Hong Kong Family Office AI Research: SFC Boundaries

SFC regulatory boundaries and compliance design

Family offices are a fast-growing wealth management model in Hong Kong, and the appeal of AI research tools to this group is plain: rapidly consolidating information, generating research summaries and monitoring market developments are all work that traditionally needed a lot of manpower. But AI applications at Hong Kong family offices need to be designed within the boundaries of the SFC regulatory framework, and those boundaries became more specific in late 2024.

Where Licensing Requirements Meet AI Research

A single family office in Hong Kong (managing only its own family’s assets) generally does not need to apply to the SFC for a licence. A multi-family office (MFO) that provides services to outside parties generally needs a Type 4 licence (advising on securities) and/or a Type 9 licence (asset management).

The key question for AI research tools within this framework: if a family office relies on AI-generated research to give investment advice to clients, that may trigger a finding of Type 4 regulated activity. The SFC’s consistent position is that licensing requirements depend on the actual nature of the activity, and job titles or tool labels do not decide them. Using AI-generated investment research as the basis for client advice does not change the regulatory character of the activity because of the tool’s automated nature.

The Direct Impact of the SFC’s 2024 AI Circular

On 12 November 2024 the SFC issued its Circular to Licensed Corporations on the Use of Generative AI Language Models (Ref 24EC55), mandatory and effective immediately. The circular is organised around four core principles, the first being senior management oversight, running through the whole lifecycle of the AI system.

The SFC now requires a written AI governance policy to be submitted as one of the application documents when applying for Type 1, 4 and 9 licences. Licensed institutions must conduct pre-deployment testing of AI models and bias testing at least once a year thereafter. This means that adopting AI research tools is now directly tied to the compliance requirements for obtaining and maintaining a licence.

Which Tasks Suit AI Assistance

Investment research support tasks suited to AI: data aggregation (consolidating financial data across multiple sources), document summarisation (first-pass summaries of financial reports, market reports and regulatory documents), market monitoring (real-time tracking of trigger words or events) and first-pass organisation of earnings analysis.

What these tasks have in common: AI produces the initial output, while the licensed analyst is responsible for interpretation, evaluation and the final judgement, and the AI tool’s output is the starting point of the work and not the conclusion.

Tasks that need a licensed person’s judgement: specific investment recommendations made to clients, asset allocation plans based on the client’s risk tolerance, and formal written advice given in a regulated capacity.

For hallucination and citation problems in AI research output, see AI-Assisted Research: Hallucination Detection, Citation Verification and Source Tracking; for the corresponding responsibility framework in another professional sector, see Hong Kong Law Firm AI Review.

Input Risk with Material Non-Public Information (MNPI)

The SFC circular explicitly warns that AI language models may “amplify” existing risks and create additional ones. Entering unpublished price-sensitive information (MNPI) into an external AI API may breach the SFC’s inside information rules, because once information is entered into a third-party service, data sovereignty questions follow.

The 2025 Hong Kong digital guidelines also state explicitly that trade secrets and sensitive information should not be processed with public AI services that lack security safeguards. When choosing AI tools, a family office must distinguish the types of information that can be processed through a public API from the information that must stay in a controlled environment, and confirm at the level of the terms of use how data is processed and stored.

For a checklist on data flows and handling terms, see What Hong Kong Businesses Need to Know About Data Flows Before Using AI on Confidential Documents.

The HKMA’s Supplementary Framework

The consumer protection principles set out in the HKMA’s August 2024 circular (aimed mainly at the banking sector) can serve as a reference: allowing customers to opt out of, or to request human intervention in, customer-facing AI applications, and continually monitoring AI output. Although these principles do not directly regulate family offices, they represent the overall direction of Hong Kong regulators’ expectations for AI applications in financial services.

Summary

Compliance design for a Hong Kong family office using AI research tools must handle two levels at once: regulatory character (whether the AI research use triggers a licensing requirement) and data security (whether MNPI and commercially sensitive information can be transmitted through the chosen AI platform). The SFC’s 2024 circular has put the AI governance policy into the licence application requirements, lifting the decision to adopt AI tools from a business efficiency question to a compliance design question.