SFC Circular on Tokenisation: Smart Contract Integrity

Updated October 2026 6 min read

Quick answer. Under the SFC's tokenisation circular, the provider must confirm, and on request show, that its smart contracts are free of vulnerabilities and security flaws with a high level of confidence. If asked, it should obtain a third-party audit.

Watch: SFC Circular on Tokenisation: Smart Contract Integrity 1:40

Video transcript

Hong Kong's SFC expects tokenised fund providers to show their smart contracts are free of flaws with a high level of confidence, and to get a third-party audit if asked.

The SFC says 13 tokenised products were offered to Hong Kong's public as of March 2026.

The April 2026 revision added secondary trading. The smart contract duties date from 2023. What changed is the attack surface, with tokens trading around the clock.

The provider stays responsible despite outsourcing. It must show smart contract integrity, get a third-party audit on request, use controls like a permissioned token on public chains, and manage hacking risk with tools like burn and re-issuance.

The SFC sets no method. In our reading, high confidence means full scope, deployed code matched to the audit, privileged roles mapped, and findings closed.

Burn and re-issuance replaces stolen tokens. But an attacker who reaches those roles can do the same, so they need multiple approvals and protected keys.

Secondary trading on licensed platforms adds price deviation alerts, an indicative NAV feed, and a primary to secondary transfer path that must reconcile both ways.

On request, a third-party audit covers operational soundness, ownership records and smart contract integrity. Commission it before the SFC asks.

Guardian audits tokenised fund contracts, transfer restrictions and burn and re-issue logic. Read the full article, or talk to Guardian at guardian.security.

The SFC circular on tokenisation is the rulebook for putting an SFC-authorised fund on a blockchain for Hong Kong's public.

On April 20, 2026 the SFC revised it (26EC22) and issued a companion circular on secondary trading (26EC23).

On October 26, 2026, two SFC-authorised tokenised money market funds began secondary trading on an SFC-licensed virtual asset trading platform (VATP), around the clock.

The SFC says 13 tokenised products were offered to Hong Kong's public as of March 2026.

The revision is narrower than it looks. The smart contract duties, the public chain restriction and the audit power date from the November 2, 2023 version.

What changed is the attack surface. Tokens can now move between the fund's register and VATP wallets, and trade at any hour.

Both circulars also refer to the 2023 Tokenised Securities Circular (23EC52), which sets out technical risk factors.

This article explains the technical and security side of the SFC's tokenisation and secondary trading circulars. It is not legal advice; confirm how it applies to you with counsel.

The Provider Stays Responsible

Paragraph 10 makes the provider ultimately responsible for the management and operational soundness of the arrangement, and for ownership records.

That holds regardless of any outsourcing.

The provider should confirm that at least one competent staff member can operate or supervise the arrangement and manage its risks (paragraph 19).

For a manager on a tokenization platform, the platform's contracts, admin keys and upgrade process are its regulatory problem. It needs enough access to answer the SFC.

What High Confidence Means

Paragraph 14 requires the provider to confirm and, on request, demonstrate three things to the SFC's satisfaction.

They are the soundness of the arrangement, its ownership record keeping and “the integrity of the smart contracts”.

Footnote 5 sets the minimum, starting with compliance with paragraphs 10 to 13.

Smart contracts must also be shown to be “not subject to any contract vulnerabilities or security flaws with a high level of confidence”.

The SFC does not define the method. In our reading, a high level of confidence is hard to support with less than this:

Full scope. Every contract that records ownership or can move, mint, burn, freeze or upgrade tokens.
Deployed code. Onchain bytecode matched to the audited commit, and live roles to the reviewed configuration.
Privileged roles mapped. Who holds each admin, minter, burner and upgrader role, behind what threshold.
Findings closed. A fix review at a pinned commit, not a list of open issues.

Public Chains Need Extra Controls

Paragraph 13 says providers should not use public permissionless networks “without additional and proper controls”. Its example is a permissioned token.

The Tokenised Securities Circular names transfer restrictions, a mint-and-burn mechanism, transaction reversals or redemption procedures as controls of particular importance there.

A permissioned token is only as strong as the code that enforces it. Check that:

Every transfer path enforces the allowlist, including transferFrom, batch transfers and permit functions.
Only authorized roles can add to the allowlist, and every addition reconciles to KYC records.
Approvals and allowances cannot route tokens to an unlisted address.
Wrapped, bridged or cross-chain copies enforce the same restrictions, or cannot be created.
VATP custody and market maker addresses are allowlisted deliberately, with a way to remove them.

Hacking Risk: Burn and Re-Issue

Paragraph 12 requires measures for cybersecurity, data privacy, system outages and recovery, and a comprehensive business continuity plan.

Footnote 3 gives one design. The arrangement “can incorporate a burning and re-issuance mechanism, with an aim to mitigating hacking risk and theft”.

It works because the register, not the wallet, is the source of truth. If a key is stolen, the provider burns those tokens and issues replacements to a new address.

That power is among the most dangerous in the contract. An attacker who reaches the burner and minter roles can do what the provider can. Test it:

Burn and re-issue need multiple approvals and, where possible, a delay. Every use reconciles to the register.
The key holders for those roles are inventoried, and their devices protected like custody keys.
The circular does not mention pauses. If one exists, test who can trigger it and what it stops.
A migration to another chain has been rehearsed, so the continuity plan is a procedure.

Secondary Trading on VATPs

Secondary trading is new. 26EC23 allows it for retail investors through on-screen auto-matching on SFC-licensed VATPs, principally for open-ended funds.

Its duties fall mostly on VATPs and providers, not on the contracts. Several have technical edges:

Price Deviation Alert. VATPs should alert investors when the price would deviate significantly from indicative NAV (paragraph 12).
Indicative NAV. VATPs should publish it in real or near real time, typically updated at least every 15 seconds (paragraph 20).
Primary to secondary transfer. Providers should arrange for primary market tokens to trade on the VATP, and for VATP-bought tokens to be redeemed (paragraph 15(d)).

Each is a system that can fail: an iNAV feed that goes stale, or an alert that fails open.

The transfer path between the fund's register and VATP custody must reconcile both ways. Test it with the token contracts.

What a Third-Party Audit Covers

Paragraph 15 says the provider should, on the SFC's request, obtain third-party audit or verification of three things:

What paragraph 15 names	What the review should test
Management and operational soundness of the arrangement	Admin and upgrade roles, key custody, deployment, monitoring, incident and migration plans
Record keeping of ownership	Onchain balances reconciled to the register, including burns, re-issues and VATP transfers
Integrity of the smart contracts	Line-by-line review, supply invariants, restriction bypasses, mint and burn rights, upgrades, deployed bytecode

Commission it before the SFC asks. A finished review with closed findings is also your evidence under paragraph 14.

Prior consultation is required for a new tokenised product, for tokenising an existing one, and for material changes. Go in able to show:

The arrangement end to end, including whether settlement is final offchain or onchain.
Every contract address, its audited commit, and the audit and fix review reports.
A map of privileged roles, and the burn and re-issuance procedure.
For secondary trading: the alert threshold, the iNAV source and the transfer flow.

How Guardian Helps

Guardian's smart contract audit runs in three passes: a design review, an invariant suite, and a manual audit by senior researchers.

For tokenised funds, that covers transfer restrictions, mint and burn authorization, burn and re-issue logic and upgrade paths. It closes with a fix review at a pinned commit.

Guardian also maps every privileged role from the deployed contracts, and matches deployed bytecode to the audited commit.

Offchain, Guardian pentests the apps, APIs and infrastructure on the subscription and redemption path. See all audits and pentests.

Frequently Asked Questions

Does the SFC require a smart contract audit for tokenised funds?

The provider must confirm, and on request demonstrate, the integrity of its smart contracts. If the SFC asks, it should obtain a third-party audit or verification. An audit with closed findings, already in hand, is the most direct evidence.

What does a high level of confidence mean in the SFC circular?

Footnote 5 says the provider must show, at a minimum, that its smart contracts are not subject to any contract vulnerabilities or security flaws with a high level of confidence. The SFC sets no method.

Can a tokenised SFC-authorised fund use a public blockchain such as Ethereum?

The circular does not rule it out. Providers should not use public permissionless networks without additional and proper controls, such as a permissioned token.

What changed in the April 2026 revision of the tokenisation circular?

It amended paragraphs 6, 7 and 21 to allow secondary trading on SFC-licensed VATPs and extend prior consultation to material changes. The smart contract, public chain and audit duties are unchanged from November 2023.

Sources

Audit your tokenised fund before the SFC asks

Guardian reviews the token contracts, transfer restrictions, burn and re-issue logic and privileged roles that paragraph 14 asks you to stand behind.

Get a quote Explore audits and pentests