2026年6月证监会观察：AI驱动的网络战已至，单一股票杠杆产品登场—

引言 / Introduction 香港证券及期货事务监察委员会（SFC）在2026年6月发布了数份关键通函，这些通函将直接影响持牌法团（LCs）、虚拟资产交易平台（VATPs）及基金产品管理人。本文用通俗易懂的语言对每份通函进行了总结，并提供了务实的评论及建议执行要点。本文不构成法律建议，权威指引请参考证监会原版通函。 The Securities and Futures Commission (SFC) of Hong Kong issued several key circulars in June 2026 that directly affect Licensed Corporations (LCs), Virtual Asset Trading Platforms (VATPs), and fund product providers. This article provides a plain-language summary of each circular, practical commentary, and suggested action items. This is not legal advice. Please refer to the original SFC circulars for authoritative guidance. 重要法律声明 / Important Legal Disclosure 本文内容仅供一般信息参考和讨论之用，不构成任何法律、监管或合规建议。尽管我们已尽合理努力对证监会通函进行准确总结，但该总结可能并不完整，亦未必适用于您的具体情况。证监会是其规则、通函和指引的唯一权威来源。您不应将本总结作为任何商业决策、监管申报或合规计划的依据。在根据这些通函采取任何行动之前，强烈建议您咨询自身的专业法律及合规顾问。 This content is for general informational and discussion purposes only and does not constitute legal, regulatory, or compliance advice. While reasonable efforts have been made to summarise the SFC circulars accurately, this summary may not be complete or applicable to your specific circumstances. The SFC is the sole authoritative source for its rules, circulars, and guidance. You should not rely on this summary as a basis for any business decision, regulatory filing, or compliance program. You are strongly advised to consult your own qualified legal and compliance advisors before taking any action in response to these circulars. 通函一：2026年6月2日 – 应对人工智能驱动的网络攻击 Circular 1: 2 June 2026 – Countering AI-Enabled Cyberattacks 概要 / Summary 证监会发出通函，提醒持牌法团、虚拟资产服务提供者及其有联系实体（统称"持牌机构"）检视并加强网络安全措施，以应对前沿人工智能模型带来的新兴网络攻击风险。证监会指出，人工智能的发展正在迅速降低网络犯罪的门槛，攻击变得更加频繁和复杂，漏洞从被发现到被利用的时间窗口已大幅缩短。 The SFC issued a circular reminding Licensed Corporations, virtual asset service providers, and their associated entities (collectively, "licensed institutions") to review and strengthen cybersecurity measures to address emerging cyberattack risks posed by advanced AI models. The SFC noted that the development of AI is rapidly lowering the barrier to cybercrime, with attacks becoming more frequent and sophisticated, and the window between vulnerability discovery and exploitation has significantly narrowed. 行业评论 / Commentary 该通函标志着监管机构对网络安全风险的认知进入了新阶段——传统以"人力速度"为前提的安全架构已不足以应对人工智能驱动的自动化攻击。证监会强调高级管理层（包括负责资讯科技职能的核心职能主管）对网络安全风险管理负有最终责任。值得注意的是，证监会明确表示可能进行现场检视以评估持牌机构的准备程度，若发现重大缺陷将采取监管行动。 This circular marks a new phase in the regulator's approach to cybersecurity risk – traditional security architectures predicated on "human speed" are no longer sufficient against AI-driven automated attacks. The SFC emphasises that senior management (including the Core Function Heads responsible for IT functions) bear ultimate responsibility for cybersecurity risk management. Notably, the SFC explicitly stated that on-site inspections may be conducted to assess licensed institutions' preparedness, and regulatory action will be taken if material deficiencies are identified. 持牌法团建议执行要点 / Suggested Action Items for Licensed Corporations 修补及漏洞管理：及时修补漏洞，优先处理高风险漏洞，建立例行修补周期之外的紧急更新流程，并分配充足资源以应对修补需求的潜在激增。 Patch and Vulnerability Management: Patch vulnerabilities promptly, prioritise high-risk vulnerabilities, establish emergency update processes beyond routine patching cycles, and allocate sufficient resources to address potential surges in patching demands. 接达及权限监控：采用零信任假设（任何用户或装置都可能已遭入侵），仅授予人员履行职责所需的最低权限，加强防火墙及网络分段，将外部数据（如电邮或网页内容）视为潜在有害。 Access and Privilege Control: Adopt a zero-trust assumption (any user or device may already be compromised), grant only the minimum privileges necessary for personnel to perform their duties, strengthen firewalls and network segmentation, and treat external data (such as emails or web content) as potentially hostile. 侦测及监察：加强客户交易及系统活动中异常情况的监察，提升威胁情报收集能力。 Detection and Monitoring: Enhance surveillance of anomalies in client transactions and system activities, and upgrade threat intelligence collection capabilities. 第三方供应链风险管理：加强对外部供应商的监督，对关键服务提供者进行彻底审查，评估集中风险，并落实合约中的安全事故通报要求。 Third-Party Supply Chain Risk Management: Strengthen oversight of external vendors, conduct thorough reviews of critical service providers, assess concentration risks, and implement contractual security incident reporting requirements. 事故应对及复原：定期测试应急计划，备有预先批准的步骤以快速隔离被入侵系统，至少每日备份数据，并立即向证监会报告重大事件。 Incident Response and Recovery: Regularly test contingency plans, have pre-approved steps to rapidly isolate compromised systems, back up data at least daily, and report material incidents to the SFC immediately. 通函二：2026年6月5日 – 上市结构性基金（含单一股票杠杆及反向产品）框架更新 Circular 2: 5 June 2026 – Updated Framework for Listed Structured Funds (including Single Stock L&I Products) 概要 / Summary 证监会修订了关于上市结构性基金的通函，取代此前关于杠杆及反向产品（L&I Products）的旧通函。主要更新包括：将单一股票杠杆及反向产品的标的范围扩大至包括香港上市的高流动性超大型股票（但不包括双重上市或内地上市的股票）；同时引入了针对单一股票L&I产品的额外保障措施，包括产品提供者资质要求、业务连续性计划、防御性措施（如止损机制）及停牌安排。 The SFC revised its circular on listed structured funds, replacing the previous circular on Leveraged and Inverse Products (L&I Products). Key updates include: expanding the underlying scope for single stock L&I products to include Hong Kong-listed high-liquidity mega-cap stocks (but excluding dual-listed or Mainland-listed stocks); and introducing additional safeguard measures for single stock L&I products, including product provider qualification requirements, business continuity plans, defensive measures (such as stop-loss mechanisms), and suspension arrangements. 行业评论 / Commentary 该通函体现了证监会在扩大产品范围的同时，对投资者保护的高度重视。对产品提供者的经验及资源要求、多元化交易对手安排等规定，旨在确保新产品具备足够的运作稳健性。值得注意的是，单一股票L&I产品的最大杠杆倍数仍维持2倍上限（内地股票指数相关反向产品为-1倍），且证监会可能根据标的股票的波幅施加更低杠杆倍数。有意在香港推出相关产品的产品提供者被鼓励尽早与证监会进行咨询沟通。 This circular reflects the SFC's strong emphasis on investor protection alongside product scope expansion. The requirements for product provider experience and resources, as well as diversified counterparty arrangements, are designed to ensure sufficient operational robustness of new products. Notably, the maximum leverage multiple for single stock L&I products remains capped at 2 times (-1 times for Mainland stock index-related inverse products), and the SFC may impose lower leverage multiples depending on the volatility of the underlying stocks. Product providers intending to launch such products in Hong Kong are encouraged to engage in early consultation with the SFC. 建议执行要点（产品提供者） / Suggested Action Items for Product Providers 产品范围评估：评估是否有意在香港推出单一股票杠杆及反向产品，并确认标的股票符合"香港上市高流动性超大型股票"的资格要求（排除双重上市及内地上市股票）。 Product Scope Assessment: Evaluate whether to launch single stock L&I products in Hong Kong and confirm that the underlying stocks meet the eligibility criteria of "Hong Kong-listed high-liquidity mega-cap stocks" (excluding dual-listed or Mainland-listed stocks). 业务连续性计划：制定并实施稳健的业务连续性计划，涵盖触发事件的应对原则、具体应急措施及防御性措施，以及投资者通知和投诉处理安排。 Business Continuity Planning: Develop and implement robust business continuity plans covering response principles for trigger events, specific contingency measures and defensive measures, as well as investor notification and complaint handling arrangements. 容量监控：持续监控产品的容量，确保能够支持目标杠杆或反向敞口，并及时增强容量以维持合理的缓冲。 Capacity Monitoring: Continuously monitor product capacity to ensure it can support target leverage or inverse exposures, and promptly enhance capacity to maintain a reasonable buffer. 防御机制：在产品设计中纳入适当的防御性措施（如止损机制），并在销售文件中作出充分披露。 Defensive Mechanisms: Incorporate appropriate defensive measures (such as stop-loss mechanisms) into product design and provide full disclosure in offering documents. 通函三：2026年5月27日（于6月持续生效）– 虚拟资产基金及稳定币相关要求的更新 Circular 3: 27 May 2026 (active in June) – Updates on VA Funds and Stablecoin Requirements 概要 / Summary 证监会在2026年5月27日更新了关于证监认可虚拟资产基金的基金通函，并于6月持续生效。新通函明确，证监认可基金的稳定币相关要求不适用于金管局持牌发行人发行的指定稳定币（即"相关稳定币"）及代币化存款。相关指引亦同步更新至《单位信托及互惠基金守则》的常见问题（FAQ 20G），以及适用于管理虚拟资产投资组合的持牌法团的发牌条款及条件。 The SFC updated its fund circular on SFC-authorised virtual asset funds on 27 May 2026, which remained effective throughout June. The new circular clarifies that the stablecoin-related requirements for SFC-authorised funds do not apply to designated stablecoins issued by HKMA-licensed issuers (i.e., "Relevant Stablecoins") and tokenised deposits. Related guidance has also been updated in the FAQ (FAQ 20G) under the Code on Unit Trusts and Mutual Funds, as well as in the licensing terms and conditions applicable to licensed corporations managing virtual asset portfolios. 行业评论 / Commentary 该更新与5月27日发布的《虚拟资产交易平台及持牌法团提供相关稳定币服务》通函形成配套，进一步确立了金管局持牌稳定币享有更低的监管摩擦成本。相关稳定币在托管安排中可委托给证监会持牌VATP、认可机构或其子公司，或证监会接受的其他实体，为市场提供了操作灵活性。基金管理者需注意，即使仅投资相关稳定币，仍需向证监会事前通知，且投资占比超过10%时可能被施加额外发牌条件。 This update complements the circular on "Provision of Relevant Stablecoin Services by VATPs and Licensed Corporations" issued on 27 May, further establishing that HKMA-licensed stablecoins enjoy lower regulatory friction costs. Relevant Stablecoins may be custodied with SFC-licensed VATPs, authorised institutions or their subsidiaries, or other entities accepted by the SFC, providing operational flexibility to the market. Fund managers should note that even when investing solely in Relevant Stablecoins, prior notification to the SFC is still required, and additional licensing conditions may be imposed when the investment proportion exceeds 10%. 持牌资产管理人建议执行要点 / Suggested Action Items for Licensed Asset Managers 产品文件更新：确保基金销售文件（包括关键事实陈述）披露可能持有的相关稳定币及代币化存款金额，以及相关特征和风险。 Product Document Updates: Ensure that fund offering documents (including key facts statements) disclose the potential holdings of Relevant Stablecoins and tokenised deposits, as well as their characteristics and risks. 报告机制：在中期报告及年度报告中披露相关稳定币及代币化存款占资产净值的比例。 Reporting Mechanisms: Disclose the proportion of Relevant Stablecoins and tokenised deposits as a percentage of net asset value in interim and annual reports. 事前咨询：新基金或现有基金拟持有相关稳定币及代币化存款的，需事先咨询证监会。 Prior Consultation: New or existing funds intending to hold Relevant Stablecoins and tokenised deposits must consult the SFC in advance. 托管安排：确保相关稳定币及代币化存款的托管安排符合新指引要求（可委托给证监会持牌VATP、认可机构或其子公司，或证监会接受的其他实体）。 Custody Arrangements: Ensure that custody arrangements for Relevant Stablecoins and tokenised deposits comply with the new guidance requirements (may be entrusted to SFC-licensed VATPs, authorised institutions or their subsidiaries, or other entities accepted by the SFC). 总结 / Conclusion 2026年6月的三份通函勾勒出香港证监会监管蓝图的三个清晰维度：防御（AI驱动的网络攻击）、创新（单一股票杠杆及反向产品）与分层（稳定币差异化监管）。持牌机构面临的挑战已不再是单一维度的合规达标，而是如何在这三条战线同步构建韧性——既要应对加速演进的网络威胁，又要把握新型产品带来的商业机遇，同时还要在日益精细化的监管框架中精准定位自身业务模式。随着人工智能、代币化与传统金融的边界持续模糊，能够将监管合规转化为竞争优势的机构，将在香港金融市场的新一轮洗牌中占据先机。 The three circulars of June 2026 outline three clear dimensions of the SFC's regulatory blueprint: Defence (AI-driven cyberattacks), Innovation (single stock L&I products), and Tiering (differentiated stablecoin regulation). The challenge for licensed institutions is no longer one-dimensional compliance, but rather how to build resilience simultaneously across these three fronts – defending against accelerating cyber threats, seizing commercial opportunities from new products, and precisely positioning business models within an increasingly nuanced regulatory framework. As the boundaries between AI, tokenisation, and traditional finance continue to blur, institutions that can transform regulatory compliance into a competitive advantage will gain the upper hand in the next wave of Hong Kong's financial market transformation. 如何获取通函原件 / How to Access the Original Circulars 证监会电子发布门户网站（SFC electronic distribution portal）是获取权威文件的唯一渠道。您可以通过以下网址进行访问： The official SFC electronic distribution portal is the sole authoritative source. You can access it at the following address: apps.sfc.hk/edistributionWeb 在网站中将文件类型筛选为"通函"（Circulars），并将日期范围设定为"2026年6月"，即可查阅并下载原版英文及中文官方文件。 Filter by document type "Circulars" and date range "June 2026" to view and download the original documents.