Technology, Media and Telecommunications (TMT)

Hong Kong is actively pushing to become a global innovation hub. Plans include installing cameras in all taxis by 2026, as well as promoting a low-altitude economy of camera-equipped drones. However, such initiatives come with privacy and data concerns. The use of CCTV surveillance, and cameras in drones and passenger-carrying vehicles, are among them.

Hong Kong’s Privacy Commissioner for Personal Data (“PCPD”) has issued two new guidance documents on camera use. The first concerns use of CCTV surveillance, and the second on use of video cameras on drones and vehicles (jointly the “Camera Use Updates”). The Camera Use Updates explain how businesses/ employers and the public should comply with the law when deploying CCTV systems, drones, and in-vehicle cameras. We summarise the key considerations below.

The Camera Use Updates and the law

A first point to note is that the Camera Use Updates are guidance notes only, not new legislation. They do not create additional legal obligations, they only explain how existing legal provisions apply to modern technologies and everyday scenarios. The Camera Use Updates help employers and the public to interpret and apply the law and adopt best practices, ensuring compliance in respecting individual privacy. They are helpful documents to help readers avoid legal liability in a safe and efficient way.

The Personal Data (Privacy) Ordinance (“PDPO”) is Hong Kong’s primary data protection law. It sets out legally binding requirements for the collection, use, and handling of personal data, enforced through six Data Protection Principles. For Tanner De Witt’s article on Hong Kong Market Entry, Data Protection, and the PDPO, please click here.

CCTV Surveillance

The CCTV guidance note sets out that CCTV should only be used when necessary and only in a proportionate way. Transparency is essential. People must know when they are being recorded, and clear notices should be displayed at entry points and monitored areas.

Data retention and security are critical concerns. Footage should not be kept longer than needed and must be stored securely to prevent leaks or misuse. Businesses should conduct Privacy Impact Assessments before installation to identify risks and mitigation measures.

The CCTV guidance note warns against covert surveillance, except as a last resort. Cameras should never be placed in private spaces such as changing rooms or rest areas. Misuse of footage, including sharing on social media, may breach the PDPO and lead to criminal liability.

Camera Use in Drones and Vehicles

For drones, operators should plan flight paths carefully to avoid private premises. Recording criteria should be defined in advance, and technology should be used to blur faces where possible. Wireless transmissions should be encrypted and stored on secure storage devices. Drone owners are reminded that lost drones can expose sensitive data if safeguards are weak.

Transparency is, once again, of utmost importance. The drones and vehicles guidance note suggest creative approaches such as QR codes on notices, flashing lights on drones, and banners at drone launch sites. These measures both inform the public and build trust with the drone owner.

For in-vehicle cameras, justification is key. Continuous inward-facing recording should only be used when necessary, because passengers expect privacy in taxis and private cars. Notices should be placed both inside the vehicle and on the exterior in a conspicuous way. The PCPD has provided a sample sticker here for this purpose.

Footage retention policies must also be clear. Recordings should be deleted promptly if no incidents occur and stored securely with encryption and access controls. Non-removable storage media should be considered, to reduce risk of theft or misuse.

Best Practices for Businesses

Assess necessity: Use cameras only when there is a clear need.

Ensure transparency: Inform people through notices and policies.

Limit data collection: Record only what is required for the purpose of your camera use.

Secure data: Protect footage from unauthorized access.

Review retention: Delete data when it is no longer needed.

Conduct privacy impact assessments: Identify and reduce risks before deployment.

Conclusion

Following the guidance outlined in the Camera Use Updates will reduce legal risk and protect a business’s reputation. CCTV, drone, and in-vehicle camera users should review their current practices now, update relevant policies, and implement new staff training.

Camera Use Updates, supplementary materials

For the PCPD’s media statement made for the launch of the Camera Use Updates, please click here.

For the PCPD’s document on “Guidance on the Use of CCTV Surveillance”, please click here.

For the PCPD’s supplementary information leaflet on CCTV titled “Tips on the Use of CCTV Surveillance,” please click here.

For the PCPD’s document on “Guidance on the Use of Video Cameras on Drones and Vehicles,” please click here.

For the PCPD’s supplementary document on “Responsible Use of Drones and In-Vehicle Cameras” information leaflet, please click here.

If you would like more information on employment related legal matters, please contact:

Russell Bennett

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.

Fraud, particularly digital fraud, is on the rise globally. Hong Kong, as an international financial centre, trading hub and an intermediary between Mainland China and the global market, has strengthened its anti-fraud efforts. These include enhancing information sharing through public-private partnerships between the Hong Kong Police Force and the banking sector. However, there remains an information gap which is often exploited by criminals to move and conceal illicit funds across their mule account networks.

In an effort to narrow this information gap, the Government has recently proposed to amend the Banking Ordinance to put in place a mechanism of AI-to-AI information sharing. The proposed mechanism will provide a safe harbour for AIs to share with each other information of both corporate and individual accounts on a voluntary basis. It aims to allow for more effective detection and prevention of prohibited conduct, including money laundering, terrorist financing, and financing of proliferation of weapons of mass destruction (“Prohibited Conduct”).

In this update, Pádraig Walsh from our Data Privacy and Cybersecurity practice looks at the Banking (Amendment) Ordinance 2025 (“Amendment Ordinance”). The Amendment Ordinance, gazetted on 12 June 2025 and now in force since 3 November 2025.

The key features of the proposed mechanism are as follows:

(a) The voluntary mechanism allows for the disclosure of information concerning a customer of an AI who may be linked to any Prohibited Conduct, as well as any related entity, account, or transaction associated with that customer. Examples include:

(i) bank account numbers;

(ii) personal data (e.g. name, date of birth, Hong Kong Identify Card number) of the customer in question, the counterparties, and beneficial owners or connected parties of the customer;

(iii) details of relevant transactions including the counterparties; and

(iv) reasons why the transactions or activities may be involved in a Prohibited Conduct.

(b) An AI may request another AI to disclose information in aid of its inquiry for detecting or preventing Prohibited Conduct. The recipient AI may disclose information to the requesting AI in response to such request. Alternatively, an AI may disclose information on its own initiative to another AI and the Joint Financial Intelligence Unit (JFIU) to alert the recipient AI of suspected crime. An AI may share information bilaterally or with multiple parties via FINEST or other secure platforms designated by the Hong Kong Monetary Authority (“HKMA”).

(c) Where an AI has reasonable grounds to believe that seeking the data subject’s consent would risk prejudicing the conduct of inquiries for the detection or prevention of prohibited conduct, disclosure may be made without such consent.

(d) A safe harbour from prosecution or civil liability is available to AIs that make disclosures under the mechanism in good faith, with reasonable care, and in compliance with the confidentiality requirements under section 68AAF of the Amendment Ordinance.

The HKMA will issue guidelines to assist AIs in safeguarding data privacy and confidentiality when sharing information under the mechanism.

Concluding remarks

The Amendment Ordinance marks a significant step for Hong Kong in aligning with international practice, introducing legislation that permits information sharing among financial institutions and other regulated entities to facilitate the detection and prevention of crime. This information sharing mechanism is expected to strengthen Hong Kong’s ability to combat fraud.

The Banking (Amendment) Ordinance 2025 is available at this link.

Pádraig Walsh

If you want to know more about the content of this article, please contact:

Pádraig Walsh

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication. This article was published on 12 November 2025.

In this update, Pádraig Walsh from our Data Privacy team looks at two investigation reports published by the Hong Kong Privacy Commissioner for Personal Data (“PCPD”) into data breach incidents occurring in 2024.

Data breach incident of Kwong’s Art Jewellery and My Jewelry

Brief overview: A brute-force attack was conducted on the companies’ shared information systems to obtain administrator credentials, allowing unauthorised access to sensitive data held on the systems. The breach affected approximately 79,400 individuals, including corporate customers and employees. The compromised personal data included names, Hong Kong Identity Card numbers, dates of birth, and contact details.

Deficiencies identified: The PCPD identified key deficiencies, including:

(a) failure to timely delete a former employee’s account;

(b) lack of effective security and detection measures;

(c) outdated operating systems of servers; and

(d) absence of comprehensive information security policies / guidelines and regular assessments and audits.

The PCPD concluded that the companies had not taken all practicable steps to protect personal data, and the companies violated Data Protection Principle (“DPP”) 4(1) of the PDPO.

Data breach incident of Adastria

Brief overview: The attack utilised the administrator credentials of a then current employee. The attack was initiated by access from an overseas IP address. The administrator credentials granted unauthorised access to various customer order information. The breach affected approximately 59,205 customers. The compromised personal data included names, telephone numbers, and order details, which were subsequently disclosed on the dark web two months after the attack.

Deficiencies identified: The PCPD identified key deficiencies, including:

(a) weak password management and lack of multi-factor authentication;

(b) insufficient awareness of data security protocols; and

(c) failure to conduct proper security reviews.

The PCPD expressed concern over Adastria’s inadequate measures to safeguard personal data, particularly given its status as a multinational fashion brand group. They concluded that Adastria violated DPP 4(1) of the PDPO by failing to take all reasonable steps to ensure the security of personal data.

The PCPD’s recommendations

The PCPD noted that retail businesses handle significant volumes of personal data, and recommended those businesses to:

(a) establish and implement clear internal policies and procedures to safeguard the security of the information systems;

(b) implement effective measures to prevent, detect and respond to cyberattacks, including conducting regular vulnerability scans and timely patching;

(c) cease the use of end-of-support software and promptly upgrade all software;

(d) enhance password management of information systems and enable multi-factor authentication;

(e) regularly conduct security risk reviews and audits for information systems;

(f) configure appropriate security functions on service platforms provided by third-party vendors and conduct regular security reviews;

(g) formulate comprehensive data breach response plans; and

(h) adequately train employees to improve their data security awareness.

The PCPD emphasised that organisations must allocate sufficient resources to safeguard personal data against increasing cyber threats.

Conclusion

These incidents underline a critical need for robust data protection and cybersecurity measures in today’s increasingly threatening digital landscape.

A privacy-secured business requires much more than a technical response. Prevention starts with commitment from senior management, and a privacy management plan that policies, plans and processes. Human error is almost invariably involved in a security incident or data breach. Training and awareness programmes should be conducted to ensure that employees follow best practices and are vigilant against cyber risk.

Tanner De Witt is well-equipped to assist organisations in navigating these challenges. We regularly help businesses with policies and plans, and conduct practical, customised training to heighten awareness of prevention, mitigation and response measures.

The PCPD’s Media Statement is available at this link.

Pádraig Walsh

If you want to know more about the content of this article, please contact:

Pádraig Walsh

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication. This article was published on 09 October 2025.

In recent years, the Hong Kong Monetary Authority (HKMA) has actively encouraged banks in Hong Kong to replace rules-based robotic process automation (RPA) with AI-enhanced transaction monitoring (TM) systems to improve efficiency and effectiveness in detecting financial crimes. Banks must conduct comprehensive pre-implementation assessments addressing unique needs, system suitability, resource impacts, and integration with existing infrastructure. Crucially, banks retain full responsibility for TM outcomes—even when using third-party vendors—and must design systems adaptable to evolving transaction patterns and risk scenarios, with senior management overseeing development and ongoing governance.

Pádraig Walsh, who leads the TMT practice at Tanner De Witt, recently examined this policy in an article published in Banking Today, the official journal of the Hong Kong Institute of Bankers. The key points are:

Regulatory Shift:

HKMA actively promotes AI-enhanced TM systems to replace rules-based RPA systems, improving efficiency and effectiveness in detecting suspicious activities.
Banks must conduct pre-implementation assessments covering needs, system suitability, and resource impact.

AI Advantages:

Reduced False Positives: AI systems prioritize alerts using contextual data (e.g., customer profiles, historical patterns), cutting manual review workload (Case Study 1).
Enhanced Detection: Identifies complex money-laundering typologies and networks faster than RPA.
Resource Optimization: Focuses efforts on high-risk cases, streamlining due diligence.

Critical Success Factors:

Data Quality: TM systems depend on mature, well-governed data from core banking/payment systems.
Governance: Senior management oversight, stakeholder alignment, and periodic system reviews (e.g., annual performance against KPIs) are mandatory.
Risk Mitigation: Banks must address AI limitations (e.g., bias, “hallucinations”) through testing, transparency logs, and fallback mechanisms.

Legal & Contractual Considerations:

Procurement Models: In-house, third-party, or co-development options require rigorous due diligence, especially for IP rights (e.g., training data ownership).
Contract Safeguards: Key clauses should cover data usage rights, output ownership, error liability, regulatory compliance, and termination rights if systems breach laws.

Implementation Best Practices:

Structured planning, cross-functional collaboration, and phased testing (Case Study 2).
Adherence to HKMA’s High-Level Principles on AI (2019) to ensure responsible innovation.

Please refer to the full article for the complete regulatory analysis, implementation case studies, and actionable frameworks.

The rapid adoption of generative artificial intelligence (“GenAI”) applications and agents is quickly transforming the workplace and how work is done in many enterprises in Hong Kong. The ease of use of GenAI tools can disguise personal data privacy and protection risks. In this update, Pádraig Walsh from our Data Privacy practice looks at the new guidelines published by the Office of the Privacy Commissioner for Personal Data (“PCPD”) to help businesses develop internal policies or guidelines for employees’ use of Gen AI at work.

The key points of the PCPD Guidelines for the Use of Generative AI by Employees are:

(a) Specify the scope of permissible use

Businesses should specify:

(i) what GenAI tools can be used. Ideally, the permitted list should identify the specific version that is permitted, noting that commercially licensed versions of publicly available GenAI tools may provide more privacy protection.

(ii) what the permitted GenAI tools can be used for. This should identify the specific work processes that the permitted GenAI tools can be used for – such as drafting marketing collateral, and so on.

(iii) who is permitted to use the GenAI tools. This could be everybody in the business, or specific departments or ranks.

(b) Protect personal data privacy

GenAI tools generally function by the user providing inputs or prompts that are processed to deliver an output. Businesses should:

(i) specify the permissible types and amounts of information that can be inputted into GenAI tools;

(ii) expressly prohibit excluded information (which may include personal, confidential, proprietary or copyrighted information);

(iii) specify the permissible use of the information and output generated by GenAI tools and identify situations where personal data should be anonymised before further use;

(iv) specify how output information should be stored and deleted; and

(v) ensure that the policies or guidelines on the use of GenAI align with other relevant internal policies, including those on personal data handling and information security.

(c) Lawful and ethical use and prevention of bias

Businesses should specify that employees must not use GenAI tools for unlawful or harmful activities. They should also define the ethical values and standards which employees should observe when reviewing AI-generated output, including accuracy, prevention of bias and discrimination, and labelling to identify use of GenAI in production of materials.

(d) Data security

Businesses should specify:

(i) the devices on which employees are permitted to access Gen AI tools (e.g. office computers, work phones, and tablets). In general, employees should only use GenAI tools for work-related purposes on work provided devices;

(ii) who is permitted to use Gen AI tools (e.g. employees with operational needs who have received relevant training);

(iii) the use of robust user credentials and stringent security settings when using the tools. Security settings should prioritise data security, which may include measures such as disabling saving functions and prohibiting sharing of prompts with GenAI providers; and

(iv) the procedures for reporting data breaches, unauthorised input of personal data, abnormal output results, and potentially illegal output.

(e) Specify consequences of violation of the policies or guidelines

Businesses should specify the possible consequences of employees’ violation of the policies or guidelines on the use of GenAI.

(f) Support employees in using GenAI tools

Businesses should ensure that the policies or guidelines on the use of AI are clearly communicated to employees. Businesses should also provide training and resources to help employees understand the risks of GenAI, and to use GenAI tools effectively and responsibly. Businesses should establish channels for employees to provide feedback on their experience using GenAI tools.

Concluding remarks

In Hong Kong, the PCPD has taken the lead in giving horizontal guidance across all industry sectors in respect of risks associated with adoption of GenAI. Even in these guidelines, the PCPD noted that its reference to information includes personal data and general information also. This is sensible. It is difficult to segregate and deal with personal data risks only when addressing GenAI systems.

The adoption of the recommendations in these guidelines is a very good step forward for businesses looking to adopt and implement a framework to guide employees on the use of GenAI tools in the workplace. Ultimately, the implementation of the guidelines will safeguard personal data and also provide a foundation for the safe and responsible use of AI by businesses.

The path to implementation of the PCPD guidelines involves assessing the guidelines in the context of the business and its business processes, drafting an AI Usage Policy that will apply to employees, and providing training, guidance and support to employees on the requirements of that policy. We at Tanner De Witt can help and assist in each of these steps.

The PCPD Guidelines for the Use of Generative AI by Employees is available on this link.

Pádraig Walsh

If you want to know more about the content of this article, please contact:

Pádraig Walsh

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication. This article was last reviewed on 25 April 2025.

More than 95% of all active traders in Hong Kong trade through internet trading systems. In this article, Pádraig Walsh from our Cybersecurity team highlights key points in a report from a recent thematic cybersecurity review of licensed corporations published by the Securities and Future Commission (“SFC”).

Measures against phishing attacks

Phishing attacks remain the most common form of cyberattacks.[1] Recommended anti-phishing measures include:

Provide regular cybersecurity awareness training to all staff. One form of training is regular phishing simulation. Stimulated phishing exercises help test staff’s awareness and response to phishing attacks. To incentivise an appropriate response from staff, corporations may adopt a “carrot-and-stick” approach. There have been examples where licensed corporations took disciplinary actions against staff who had repeatedly fail the stimulation, while rewarding staff who dealt with the phishing attack appropriately.
Deploy multiple means of identifying potential phishing attacks. Licensed corporations should deploy technical security solutions such as filtering tools of email, web and attachment contents. Automated solutions to monitor and identify fraudulent websites on the internet are also useful. There should be clear reporting procedures for clients to contribute to alerting corporations of any phishing attempts.
Send regular cybersecurity alerts and reminders to clients. Upon identification of phishing activities, licensed corporations should promptly post alert messages on social media to remind clients to stay vigilant. In cases where alerts are sent via SMS, licensed corporations may consider participating in the SMS Sender Registration Scheme, under which scheme, legitimate SMSs are differentiated by the prefixed “#”, which helps clients to verify the senders’ identities.

EOL software management

EOL (end-of-life) software refers to software which has reached the end of its life cycle, and is no longer given technical support and maintenance such as updated security patches and fixes. This puts EOL software at major risk of attackers gaining entry point to penetrate the target’s IT environment. The SFC recommends:

Identity and monitor EOL software and operating systems. For example, as of the date of this article, Windows 7 has reached its lifecycle, while Windows 8 and 10 are being phased out. To keep a close monitor of EOL software, corporations should maintain a complete IT asset inventory list and review it regularly. Licensed corporations should also regularly gather information on software’s EOL from official sources.
Cease usage of EOL software on all critical system servers and databases. Internet-facing servers, trading related servers and databases should not be built upon EOL systems. For non-critical system servers and databases, EOL software should be upgraded or replaced in a timely manner unless there are measures in place to properly mitigate the associated cybersecurity risks.

Remote access management

Remote working has become an integral part of many businesses. However, remote access solutions may give rise to cybersecurity vulnerabilities as attacks gain entry point to infiltrate internal networks. There are ways that corporations may take to counter these risks. They include:

Only grant remote access rights on a “least privileged” and “need-to-have” basis. Accesscredentials should only be assigned to staff of appropriate bands or ranks to limit exposure to data breaches through remote systems. Access rights should be routinely reviewed and adjusted.
Implement multiple security controls. Common forms of control are remote access via VPN, multi-factor authentication, timeout, and temporary access suspension after multiple invalid login attempts.
Prevent and identify unauthorised remote access or attempt to internal networks. This may be achieved through blocking remote access from certain IP addresses such as private VPN and sanctioned countries, and when geolocation of a user’s login IP address changes from one country to another within a short period of time.

Third party provider management

Many licensed corporations engage third party providers of IT services. Cybersecurity breaches at the third party providers’ end can compromise businesses of the service users. The licensed corporation’s responsibility in securing their systems is not absolved by simply outsourcing their IT systems; the licensed corporation must properly manage its service providers.

Conduct proper due diligence on the providers prior to the engagement. Due diligence should include an assessment on the adequacy of the cybersecurity measures proposed by the providers. The SFC noted in its report that some licensed corporations would exchange information with other brokers on providers that they used, conduct interviews with the providers, and request the providers to complete a security checklist.
Put in place specific cybersecurity terms in formal contractual arrangements. Agreements with third party providers should cover security obligations to give contractual assurance and accountability. There should also be specific terms on reporting procedures in the event of a cybersecurity incident, and on contingency plans in the event of disruptions.

Cloud security

Most businesses host their applications and systems in a cloud environment. Some businesses adopt multiple clouds to help enhance system resilience and minimise risk of service interruption. The downside is that the usage of multiple clouds increases the complexity in managing different cloud environments, giving rise to potential vulnerabilities. The SFC recommended in its report to:

Segregate critical systems and data from others groups that are subject to higher hacking risk exposure. If necessary, consult and engage a competent third party provider to design and implement the network infrastructure to suit an individual’s business needs and risks.
Back up business records, clients and transaction databases, and servers in an offline medium. This should be done on at least a daily basis. The backup should be “immutable”, which means the backup medium should be disconnected from the cloud environment after each backup process.

Concluding remarks

The thematic review conducted by the SFC is a timely summary of key issues for licensed corporations to keep in mind in respect of cybersecurity. The touchstone SFC guideline is the SFC’s Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading (link). Failure to meet the cybersecurity standards and expectations of the SFC may reflect adversely on a licensed corporation’s and licensed persons’ fitness and properness in conducting regulated activities.

The SFC has for some time now placed institutional resilience as a core strategic priority. Cyber resilience, IT strategy and internal control and governance are all elements of cyber resilience. The SFC is very mindful that it is the primary regulatory of Hong Kong’s financial markets, which are a critical infrastructure of Hong Kong. With the imminent introduction into law and force of the Protection of Critical Infrastructures (Computer Systems) Bill in Hong Kong, we expect the SFC to intensify its focus on cybersecurity even more. We can expect that the SFC will be one of the sector regulators that is designated to discharge organisational and preventive obligations under the new laws. This will see the SFC working closely with the new Commissioner on cybersecurity matters.

We are at the dawn of a new era of regulation and oversight of cybersecurity. This thematic review and report by the SFC are incisive reminders to licensed corporations in the financial markets sector to review and strengthen cyber readiness.

Pádraig Walsh and Vanessa Leung

If you want to know more about the content of this article, please contact:

Pádraig Walsh

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication. This article was last reviewed on 07 March 2025.

[1] §17 of the Report.

In this news update, Pádraig Walsh from our Fintech practice group looks at the streamlined licensing process for virtual asset trading platforms (VATPs) introduced for all applicants by the Securities and Futures Commission (SFC) in its 16 January 2025 Circular[1].

Streamlined licensing process

This Circular extends an initiative of the SFC for deemed applicants announced in a prior Circular on 18 December 2024[2]. The new Circular revamps the external assessment process for VATP applicants whose applications are submitted to the SFC after 18 December 2024. The goal is to expedite the licensing process without sacrificing regulatory standards.

The revamped process primarily relates to the external assessment which is at the core of the VATP licensing process. Previously, the external assessment was conducted in two phases. This has been replaced by a single external assessment review under a tripartite arrangement between the VATP applicant, the SFC and the external assessor, requiring sign-off as an assurance assignment by a certified public accountant.

The external assessment process is triggered when receipt of a VATP licence application is accepted by the SFC. This acceptance of the licence application is not an approval of the application; it signifies simply that the SFC will proceed to review the VATP licence application. Before the SFC accepts the licence application, the SFC will assess the VATP applicant’s business structure, competence, fitness and properness of the VATP applicant and its ultimate controller, ultimate owners, substantial shareholders, proposed responsible officers and managers-in-charge, and the capability of the external assessor. Depending on the circumstances, the SFC may raise material concerns with the licence application, and return the application to the applicant with reasons.

If the SFC accepts the licence application, the VATP applicant must deploy its systems, and operate according to its submitted application documents. This is when the external assessment can begin. The VATP applicant, the external assessor and the SFC will agree terms for a scope of engagement and enter a tripartite agreement to enable all parties to communicate and engage in respect of the progress, findings and remediation of the external assessment. The external assessor must confirm that the VATP applicant’s policies and procedures are suitably designed and implemented to comply with the applicable SFC Guidelines for VATPs[3]. The assessment must be performed as a direct assurance engagement, signed by a practicing certified public accountant.

The SFC will play a supervisory role providing clarifications on regulatory requirements and offering feedback on findings of the external assessor. The VATP applicant will be expected to revise policies, systems and controls in line with the recommendations and findings of the external assessment and the SFC, before submitting a final report for the SFC’s approval.

Concluding remarks

This Circular marks a significant advance in the approach to VATP licence applications. There are no longer two phases of external assessment, and the single external assessment is integrated into the period of the licence application when systems are deployed. Further, the SFC can directly engage and provide guidance under the planned tripartite arrangement. This focuses time and effort on the period when systems and procedures can be tested, refined, reiterated and improved until compliant. This structured approach streamlines the licensing process, and also provides VATP applicants direct access to prompt regulatory feedback. There is reason to be confident that this initiative will encourage more VATP applications.

Pádraig Walsh and Oliver Lam

If you want to know more about the content of this article, please contact:

Pádraig Walsh

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication. This article was last reviewed on 10 February 2025.

[1] Available on this link

[2] Available on this link

[3] Being primarily the SFC Guidelines for Virtual Asset Trading Platform Operators [link] and the SFC Guideline on Anti-Money Laundering and Counter-Financing of Terrorism [link]

The fintech landscape in Hong Kong witnessed significant regulatory developments in 2024. More lies ahead for 2025 with several regulatory initiatives in prospect. In this article”,” PÃ¡draig Walsh from our Fintech team highlights three key developments in 2024″,” and foreshadows three possible highlights in the year to come.

2024 in review

Virtual assets and tokenisation

In the course of 2024″,” the Financial Services and Treasury Bureau conducted and concluded its public consultation for feedback on proposals to regulate service providers of over-the-counter trading of virtual assets. The proposals will result in a new licensing system which will require licensees to abide by anti-money laundering and counter-terrorist financing requirements”,” to appoint competent compliance officers”,” and to implement internal policies and procedures to mitigate cybersecurity risks. The competent regulator will be the Customs and Excise Department (CED)”,” though we would not be surprised if the Securities and Futures Commission (SFC) was involved in some form once the proposals are finalised. The legislative changes will be in the form of an amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance”,” and we can expect the draft legislation to be published soon.

In March 2024″,” the Hong Kong Monetary Authority (HKMA) launched Project Ensemble aimed at exploring the potential tokenization of financial and real-world assets and the use of a wholesale central bank digital currency (wCBDC) for interbank settlements. Central to this project was the Project Ensemble Sandbox”,” established with the aim of exploring the potential interoperability of tokenized assets”,” tokenized deposits”,” and wCBDC. The sandbox has also identified several use cases involving the tokenization of bonds and investment funds”,” liquidity management solutions”,” and applications in green finance. The HKMA is also working with the Banque de France to test cross-border payment functionalities”,” demonstrating the potential for interbank settlement between different jurisdictions.

Digital money

On 23 September 2024″,” the Hong Kong Monetary Authority (HKMA) launched Phase 2 of the e-HKD Pilot Programme”,” now renamed Project e-HKD+”,” to explore use cases for digital money”,” including e-HKD and tokenised deposits. The regulatory sandbox for this project involves 11 selected firms from various sectors”,” focusing on three main themes: the settlement of tokenised assets”,” programmability”,” and offline payments. The HKMA plans to share its key findings with the public by the end of 2025. This study will assist in addressing the practical challenges of designing a digital money ecosystem that includes both publicly and privately issued currencies.

Artificial intelligence

Each of the three core financial services regulators made significant policy statements in 2024 on the risk and potential of generative AI. The key touchstone is a Research Paper on Generative AI in financial services published by the HKMA”,” but with significant contributions by the SFC and the Insurance Authority. This led to separate guidelines on the use of Generative AI published by the HKMA in September 2024″,” and by the SFC in November 2024″,” which focused on governance and risk expectations of the regulators in respect of the adoption”,” use and reliance on generative AI. The HKMA has also announced and accepted the first cohort of its Gen AI sandbox initiative to provide a risk-controlled environment for banks to test AI-based solutions in real-world banking scenarios. 2024 was the year when Gen AI crossed the rubicon to become a priority topic of interest to regulators in Hong Kong.

2025 in prospect

Stablecoin legislation

The Stablecoins Bills was published on 6 December 2024 and was introduced to the Legislative Counsel for first reading on 18 December 2024. We can expect 2025 to be the year when this significant legislation to implement stablecoin regulation in Hong Kong is enacted and in force in Hong Kong. This will introduce a regulatory framework for fiat referenced stablecoin (FRS) issuers in Hong Kong. Stablecoin issuers that wish to issue a fiat referenced stablecoin in Hong Kong (or actively market to Hong Kong)”,” or to issue a Hong Kong dollar referenced stablecoin”,” will require to be licensed by the HKMA. They must also fulfil the requirements of the HKMA in respect of capital reserves and asset-backing.

Cybersecurity”,” governance and resilience

The Protection of Critical Infrastructure (Computer System) Bill is already in formal reading before the Legislative Council in Hong Kong and will be implemented in 2025. Banking and financial services is one of the sectors specified for the definition of critical infrastructure in the draft legislation. As part of this initiative”,” a Commissioner”_x0099_s Office will be established to oversee compliance and designate Critical Infrastructure Operators (CIOs). CIOs will be required to establish security management units”,” conduct annual risk assessments”,” and submit regular incident reports. The Security Bureau has stated that it will designate certain sector regulators as designated authorities to monitor organisational and preventive obligations”,” and has indicated that the HKMA will be a designated authority responsible for regulating some service providers in the banking and financial services sector. This will mean that CIOs under the regulatory remit of the HKMA will not need to fulfil additional requirements of the Commissioner”_x0099_s Office in relation to organisational and preventive obligations under the new legislation. We can expect that”,” in time”,” the Security Bureau may also consider the SFC and the Insurance Authority as designated authorities. The industry will also focus on how the Security Bureau will streamline compliance obligations as the new legislation is implemented.

All banks go fintech

Building on the Smart Banking Era Strategy introduced in 2017″,” the HKMA plans to support fintech adoption among Hong Kong banks by promoting digitalization across their operations. To facilitate this”,” the HKMA will conduct a Tech Baseline Assessment in 2025 to evaluate banks”_x0099_ current and future use of fintech”,” focusing on areas that may need further development such as wealthtech”,” insurtech”,” and greentech. The HKMA will again focus on use cases and implementation of artificial intelligence and distributed ledger technology. The HKMA intends to provide additional supervisory guidance to encourage the adoption of new technologies”,” and will enhance its own supervisory processes.

Conclusion

A lot happened in fintech regulation in 2024″,” and much more will happen in the coming 12 months. The key drivers are virtual assets”,” artificial intelligence and cybersecurity.

The financial services industry must bear the burden of meeting obligations of new laws and regulations as they come into force and are implemented. Just as importantly”,” the industry must engage with regulators to influence the regulatory perspective before the direction for further laws and regulations is set. These are interesting times when tech in financial services is more crucial than ever. Collaboration and consultation is key. It”_x0099_s getting to be that new regulation is up there with death and taxes as only certainties we can hold on to.

PÃ¡draig Walsh and Oliver Lam

Extracts from this article were first published on Reglex.io.

If you want to know more about the content of this article”,” please contact:

PÃ¡draig Walsh

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication. This article was last reviewed on 22 January 2025.

text

Featured Articles

text

Featured Articles

text

Featured Articles

text

Featured Articles

text

Featured Articles

text

Featured Articles

text

Featured Articles

text

Featured Articles

text

Featured Articles

text

Featured Articles