-development gesture with investor-protection strings attached. Issuers get a path to Single Stock L&I and Defined Outcome funds; distributors get a wider shelf. In return, everyone in the chain absorbs tighter naming rules, daily leverage transparency, capacity-reporting duties, BCP obligations for single-stock products, and a distribution regime that threats these instruments as sophisticated trading tools mis-sold to buy-and-hold clients at the firm’s own risk. Early consultation with the Investment Product Division is advised not because the SFC is being polite, but because the facts-and-circumstances calls, what counts as “highly liquid mega-cap”, what leverage a volatile single stock can bear, how a Defined Outcome fund discloses barriers events, will define whether your authorization sails through or stalls.





[End of ComplianceOne Newsletter – July 2026]

 

For more details, please click on the title of the topic above.

 

=================================

~ Make It Right Today, Better Tomorrow ~ 

=================================

  

The Newsletter is for general information purpose only and is not intended to constitute legal or other professional advice.


For enquiries, please email to support@complianceone.hk or WhatsApp us at (852) 95164607.  

Unit 1605, 16/F, West Tower, Shun Tak Centre,168-200 Connaught Road Central,

Sheung Wan, Hong Kong  


Tel: (852) 39550277   www.complianceone.hk


bottom of page