Hong Kong's Securities and Futures Commission said 30% of the large financial groups it surveyed already use agentic AI in their operations and another 25% are piloting it, and the regulator plans new guidance for autonomous systems and a cybersecurity framework for every licensed firm.

The findings, published on Nov. 2 in the SFC's first Large Firm AI Readiness Survey, come from 20 groups whose 78 licensed corporations account for more than 75% of securities transactions reported by all licensed corporations in the six months to June 30. For brokers and asset managers in the city, that makes the report the clearest signal yet of how the regulator intends to supervise software that can act with limited human direction, including in some trading-related work.

The survey covered 12 large global firms, five large mainland Chinese firms and three large online retail brokers. It was conducted in July and August, and the SFC noted that answers reflect the firms' own descriptions rather than an independent check of their systems.

How Hong Kong brokers use AI today

In front-office work, investment research and analytics led at 80% of firms, followed by client communications and documentation and client service at 65% each. Use was thinner in client-facing decisions: 30% reported AI in trading and execution, 20% in product offering and distribution and 15% in investment advice and portfolio management.

Inside middle-office functions, 55% used AI for compliance and regulatory monitoring and 35% for fraud detection and anti-money laundering work. Technology development support was the most common back-office use, at 90%.

The systems are also wired deeper into firms' plumbing. Ninety percent of firms said they had connected AI tools to internal systems, most often email and messaging platforms and document repositories (85% each). Eight firms (40%) linked AI to trading, order or portfolio systems.

On autonomy, six firms permit agentic AI in live production and five in controlled pilots or tests. The other nine are developing or considering use cases. Sixteen of the 20 groups expect to use more agentic AI over the next 12 months, though only five foresee a substantial increase; 11 expect a modest one. Across AI use as a whole, 95% of firms expect adoption to accelerate within a year.

The obstacles are practical. Fourteen firms (70%) cited trouble integrating AI with existing technology and moving from pilots to production, and 12 (60%) pointed to cost and uncertain business value. Data constraints, cross-border regulatory alignment and skills shortages were each named by 11 firms.

Eric Yip, the SFC's executive director of intermediaries, said the regulator's approach is "safety-first, human-anchored and collaboration-led." The SFC said controls should match an application's authority and potential impact, rather than requiring manual sign-off on every output.

SFC plans guidance and a cybersecurity framework

SFC Chief Executive Julia Leung previewed the results at a Hong Kong FinTech Week panel the same day. According to a synopsis of her remarks published by the commission, she said the SFC will develop practical, principles-based guidance for AI applications with greater autonomy, built on the survey and on trials in the regulators' GenAI Sandbox++.

She said human review of every intermediate step is unrealistic, but that agentic systems change the nature and scale of risk because they can compound errors across steps, take unauthorized actions and disrupt other firms. Low-impact, reversible tasks such as selected back-office processes and surveillance could be a starting point, she said, while client advice, portfolio decisions and market-facing execution need progressively stronger safeguards.

On cyber risk, Leung cited recent global alerts over critical flaws in PHP and other web development tools, which she said drew millions of attempted exploits worldwide within a day. Some licensed corporations took websites offline pending patches, and a few reported disruptions from problems at their system vendors, according to the synopsis. The SFC's own systems were not compromised.

The commission plans a cybersecurity framework with baseline requirements for all licensed firms and enhanced requirements for those with higher risk profiles. The survey found 18 firms (90%) are using or evaluating frontier AI models for cyber defence, and nine (45%) use AI in adversary simulation. Leung called for "fighting AI with AI," the synopsis said.

The SFC did not give a timetable for either the AI guidance or the cyber framework.

Tokenization moves toward commercial use

Leung also gave figures on tokenized products. Up to September, the SFC had authorized 17 tokenized retail products with assets under management of US$1.3 billion, up 34% over 12 months. A week earlier, the regulator approved 24/7 secondary trading in two tokenized money market funds on licensed virtual asset trading platforms, and on Nov. 2 the Hong Kong Monetary Authority moved its Project Ensemble to round-the-clock settlement in tokenized central bank money, the same day it launched Project SAGE for AI agents in banking.

In a separate FinTech Week keynote, Elisa Ng, the SFC's executive director of investment products, said Hong Kong's tokenization focus is shifting from building infrastructure to commercialization. The commission said a new "innovation pathway" will give regulatory flexibility for controlled pilots and new product launches, and that it sees room to connect tokenized funds with digital money for liquidity and treasury management.

The SFC said the survey findings will feed into four supervisory priorities: investor protection, cybersecurity and operational resilience, AI governance and industry capability. The next concrete marker for licensed firms will be the consultation or circular that sets out the baseline cyber requirements.