SFC Signals AI Guidance and Cyber Rules: What It Means for Crypto Accounting Software

Hong Kong's securities regulator has told the market that AI oversight and cyber resilience requirements are coming for licensed firms, and that tokenisation will scale only when it delivers real economic benefits. For finance teams choosing or running crypto accounting software, the practical message is that tooling, data controls and audit trails will increasingly be judged against regulatory expectations on human accountability and cybersecurity.

What the SFC actually said

The signals come from remarks by Ms Julia Leung of the Securities and Futures Commission (SFC), who spoke on a panel at Hong Kong FinTech Week 2026. A synopsis titled "Galvanising Responsible Innovation for Capital Markets through AI and Tokenisation" was posted on the SFC website. The source is a speech synopsis and not a consultation paper or a rule text, so everything below is a statement of intent, not binding obligation. The lifecycle stage is best read as proposed.

Three announcements in brief

• AI guidance: The SFC said AI development and adoption in Hong Kong are growing rapidly in scale and speed. It will develop practical, principles-based guidance for AI applications that involve greater autonomy, focused on safety and on preserving human accountability and oversight across the workflow.
• Cybersecurity framework: The SFC plans to set out a cybersecurity framework for licensed firms, supplemented by enhanced requirements for firms with higher risk profiles, to strengthen cyber resilience against AI-enabled threats.
• Tokenisation: Hong Kong firms are leading in tokenisation, which the SFC said will scale when it can provide tangible economic benefits for the market.

What was not said

The synopsis gives no dates, no consultation timetable, no list of in-scope firm types and no detail on what the "enhanced requirements" will contain. Firms should not treat any of those as settled. The sensible reading is directional: the regulator is telling licensed firms where supervisory attention is heading.

Why AI autonomy guidance matters for crypto accounting software

Finance functions are adopting automation quickly. Transaction classification, wallet reconciliation, pricing and journal drafting can all be assisted by models that act with limited human input. The SFC's emphasis on "greater autonomy" and on human accountability across the workflow maps directly onto those use cases.

Accountability does not transfer to the tool

The principle the SFC highlighted is that accountability and oversight stay with people. For an accounting firm or a CFO, that means an automated classification or valuation is still your judgment once it lands in the ledger. If guidance follows the principles-based approach described, expect questions such as who reviewed the output, what the override process is, and how exceptions are recorded.

What to look for in your tooling

Without assuming what the final guidance will say, a reasonable procurement and review checklist for crypto accounting software, crypto bookkeeping software or any digital asset accounting software includes:

• A clear record of which entries were machine-suggested and which were human-approved.
• The ability to override automated treatment and keep the original suggestion for audit purposes.
• Documented logic for how the tool selects pricing sources, cost-basis methods and transaction types, so a reviewer can challenge it.
• Role-based access, so approval rights match your internal segregation of duties.

These are good practice under existing audit and internal-control expectations whether or not the SFC guidance lands in this form. They also give you a head start if it does.

The cybersecurity framework and your books and records

The SFC said it plans to set out a cybersecurity framework for licensed firms, with enhanced requirements for higher-risk profiles, aimed at AI-enabled threats. Accounting data for crypto is unusually sensitive: it can contain wallet addresses, exchange account links, counterparty details and, in some set-ups, API keys with read or trade permissions.

For B2B readers: firms, auditors and CFOs

If you are a licensed firm in Hong Kong, your accounting stack is part of your operational risk surface. Third-party software that holds exchange connections or custody data should be assessed as part of vendor risk management. Consider reviewing how credentials are stored, whether API keys are scoped to read-only, how access is logged, and what the vendor's incident-notification commitments are. If you are an accounting or audit firm serving licensed clients, expect clients to ask how you handle their on-chain and exchange data.

Firms with higher risk profiles are flagged for enhanced requirements. The synopsis does not define "higher risk", so do not assume where your firm falls. A prudent step is to run a self-assessment now and note the assumptions, so you can adjust quickly once definitions are published.

For B2C readers: individual filers

The framework targets licensed firms, not individual taxpayers, so nothing in the synopsis creates a new duty for a person filing their own return. It is still a reminder that you are handing sensitive data to whichever software or service you use. Prefer read-only connections where possible, use strong authentication, and keep your own exported records of transactions so you are not dependent on one provider's access.

Tokenisation: economic substance first

The SFC said Hong Kong firms are leading in tokenisation, and that it will scale when it provides tangible economic benefits. That is a notable framing: the test is market utility, not novelty.

Accounting implications

Tokenised instruments raise familiar questions in new form. What is the underlying asset or claim? Who holds legal title? Is the token a financial instrument, a representation of one, or something else? The answer drives recognition, measurement and disclosure. The synopsis does not set out any accounting treatment, and it would be wrong to infer one. What it does tell you is that tokenised products from Hong Kong firms are likely to become more common, so teams should make sure their ledgers can represent a token and its underlying exposure as separate attributes.

Tax and AML angles

The source covers neither tax nor anti-money-laundering rules, so no conclusions should be drawn from it on those fronts. Practically, though, any scaling of tokenised products brings more transfers, more counterparties and more records. Reconciliation discipline, wallet-level tracking and clear documentation of the purpose of each transaction support both tax reporting and AML monitoring, whatever rules apply to you.

Practical next steps

This quarter

• Inventory where AI or automation touches your accounting workflow, and name the human owner of each step.
• Map your accounting tools and integrations, noting what data each one can access.
• Review credential hygiene: scoped API keys, access logs, multi-factor authentication.
• Watch the SFC website for the guidance and framework, since the synopsis gives no publication date.

When drafts appear

• Compare your controls against any principles on safety, oversight and accountability.
• Check whether your firm could fall into a higher-risk category.
• Consider responding to any consultation, since principles-based guidance is shaped by practitioner feedback.

For wider context on how crypto firms are managing operational and compliance risk, see our crypto compliance reporting pillar, our piece on enterprise risk management for crypto-active financial services firms, and our look at an AI-assisted breach of customer data, which illustrates the kind of AI-enabled threat regulators have in mind.

Bottom line for finance teams

This is a signal, not a rulebook. The direction is consistent: more automation is welcome, but people stay accountable, and cyber resilience expectations will rise, especially for riskier firms. Choose crypto accounting software that makes human review visible, protects the data it touches, and can represent tokenised assets accurately. Build those habits before the formal text arrives.

FAQ

Is the SFC announcement a binding rule?

No. It comes from a speech synopsis at Hong Kong FinTech Week 2026. The SFC said it will develop guidance and plans a cybersecurity framework, so formal text is still to come.

Does this apply to individual crypto taxpayers?

The cybersecurity framework is aimed at licensed firms. Nothing in the synopsis creates new duties for individuals, though careful data handling is sensible for anyone using accounting tools.

What does human accountability mean for automated bookkeeping?

The SFC said guidance will focus on preserving human accountability and oversight across the workflow. In practice, keep clear records of who reviewed and approved automated outputs.

Which firms face enhanced cybersecurity requirements?

The SFC referred to firms with higher risk profiles but the synopsis does not define them. Watch for the framework text before assuming where your firm sits.

Does the synopsis set an accounting treatment for tokenised assets?

No. It says only that tokenisation will scale when it delivers tangible economic benefits. Treatment should follow the applicable accounting standards and the specific token's rights.