New synopsis by Julia Leung: Panel remarks at Hong Kong FinTech Week 2026

On November 02, 2026, Ms Julia Leung, Chief Executive Officer of the Securities and Futures Commission (the "SFC"), delivered panel remarks entitled 'Galvanising Responsible Innovation for Capital Markets through AI and Tokenisation' at Hong Kong FinTech Week 2026. In her address, she set out regulatory perspectives on the rapid adoption of artificial intelligence—particularly agentic AI—in capital markets, its implications for investor protection, market resilience, and cybersecurity, as well as Hong Kong's progress in securities tokenisation.

Regulatory Commitments and Key Policy Directions

The SFC announced three principal regulatory commitments. First, it would develop practical, principles-based guidance governing AI applications involving greater autonomy, with an emphasis on safety and the preservation of human accountability across all workflow stages. Second, the Commission planned to establish a cybersecurity framework for licensed corporations, supplemented by enhanced requirements proportionate to firms' risk profiles, in order to strengthen cyber resilience against AI-enabled threats. Third, it affirmed that Hong Kong's tokenisation initiatives would scale once they demonstrated tangible economic benefits to market participants.

Agentic AI Adoption and Risk Management

Ms Leung observed that the adoption of AI among intermediaries in Hong Kong was expanding rapidly in both scope and velocity. She cautioned that frontier model development and agentic AI capabilities may outpace traditional regulatory assessment cycles, necessitating a more agile collaborative approach between regulators and industry participants. To illuminate this trajectory, she previewed key findings from an SFC survey conducted across 20 large financial groups—collectively representing approximately 75% of securities turnover and 45% of clients reported by licensed corporations—which was to be published later that same day.

The survey revealed that all twenty respondent groups were already deploying AI in research, analytics, and back-office support functions. With respect to agentic AI specifically, more than half had either adopted or piloted such systems, and approximately 80% anticipated further adoption within the ensuing twelve months. Building on these findings and Sandbox++ trial outcomes, the SFC indicated it would provide additional guidance on agentic AI deployment as appropriate.

In articulating its regulatory philosophy for autonomous AI applications, Ms Leung stated that requiring human review of every intermediate step was impractical where greater autonomy is involved. The Commission's approach would therefore centre on preserving human accountability and oversight throughout the workflow—a position informed by the recognition that agentic systems can compound errors across multiple steps, execute unauthorised actions, and inadvertently disrupt other market participants in unintended ways. She noted a graduated risk framework: autonomous functions might commence with low-impact, reversible workflows, while market-facing execution performed on behalf of clients would demand progressively stronger safeguards commensurate with associated risks. The GenAI Sandbox++ initiative launched by financial regulators was identified as the appropriate venue for testing whether decisions can be reconstructed, actions traced, outcomes explained, and accountability determined in the event of failure.

Cybersecurity Resilience Against AI-Enabled Threats

Ms Leung underscored that AI is fundamentally altering the speed at which latent software vulnerabilities escalate into large-scale threats. She cited recent global alerts regarding critical flaws in PHP and other web development tools, noting that such defects could permit unauthorised control of an unpatched server without authentication or exposure of sensitive data; in the case of the identified PHP vulnerability, millions of attempted exploits were reported globally within a single day.

She recorded that certain licensed corporations had taken affected websites offline as a precautionary measure pending application of patches, while others experienced operational disruptions attributable to issues at their system vendors. The SFC's own systems remained uncompromised owing to the early deployment of relevant PHP patches. Reiterating its June circular warning, Ms Leung urged all licensed corporations to prioritise critical remediation and maintain robust cyber hygiene practices.

On a positive note, survey data indicated that approximately 90% of respondent groups were either using or evaluating frontier AI for defensive cybersecurity purposes, with nearly half employing AI in adversarial simulation and threat hunting. Ms Leung advocated the principle of 'fighting AI with AI.' Looking ahead, the SFC planned to promulgate a cybersecurity framework establishing baseline requirements applicable to all licensed firms, supplemented by enhanced obligations calibrated to higher-risk profiles. The Commission was also intensifying inter-regulatory coordination on intelligence sharing and financial sector resilience, and leading joint initiatives among Asia-Pacific securities regulators to address operational incidents or large-scale fraud schemes with cross-border dimensions.

Securities Tokenisation: Regulatory Progress and Market Scaling

Following several years of constructing a comprehensive regulatory architecture for tokenised assets, Ms Leung provided an update on implementation. Since the SFC's 2023 circular enabling technology wrap for investment products, the Commission had authorised up to seventeen (17) tokenised retail products as at September 2026, with aggregate assets under management of US$1.3 billion—a year-on-year increase of approximately 34%.

In a significant development occurring in the week immediately preceding her remarks (late October to early November 2026), Hong Kong became the first jurisdiction globally to permit secondary trading of tokenised money market funds on licensed VATP platforms, thereby enabling round-the-clock access. On that same morning, the Hong Kong Monetary Authority announced the availability of 24/7 interbank settlement in Central Bank Digital Currency ("CBDC"), which would allow tokenised deposits to support continuous real-value transactions, including those involving tokenised fund products.

Concluding Remarks: Innovation, Trust, and Long-Term Market Development

In closing, Ms Leung drew an analogy between building market scale in tokenisation and wiring a lighting grid—the more connections established, the greater the illumination. She expressed that the true milestone would be reached when investors and institutional participants select tokenised products on the basis of superior functionality and enhanced outcomes for holders, rather than merely by virtue of their tokenised form. She concluded that innovation and safety are not mutually exclusive; trust serves as the foundational bridge between them. Regulators should establish clear, risk-aware guardrails that facilitate progress while cementing market confidence, such that genuine success is measured by innovation that benefits investors, strengthens efficiency and resilience, and supports sustained long-term development of capital markets with credibility.