AI security and governance for Hong Kong financial institutions
Hong Kong's banks run AI under the HKMA's eye and handle data under both the PDPO and, across the border, the PIPL. Kapālins gives them one inventory of every AI they run and proof, control by control, that each behaves as approved.
What changes for Hong Kong enterprises, and when.
In mid-2026 the HKMA and the SFC issued circulars calling for enhanced cyber security against AI-enabled attacks, asking banks to review cyber risk management, incident response, recovery testing and third-party arrangements. The HKMA's generative-AI sandbox keeps expanding, which means supervisors expect the controls to expand with it.
- In force
HKMA and SFC circulars on cyber security against AI-enabled attacks. Banks asked to review cyber risk management, incident response, recovery testing and third-party arrangements. Source (secondary)
Dates: each entry links to its source. A source marked secondary is a law firm, analyst or vendor summary; check the primary text before relying on the date. The full calendar is on the AI regulation tracker.
Mapped on the platform for Hong Kong.
Every framework page says which controls are proved by a live signal from the gateway, probes or device sensor, and which by assessment evidence. Both are exported in the regulator evidence pack.
Hosting and residency.
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon.
Industries and cities.
Questions buyers in Hong Kong ask.
Is Kapālins available in Hong Kong?
Yes. Kapālins is delivered remotely from Melbourne, Australia, and through partners in the Authorised, Premier and Elite tiers. A briefing on your own estate comes first, then onboarding.
Which Hong Kong frameworks does the platform map?
HKMA GenAI, PIPL, ISO/IEC 42001, ISO/IEC 27001, SOC 2, OWASP LLM Top 10. Each framework page lists the controls mapped and whether a control is proved by a live platform signal or by assessment evidence.
Where is our data hosted?
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon.
Does the platform cover PIPL for cross-border groups?
Yes. The PIPL framework page lists each mapped control and how it is evidenced, alongside the HKMA GenAI framework page.