Regulatory Updates June 2026 – APAC Region

The Monetary Authority of Singapore (MAS) has issued a consultation paper proposing amendments to its Notices on Technology Risk Management (TRM). The proposed changes are intended to strengthen technology risk management standards for Singapore financial institutions in response to emerging high-tech and AI-driven threats.

MAS is seeking to raise the regulatory baseline by incorporating the proposed amendments into the various TRM Notices. Financial institutions would be required to:

1. IT Asset Management – Maintain an accurate and up-to-date inventory of all IT assets.
2. IT Risk Assessment and Monitoring – Establish and maintain an IT risk management framework that includes risk assessments, a risk register and key risk indicators.
3. Capacity Planning and Management – Implement a framework and process for capacity planning to manage critical systems.
4. Change Management – Ensure changes to systems are properly managed and implemented.
5. Continuous System and Security Monitoring – Continuously monitor system performance and security for critical systems and remediate issues
6. Immutable or Offline Data Backup – Maintain immutable and/or offline backups to enable timely restoration of services.
7. Incident Management – Implement an incident management framework and process to manage IT incidents.
8. Monitoring of Unscheduled Downtime – Include partial or intermittent disruptions in the computation of unscheduled downtime for critical systems.

The consultation closes on 31 July 2026. Interested parties may submit feedback through the consultation link.

Please refer to the consultation paper at this link.

On 2 June 2026, the Securities and Futures Commission (SFC) issued a circular reminding licensed corporations, SFC-licensed VATPs and associated entities (Licensed Firms) to review and enhance cybercyber security measures against AI-enabled cyberattacks. The circular follows SFC engagements with firms on preparedness and provides practical guidance. Senior management, including the MIC-IT, is ultimately responsible for managing these risks and ensuring timely implementation of enhancements (Circular).

Developments in AI-enabled cyber threats

Frontier AI models significantly reduce the time, cost and expertise needed to identify and exploit vulnerabilities, including zero-day vulnerabilities, and to chain lower-risk vulnerabilities for high-impact, large-scale attacks. AI tools also lower barriers for phishing, social engineering and deepfakes, leading to more frequent and targeted attacks with faster exploitation windows. Licensed Firms must review whether existing prevention, detection, response and recovery procedures remain effective and expedite patching and vulnerability management processes.

Key cyber security measures expected by the SFC

Licensed Firms must maintain an accurate, up-to-date inventory of technology assets, identifying externally exposed and business-critical components to enable rapid prioritisation. They should review and enhance their cybercyber security frameworks in the following areas:

• Patching and vulnerability management: Promptly address known vulnerabilities with policies for urgent fixes outside routine cycles, especially for business-critical components, and allocate resources for potential surges.
• Access and privilege controls: Assume compromise, enforce least-privilege access, apply micro-segmentation, treat untrusted inputs as adversarial, and apply maker-checker controls for high-impact actions.
• Detection and monitoring: Strengthen anomaly detection in trading and system activities and improve threat intelligence.
• Third-party supply chain risk management: Enhance assessments of third-party providers supporting critical operations, factoring in AI-enabled threats.
• Incident response and recovery: Establish faster escalation, pre-planned containment strategies, regular testing, including tabletop exercises and simulated attacks, and reliable backups. Promptly notify the SFC of material incidents in accordance with the Code of Conduct and VATP Guidelines.

AI language model risks

Firms using AI language models must address additional risks, including adversarial attacks, data leakage and prompt override, in their cybercyber security framework and incident handling, referencing the November 2024 Circular. Notification is required for high-risk use cases under the Licensing and Registration (Information) Rules. Licensed Firms should assess gaps and implement enhancements promptly under MIC-IT and senior management oversight.

For assistance or if you have any enquiries about this circular, please contact Waystone.

To view the circular, please click here.

On 5 June 2026, the SFC issued a circular supplementing UT Code 8.8 with additional requirements for authorising listed structured funds for public offering in Hong Kong. It incorporates and supersedes SFC’s 22 May 2020 L&I Products circulars. Listed structured funds must meet the Overarching Principles Section and UT Code, particularly ETF requirements in 8.6, plus the additional requirements in this circular (Circular).

General requirements for listed structured funds

• Product naming must clearly differentiate listed structured funds from conventional ETFs.
• Product structures may make extensive use of derivatives, including futures-, swap- or options-based strategies.
• The Product KFS must contain upfront disclosure of key risks and features, including investment time horizon, periodic reset, futures versus spot correlation, volatility, internalised derivative, roll or swap costs, and maximum redemption fee.
• At least one market maker is required on an ongoing basis.
• A performance simulator is generally required, except for delta-one products, with a user-friendly interface and explanatory narratives.
• Extensive investor education required before launch.
• Distribution is subject to derivative product requirements under the Code of Conduct, including paragraphs 5.1A to 5.3, staff training and best-interest obligations.

Additional requirements for leveraged and inverse products

These requirements apply to products tracking broad-based indices or highly liquid mega-cap single stocks.

• Maximum leverage is generally capped at 2x to -2x, or -1x for Mainland equity inverse products, and may be lower for single stock L&I products.
• Products must be named “Leveraged Product” or “Inverse Product”, include the leverage factor and “daily”, and sit within a standalone category with “L” or “I” short names and designated codes.
• The KFS must include prominent warnings that L&I products are daily rebalanced trading tools, suitable only for sophisticated investors who monitor them daily, and may deviate from the underlying asset when held overnight.
• Termination is required if all market makers resign, and HKEX monitors performance.
• Providers must continuously monitor capacity and promptly notify the SFC of any adverse capacity issues affecting rebalancing or creation.
• Single stock L&I products are subject to higher standards on provider acceptability, including proven L&I experience, group support, diversified counterparties and initial capacity, robust business continuity plans with clear triggers and contingency or defensive measures, and trading suspension rules aligned with the underlying stock.

For assistance or if you have any enquiries about this circular, please contact Waystone.

To view the circular, please click here.