How the survey was done: firms representing over 75% of reported securities transactions
On 2 November 2026 the SFC published a press release with the findings of its first Large Firm AI Readiness Survey. The survey ran from July to August 2026 and covered 20 large financial firms together with 78 affiliated licensed corporations in Hong Kong. According to the notes to the release, the sample comprised 12 large global firms, five large Chinese Mainland firms and three large online retail brokers; their affiliated licensed corporations collectively accounted for over 75% of the securities transactions reported by all licensed corporations in the six months ended 30 June 2026.
Two cautions apply. The findings are anonymised and based on firms' own responses rather than the SFC's independent assessment of their systems or controls, and the SFC states plainly that they should not be taken as representative of all licensed corporations. The numbers describe the large end of the market; smaller firms should read them as a direction of travel, not a benchmark.
Headline findings: AI across the front, middle and back office
AI use is extending across business and control functions, spanning front-, middle- and back-office activities. Ninety-five per cent of the firms surveyed expect their AI use to accelerate over the next 12 months, and 90% have connected AI tools to internal systems — AI has moved from assistant to embedded infrastructure.
Cyber defence stands out: 90% of firms are using or evaluating frontier AI models for cyber defence, reporting benefits in faster analysis and broader detection coverage. The lesson generalises beyond finance: AI is both a new source of risk and a practical defensive tool.
Agentic AI: used by 30%, piloted by another 25%
The survey singles out the rise of agentic AI. The SFC defines it as AI capable of autonomously determining and executing the steps needed to achieve an objective, including accessing information or tools and, where authorised, taking actions with limited human direction. Thirty per cent of the surveyed firms already use agentic AI in their business operations and 25% are piloting it, with varying degrees of autonomy and human involvement.
Major use cases include information retrieval, drafting, software development, operational workflows and some trading-related activities. The shift from answering questions to taking actions on your behalf is the survey's most notable change, and the root of the governance challenge.
Where responsible scaling gets stuck
The survey lists the practical barriers to broader adoption: technology integration, the transition from pilots to production use, costs and uncertain business value, data constraints and shortages of skills. Firms also face challenges in extending governance and controls across a growing portfolio of applications, and in maintaining clear accountability and human oversight as workflows become more autonomous.
The SFC's stance: safety-first, human-anchored, collaboration-led
Dr Eric Yip, the SFC's Executive Director of Intermediaries, summarised the approach: "Our supervisory approach is safety-first, human-anchored and collaboration-led. As AI becomes more autonomous, we must put humans even more firmly in the driving seat." He added: "Scaling AI takes more than powerful models and promising use cases. It takes reliable infrastructure, sound data, the right expertise and governance that keeps pace with the technology."
The findings will inform four supervisory priorities: protecting investors as AI reshapes their interactions with firms; strengthening cybersecurity and operational resilience as AI introduces new threats and dependencies; ensuring effective AI governance by rethinking how human accountability and oversight are embedded in increasingly autonomous workflows; and building knowledge and capability through engagement and collaboration.
On controls, the SFC says it will focus on preserving human accountability throughout AI-enabled business processes: clear objectives, defined limits on access and authorised actions, and effective monitoring and intervention. Controls should be proportionate to an application's authority and potential impact, rather than requiring manual approval for every output or action.
What comes next: further guidance on agentic AI
On the same day at Hong Kong FinTech Week, The Standard reported SFC Chief Executive Julia Leung as saying that reviewing every intermediate step of agentic AI manually is not feasible, so the SFC will develop practical, principles-based guidance for higher-autonomy applications, focused on preserving human accountability and oversight throughout the workflow. She noted that agentic AI can compound errors across steps, take unauthorised actions and disrupt other firms in unintended ways.
The Standard also reported that the SFC plans a cybersecurity framework with baseline requirements for all licensed firms and enhanced requirements for higher-risk firms, responding to AI-related cyber threats. Firms should watch for these publications.
What businesses can do now
Even outside the licensed sector, the direction travels. Four practical steps follow from the SFC's message. First, inventory the AI applications already in use and mark each one's degree of autonomy and external impact. Second, for more autonomous applications, set clear objectives and defined limits on access and authorised actions. Third, build monitoring and intervention so that when something goes wrong you can stop and trace it quickly. Fourth, fix the foundations — data, infrastructure and skills — before scaling further.
This article is based on the SFC's public materials and published reporting and is not legal advice; licensed corporations and regulated businesses should confirm specific requirements with the SFC and their professional advisers.