Look, this was a housekeeping week for the SFC's Enforcement Division, not a policy week. Mok Cheuk Ling drew a 42-month industry ban on September 11 (the SFC's release doesn't itemize the underlying conduct beyond the ban term, which is its own small data point about how thin these notices run). A day earlier, the Division suspended dealings in Cloudbreak Pharma Inc shares over suspected IPO rigging, an SFO Part XIV market-misconduct action rather than a Corporate Finance Division listing review. Neither action touches a licensed corporation's cybersecurity or AI controls. The HKMA's three notices this week were a Silver Bond allocation result, a fraudulent-website alert from HKICL, and a green fintech symposium announcement, public information, not supervisory guidance, so nothing in TM-E-1 or TM-G-1 moves either.

So the read for a Hong Kong compliance head this week is mostly what didn't happen: no GL20 update from the Insurance Authority, no new SFC circular on AI-enabled attacks beyond the existing 26EC32 framework, and the HKMA-HKEX-DFSA-Nasdaq Dubai Strategic Working Group announced September 10 is a market-access initiative for Banking Policy Department-adjacent planning, not a conduct or prudential obligation with a compliance deadline attached. The one live clock that does apply broadly, and that this week's silence doesn't excuse anyone from, is SPM OR-2: an authorized institution had to have its operational resilience framework in place by 31 May 2023 and needs to demonstrate actual resilience, not just a framework binder, by 31 May 2026.

Mark the calendar for 31 May 2026, not for anything in this week's press releases. That's when the Banking Supervision Department's operational and technology risk division stops accepting "we have a framework" as the answer and starts asking for evidence the tolerances hold under a real scenario.