# RWA Daily Update - 2026-10-08 ## Lesson title A smart-contract audit is not a complete product review Access date: October 8, 2026 (PDT), checked with the local system clock. Publication: https://managingexpectations.net/rwa.html Status: educational review of an existing circular, not breaking news or an audit of any investment product. ## Authoritative source checked Hong Kong Securities and Futures Commission (SFC), "Circular on tokenisation of SFC-authorised investment products", revised 20 April 2026, reference 26EC22. - Canonical URL: https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/doc?refNo=26EC22 - Official HTML content endpoint actually retrieved in full with Python urllib (HTTP 200, text/html;charset=UTF-8): https://apps.sfc.hk/edistributionWeb/api/circular/list-content/circular/doc?lang=EN&refNo=26EC22 - Source class: primary regulator circular. Scope: investment products authorised under Part IV of the Securities and Futures Ordinance for offering to the public in Hong Kong. It is not a worldwide standard or endorsement of a named product. - Source date verified in retrieved heading and footer: 20 Apr 2026 / Revised on 20 April 2026. ## Extracted facts and claim mapping 1. Section B, "Tokenisation arrangement": product providers "should, upon SFC's request, obtain third party audit or verification" on management and operational soundness, record keeping of ownership and integrity of smart contracts. The conditional wording matters: this is not evidence that every product has undergone or passed such a review. 2. Same section: providers "should remain and be ultimately responsible" for management and operational soundness and ownership recordkeeping "regardless of any outsourcing arrangement". Footnote 1 reiterates the responsibility despite outsourcing. 3. Same section: providers should manage and mitigate cybersecurity, privacy, system outages and recovery risks and maintain "a comprehensive and robust business continuity plan". 4. "Disclosure", item (c): offering documents should describe associated risks including "the possibility of undiscovered technical flaws", cybersecurity and system outages, evolving regulation and legal-application challenges. 5. Disclosure items (a)-(b) separately require clarity about on-chain/off-chain settlement finality and what ownership the tokens represent. These support treating software integrity and legal rights as separate diligence questions. Short quotes preserve source wording; displayed typography/spacing was normalized. Section headings rather than unverified PDF page numbers are used because the full source was retrieved as official HTML. ## Educational interpretation, not additional regulatory requirements - A code audit, operational-controls review and ownership-record review have different scopes. A badge alone does not explain which was performed. - Asking about code version, covered systems, exclusions and remediation is a practical diligence checklist proposed by this journal, not a quotation of specific additional SFC requirements. - A software review alone does not prove the underlying assets exist, establish enforceable redemption rights, guarantee liquidity or make a product safe. - No assertion is made that a particular provider has complied, failed a review or obtained regulatory approval. ## No-hype summary and novelty The new lesson is about the scope of assurance: read what an audit actually covers before treating it as a product-wide guarantee. Previous lesson titles were reviewed. The August 11 note briefly mentioned outsourcing accountability, but did not focus on audit scope; the September 19 lesson concerned maker-checker review and activity logs. Today's primary source is a separate April 2026 SFC investment-product circular, newly linked in the source trail. This is not a rerun of the October 7 property-buyback/liquidity lesson. ## Practical watch question Does "audited" cover only the code, or also ownership records and operational controls - and what remains outside the review? ## Retrieval limitations and recovery - Initial discovery used the related 2 November 2023 intermediaries circular, reference 23EC52: https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/doc?refNo=23EC52 . Web extraction returned only fragments/footer material; direct retrieval of the gateway returned a JavaScript app shell. - Extraction of its openFile and openAppendix links failed. A Python attempt to parse openFile as PDF failed because the response was HTML, not a PDF. No official PDF was successfully downloaded or relied on. - Web search exposed the official HTML content endpoint and the revised investment-products circular 26EC22. Web extraction of that endpoint returned a service error, but Python urllib retrieved the complete official HTML successfully, including substantive sections and footnotes. Selected passages were independently re-fetched to confirm the scope wording. - Search snippets were discovery aids only. Published claims rely on the full official 26EC22 HTML, not the incomplete 23EC52 extraction or snippets. Educational source review only; not investment, legal, cybersecurity-audit or regulatory-compliance advice.