Hong Kong recently saw the passage of the Protection of Critical Infrastructure (Computer System) Ordinance into law, the provisions of which will come into effect on 1 January 2026. The new laws aim to protect local infrastructure in certain sectors designated as critical. Banks and financial institutions (in addition to those operating in other prescribed sectors) will be required to implement measures to prevent and report security breaches. Failure to do so may attract a fine of up to HK$5 million (US$640,000). We expect increased regulatory activity in encouraging organisations to bolster the security and reporting any breaches of their computer systems in 2026.