What changed, and when.
- 31 Oct 2019Circular 19EC59 on external electronic data storage. Records kept only with a cloud provider need a Hong Kong data centre or an undertaking from the provider.
- 12 Nov 2024Circular 24EC55 on generative AI language models, with immediate effect. Investment research, advice and recommendations to clients named high-risk use cases.
- TodayEvery licensed corporation using AI for research carries the high-risk duties below.
In the SFC’s words.
The circular is short and direct. Three paragraphs set the tone for a research desk.
“The SFC considers using an AI LM for providing investment recommendations, investment advice or investment research to investors or clients as high-risk use cases.”
“Having a human in the loop to address hallucination risk and review the AI LM’s output for factual accuracy before relaying it to the user.”
“LCs remain accountable for their output regardless of the risk mitigation measures adopted.”
The circular also names the risks it has in mind. Among them, at para 4(b), “inadvertent leakage of confidential information in relation to a firm or its clients”, and at para 22, that “the use of AI LM-based browser extensions may entail privacy and data leakage risks”.
What it requires.
For a high-risk use such as research to clients, the circular asks licensed corporations for four things.
- 1Model validation and ongoing monitoring of the output for factual accuracy.
- 2A person in the loop who reviews the output before it reaches the client.
- 3Testing that answers hold up when the same question is asked a different way.
- 4Notifying the SFC of the change to the business when a high-risk use starts.
The 2019 storage circular adds a point about records. Where a firm keeps regulatory records only with an outside data storage provider, the provider must hold them in a Hong Kong data centre, or the firm must obtain an undertaking from the provider, and the records must be available to the SFC on demand (circular 19EC59, para 7).
What it means on a research desk.
Most desks already use AI. Analysts summarise filings with it, draft notes with it, and paste in broker reports to ask what changed. Under the circular, three habits have to be in place.
- 1Every AI-written note gets a reviewer before anyone acts on it or sends it to a client.
- 2There is a record of what was asked, what was answered, and who checked it.
- 3No confidential document, position or client detail is pasted into a tool outside the firm’s control.
Review is the hard part. In AlphaSense’s 2026 survey of 1,028 business and finance professionals, 62% said a bad AI output had hurt them and 21% said they had quoted a fabricated source. A reviewer can only catch that if every figure shows where it came from.
How Core answers each requirement.
- A person reviews for factual accuracy
- Every figure cites its source page, and a figure with no source is flagged, so the reviewer checks numbers in one click instead of retyping them.
- Accountability and a record
- Each Ask answer is logged with the model, where it ran, its sources and who reviewed it. The log is kept on the machine in your office.
- Confidential information
- Core runs on hardware your firm owns, in your office, and your documents stay on it. What leaves depends on the setup, and we state it for each: on a Mac mini, questions go to a cloud model under your own agreement.
- Evidence for the SFC
- An inspection pack in one download: the model card, controls, the use-case inventory and the answer log, framed on the SFC’s principles.
- Records the SFC can reach
- The answer log is kept on your machine in your office, not with a cloud provider outside Hong Kong.
This is a summary of public documents, not legal advice. Check how they apply to your firm with your compliance team.
Questions.
Does the SFC treat AI used for investment research as high-risk?
Yes. Circular 24EC55 of 12 November 2024 says, at para 8, that the SFC considers using an AI language model for investment recommendations, investment advice or investment research to investors or clients as high-risk use cases.
What does “human in the loop” mean in the SFC circular?
Para 18(b) asks for a person who reviews the AI model’s output for factual accuracy, to address hallucination risk, before it is relayed to the user. For a research desk, that means a named reviewer checks each AI-written note before it is used or sent.
Is the firm still responsible if the AI makes a mistake?
Yes. Para 16 says licensed corporations remain accountable for their output regardless of the risk mitigation measures adopted.
Can AI answers be stored with a cloud provider outside Hong Kong?
Under the SFC’s 2019 circular on external electronic data storage (19EC59, para 7), regulatory records kept only with an outside provider need a Hong Kong data centre or an undertaking from the provider. Check with your compliance team which AI records count as regulatory records for your firm.
