HKMA sets AI rules for Hong Kong banks and floats a registry of AI agents

What the HKMA announced

Hong Kong's banking regulator has rewritten its rules for how banks use artificial intelligence. On 15 October 2026 the Hong Kong Monetary Authority announced what it calls the “ART” Framework, short for Accountability, Resilience and Trust, to govern AI across the city's banking sector. The package has three parts: new supervisory guidance that banks are expected to follow, an AI training-data sharing platform built with Hong Kong Cyberport and the University of Hong Kong, and more testing of AI agents together with a planned discussion paper on how to supervise them.

The guidance itself was sent to every authorized institution, the legal term for licensed banks, in a circular signed by Carmen Chu, the HKMA's executive director for banking supervision. It replaces the HKMA's “High-level Principles on Artificial Intelligence” from November 2019, which were written before generative AI and agents became everyday tools in banks. The HKMA says the update draws on its own sandbox trials and on a Financial Stability Board report on sound practices for responsible AI adoption, issued the same day.

The launch coincided with a two-day Finance+A.I. Forum that the HKMA co-hosted with Cyberport on 15 and 16 October, where the second cohort of its generative AI sandbox formally ended. The regulator said more than 60% of the use cases in that cohort explored agentic AI, meaning systems that plan and carry out multi-step tasks within set limits. “The progression from generative to agentic A.I. represents an important new stage of innovation for the banking sector,” said Arthur Yuen, the HKMA's deputy chief executive.

What banks now have to do

The binding part of the package is Annex A, the Supervisory Guidance for Responsible Adoption of Artificial Intelligence. Under accountability, it asks each bank's board to approve an AI strategy that sets out its approach and risk appetite, with clear roles across the three lines of defence for approving a use case before launch and monitoring it afterwards. Senior management has to keep reviewing whether that strategy still fits the risks.

Every deployed AI use case needs a named owner who defines what the system is allowed to do, watches its controls and escalates problems. Human oversight can take the form of “human-in-the-loop”, “human-on-the-loop” or “human-in-command” arrangements, with risk-based triggers for when a person must approve or step in. The people doing that review must have the competence, information, time and authority to challenge, override or stop the system. That is a notable shift: a 2024 HKMA circular had told banks to keep a human in the loop for early customer-facing generative AI, and the new guidance says looser arrangements may now suit some uses.

Banks must also keep an up-to-date inventory of approved AI use cases, covering tools they build, buy or get embedded in other software. Each entry should record the purpose, owner, provider and model, risk class, approval status, dependencies and key controls. Staff must not use unapproved tools or use approved tools for unapproved purposes, and banks are told to put controls on “shadow A.I.”.

Kill switches, testing and audit trails

Under resilience, banks have to rate the materiality and risk of each use case and match the level of review to it, with senior management sign-off for material or higher-risk systems. Testing before launch should cover reliability, security, fairness and output variability under normal and stressed conditions. Material or higher-risk systems need independent validation and, where appropriate, adversarial testing, and any risk left over has to be formally accepted by whoever approves the launch.

For AI that takes actions, monitoring has to cover the intermediate steps, not only the final result. Where one AI is used to test or watch another, which the HKMA calls “A.I. versus A.I.”, banks must allow for the weaknesses of both. If something goes wrong, a bank must be able to recover operations, including when a third-party provider fails, and to contain, suspend or retire the system. For the more material systems, “a kill switch or equivalent should be built-in” to suspend the model, revoke its access and stop further actions. Banks must keep records that allow auditing and tracing of higher-risk outputs, which the guidance says can include model versions, configurations, inputs and prompts.

The risk sections are specific about vendors and security. Banks remain responsible for all AI-generated outcomes even when an outside provider runs the model, and they need contract terms that stop providers reusing customers' personal data or confidential information for training unless the bank allows it. They must also weigh concentration risk where a use case depends on “a small group of dominant players”. On cyber risk, the guidance names data poisoning and prompt injection and says banks “should not rely solely on model instructions or filters” for protection.

Trust: hallucinations, explanations and customers

The trust principles start from a simple rule: banks remain accountable for AI outputs, including actions. Where an output could materially affect a customer, it should be anchored in reliable sources or checked by a person, and banks must define when an output is withheld, sent for review or blocked from triggering an action. The guidance names hallucinations, “plausible but fabricated outputs”, as a risk to guard against.

Banks also have to document how explainable each system is and, where a simpler and more explainable approach can meet the goal, prefer it. AI-driven decisions must not discriminate against any group of customers. People affected by an AI decision should be able to ask for clarification, review or reassessment, and customers must be told before they use a service that relies on AI, along with the relevant risks.

A registry of AI agents is on the table

The most forward-looking part is Annex C, a concept note on governing agentic AI. It is explicitly not a set of requirements yet. It floats four ideas. The first is “intent-anchored accountability”: every agent's actions should trace back to a stated business intent, and the business function that owns that intent, rather than the technology team, would generally answer for the agent's outcomes.

The second is visibility. Banks would keep an inventory of material agents, especially ones that are highly autonomous or can reach sensitive data, along with a map of the models, tools and services each depends on so the cause of an incident can be traced. The HKMA says it is also exploring an industry-level registry of material AI agents deployed by banks, which could show how accountability is arranged, reveal shared dependencies across the sector and help banks share intelligence quickly.

The third is oversight that moves from “human in the loop” to “human on the loop”, with the ability to cut an agent's access to particular tools or trigger an emergency stop before actions with material customer impact. The fourth is clear operating boundaries on which tools, systems and data an agent may use, which the note says a “risk-integrated agent harness” could help enforce. The HKMA says it will soon publish a discussion paper with options for possible supervisory requirements and seek views from banks.

Where the agent tests happen

The agent ideas lean on a joint testing scheme. In August the HKMA, the Securities and Futures Commission, the Insurance Authority and the Mandatory Provident Fund Schemes Authority named the first cohort of GenA.I. Sandbox++: 36 use cases from 30 financial institutions and 27 technology partners, picked from nearly 100 proposals. The cohort focuses on agentic AI in customer onboarding, payments, insurance claims and customer service, and on AI that oversees other AI. Participants run on a platform managed by Cyberport's Artificial Intelligence Supercomputing Centre.

The training-data platform with Cyberport and the University of Hong Kong is the least detailed part of the package. The HKMA says only that data quality assurance is a core design principle; it has not said what data will be shared, who can contribute or use it, or how customer privacy will be protected.

How it fits the wider fight over agents in banking

Hong Kong's approach is a contrast to what some US banks are doing. JPMorgan, Citigroup and Bank of America have restricted outside AI agents from logging in with customers' credentials, largely because nobody has settled who is liable when an agent moves money. The HKMA is instead trying to define, in advance, who inside a bank answers for an agent and how it can be stopped. Its intent-anchored idea echoes industry efforts such as American Express's framework for checking a purchase against what a customer told an agent to buy, and its harness language recalls Singapore's new cybersecurity strategy, which bets on “AI harness engineering”, the software and workflows wrapped around models, rather than building its own.

For banks operating in Hong Kong, the immediate work is practical: board-approved AI strategies, owners and inventories for every use case, testing and kill switches scaled to risk, and contract changes with AI vendors. For AI providers selling to those banks, the guidance means more due diligence, audit rights and questions about training on client data.

What is still unclear

The guidance sets no deadline. Banks are told to update their policies, procedures and controls “in a timely manner” and to apply the principles proportionately, which leaves the pace to supervisory follow-up. It also leaves each bank to decide what counts as “material”, the threshold that triggers the strictest controls.

The agent registry may never be built; the HKMA describes it only as a possibility it is exploring, and the discussion paper has no published date. The HKMA said the second sandbox cohort delivered positive results but gave no figures beyond the 60% agentic share. A companion report on practical insights from that cohort, Annex B, was published alongside the circular, but AI Lookout could not open the full file and this article does not draw on it.