What will Hong Kong expect from banks using AI agents?
Hong Kong's banking supervisor has now launched Project SAGE, formed a cross-sector expert group and published its agent-governance discussion paper. The earlier ART controls remain a direction of travel, not final rules.
The short version
- What happened
- The HKMA says every approved AI use case should have a clear owner and sit in an up-to-date inventory.
- Who it affects
- Customers need a bank to identify who is accountable when an automated action affects an account or service.
- What remains unproven
- The evidence is official policy material. Sandbox performance claims are not independently audited, and the Project SAGE discussion paper begins consultation rather than establishing final requirements or measured outcomes.
Keep in mind
The evidence is official policy material. Sandbox performance claims are not independently audited, and the Project SAGE discussion paper begins consultation rather than establishing final requirements or measured outcomes.
Source analysis · 3 linked sources. Primary analysed source date: 16 October 2026. Earliest linked supporting source: 15 October 2026. Latest linked supporting source: 2 November 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
The policy shift is from checking outputs to supervising actions
Hong Kong's banking supervisor wants institutions to know which AI systems are approved, who owns each use case, what an agent is allowed to do and how it can be stopped. The Hong Kong Monetary Authority set out those expectations on 16 October under its new Accountability, Resilience and Trust—or ART—framework. For bank staff and customers, the practical change is that an autonomous system should not become an invisible chain of models, tools and data access behind a useful-looking answer.
The framework follows two cohorts of the regulator's generative-AI sandbox. HKMA banking-supervision director Carmen Chu said more than 60% of second-cohort use cases involved agents and half of those were multi-agent applications. Those are shares of sandbox projects, not estimates of adoption across Hong Kong's banking sector. The authority also described reductions in onboarding and risk-analysis time, but these are regulator-reported sandbox outcomes without published denominators or an independent comparison group.[1][2]
What accountability and resilience mean in practice
For accountability, the HKMA says a bank should anchor an agent to its intended purpose from design through data, tool access and action. It calls for clear ownership and an inventory of approved applications. The speech also recognises a move from a person approving every step to a person monitoring the system overall. That 'human-on-the-loop' model makes alerts, escalation routes and the ability to intervene more important, because the person may not see each individual action before it happens.
For resilience, banks are asked to map dependencies across models, data, tools, infrastructure and third-party providers. The regulator says corrective and restrictive controls may include a kill switch that suspends an agent. Trust is framed as the boundary around the agent: the surrounding harness should translate the institution's risk appetite into limits and test behaviour under extreme scenarios. A training-data sharing platform with Cyberport and the University of Hong Kong is also planned.[1]
The distinction that matters
How the ART framework divides oversight
The HKMA groups agent controls into three connected duties.
Accountability
Name the owner and permitted intent
Trace responsibility for actions
Resilience
Map dependencies and recovery controls
Contain and restore a failing service
Trust
Set boundaries and test extreme behaviour
Keep agent actions within risk limits
Project SAGE starts the consultation, not the final rulebook
The next step promised in October has now happened. On 2 November, the HKMA launched Project SAGE—Securing Agentic Finance with Governance and Enablement—established a cross-sector Agentic Finance Expert Group and published a discussion paper seeking industry feedback on how banks' use of agentic AI should be supervised and governed. That is a material move from a speech about forthcoming work to an active policy consultation, but it does not make the earlier proposals final requirements.
Our analysis: a useful implementation test is whether an operations team can trace one customer-affecting decision from approved purpose to data, tool call, human owner and recovery action. Evidence that would strengthen the assessment includes final supervisory requirements, the scope of any material-agent register, a response timetable, transparent sandbox methods, incident reporting and examples of intervention tests under realistic load. Project SAGE gives banks a formal route into the policy process; it does not yet settle every threshold they must meet.[1][2][3]