The information in this article is current as of 2026-10-16. The rules involved (tariffs, CRS, foreign exchange, customs, tax, etc.) may all be adjusted; when citing or making decisions, please rely on the latest official sources and qualified professional judgment.

On 15 October 2026, the Hong Kong Monetary Authority issued a circular entitled "Responsible Adoption of Artificial Intelligence" to all authorized institutions, publishing the ART framework built on three pillars: accountability, resilience and trust. The accompanying supervisory guidance supersedes the 2019 high-level principles on artificial intelligence and requires banks to promptly upgrade their policies, procedures and controls. A concept paper on agentic artificial intelligence governance published the same day advances the discussion to a more specific scenario: AI no longer merely generates answers, but can access data, invoke tools, connect to internal and external systems, and plan and execute multi-step tasks in accordance with objectives.

This change differs from ordinary "banks using chatbots." Where a model that automatically organizes client materials produces an error, that error can usually still be corrected before submission; where an agent can adjust a client's risk rating based on materials, initiate requests for supplementary documents, restrict transactions or even invoke payment processes, errors flow directly into funds and into relationships of rights and obligations. The regulatory question is therefore not merely whether the model is accurate, but who authorizes it to act, where the boundaries of its actions lie, who can stop it when an anomaly occurs, and whether every step of its judgment can be reconstructed afterwards.

From generating content to taking action: the object of risk has changed

The HKMA's description of agentic AI encompasses several key capabilities: understanding business objectives, autonomously planning steps, using tools, accessing data, interacting with systems, and possibly having multiple agents collaborate to complete interrelated tasks. Applied to banking operations, these capabilities may be used for transaction monitoring, anti-fraud, customer service, credit analysis, compliance screening and operational processing.

Traditional automation generally hard-codes rules, inputs and actions. Agentic AI, by contrast, may choose its path according to the environment. For example, after a system finds that a cross-border payment does not match a client's historical pattern, it may retrieve the corporate file, verify beneficial owners, check sanctions and adverse information, request supplementary contracts or logistics documents, and then decide whether to escalate to manual review. The efficiency comes from the system's ability to work across steps, and the risk likewise comes from the interconnection of those steps: an error in front-end identification may be amplified along the workflow, ultimately manifesting as delayed payment, denial of service, erroneous freezing or improper disclosure of data.

Enterprises therefore cannot treat "the system decided" or "the model judged" in a bank's response as the end point of responsibility. AI is a tool by which banks perform their contractual, customer due diligence, anti-money laundering, anti-fraud and consumer protection obligations. The HKMA expressly requires authorized institutions to remain responsible for AI-generated outputs and actions; the board and senior management bear overall responsibility for AI adoption, and external service providers cannot assume or eliminate the bank's own regulatory responsibility.

Business intent determines where responsibility lies; it should not be left to the technology department alone

The concept paper proposes "intent-anchored accountability." The actions of agentic AI derive from its interpretation of instructions or business objectives; governance arrangements should connect specific actions to the original business intent and determine autonomous authority and the responsible party accordingly.

This design matters for the allocation of responsibility within banks. The technology department provides models, interfaces and infrastructure, but does not necessarily decide why enhanced review should apply to a certain category of clients, when payments should be suspended, or how fraud alerts should be handled. The department that proposes and owns the business objective should generally be responsible for the agent's results. The accompanying supervisory guidance also requires that a responsible person be designated for each deployed AI use case, that system permissions be clearly defined, that the effectiveness of controls be supervised, and that the person be responsible for issue escalation and remediation.

For Chinese enterprises, similar arrangements also apply to the treasury and compliance tools they use themselves. If a group treasury function has AI automatically select payment accounts based on cash positions, the legal and compliance departments cannot merely review the vendor's model documentation. Enterprises need to translate "permitted to optimize liquidity" into executable authority: which accounts may be read, to which whitelisted payees payments may be made, what the per-transaction and cumulative limits are, whether currency or channel may be changed, and at which step the agent must stop upon a sanctions hit, account anomaly or missing contractual materials.

If business intent is expressed only as "reduce payment costs" or "increase pass rates," the agent may technically achieve the objective while departing from the legal and risk boundaries the enterprise can genuinely accept. Authorization documents, system configurations and personnel responsibilities must correspond to one another; it is not acceptable to require dual review in a contract while granting the agent sole authority to disburse funds in the system.

Human oversight is not formal approval; it is the capacity to stop the process

The HKMA allows banks to choose, based on risk, among arrangements such as "human-in-the-loop," "human-on-the-loop," or "human retains command authority." This is not simply a reduction of human involvement; rather, it requires that the oversight method match the materiality of the specific use case, the consequences of failure, and the technological maturity.

Low-risk tools may be overseen by personnel through sampling; use cases involving material customer rights and interests, account restrictions, credit granting, investment advice, or fund movements require clear human approval and defined triggers for intervention. The regulatory guidance requires that reviewers have sufficient competence, information, time, and authority to challenge, override, or stop the AI. If staff can only click to confirm and cannot see the basis, modify the result, or prevent subsequent actions, such an arrangement is unlikely to constitute effective oversight.

Agentic AI executes quickly, and the interval between consecutive actions may be very short. The concept paper therefore proposes embedding intervention points before material customer impact arises, and retaining the ability to suspend tool or system access, revoke permissions, and initiate emergency stops. The accompanying guidance further requires that more material or higher-risk use cases be equipped with a "kill switch" or equivalent mechanism to prevent an anomalous model from continuing to take actions.

Bank customers should also understand their own channels for human redress. When enterprises are affected by automated decisions in account opening, payment, or account management, they should promptly inquire about the type of decision, the channels for supplementation and correction, the path for human review, and the processing time limits. The focus of a dispute need not remain on demanding that the bank disclose its algorithms; it can instead turn to more actionable questions: on what facts did the bank base its measures, whether the materials submitted by the customer entered review, whether anyone has the authority to correct the result, and whether the restrictive measures are proportionate to the risk.

The evidence chain must be able to reconstruct "why the action was taken" and "how it was taken"

The HKMA requires banks to maintain an inventory of AI use cases, recording purpose, responsible persons, vendors and models, risk classification, lifecycle, approval status, dependencies, and key controls. For material or higher-risk outputs, banks should also, to the extent possible, retain records capable of auditing and tracing results, including the sources used, models and versions, configurations, and inputs; generative AI scenarios may also include prompts and the evidence supporting the reasoning behind material outputs.

This provides a new evidence map for cross-border fund disputes. In the past, enterprises often retained payment instructions, bank receipts, and emails; once agents are involved, attention must also be paid to four groups of records: the original objectives and authorizations given by business personnel, the data and tools actually invoked by the system, the intermediate judgments and risk labels made by the model, and human intervention, exception approvals, and final execution results. Without intermediate records, it is difficult to determine whether an error originated from enterprise materials, third-party databases, model inference, interface mapping, or human handling.

Enterprises themselves should at a minimum retain versioned materials submitted to the bank, upload times, bank requests for supplementary materials, records of human communications, changes in transaction status, and screenshots of anomaly alerts. If an automated treasury system is connected via API or corporate online banking, enterprises should also retain instruction numbers, the identity of the operator or agent, scope of authority, approval logs, receipts, and revocation records. Transaction hashes, payment receipts, or ticket numbers each prove only part of the facts and cannot replace the complete chain of authorization and handling.

Banks remain responsible for governance of external models, data, and interfaces

Agentic AI typically relies on cloud services, foundation models, sanctions databases, identity verification tools, and system integrators. The HKMA requires banks to conduct due diligence and risk assessments before selecting external service providers, to implement audit rights, data protection, notification of material changes and incidents, response and recovery through contracts, and to assess concentration, continuity, substitutability, and exit risks.

Data arrangements also cannot be determined by vendors' default terms. The guidance requires banks to prevent service providers from using customer personal information or bank confidential information for model training or improvement unless the bank has expressly authorized this and applicable requirements are met. For Chinese enterprises, when providing contracts, invoices, logistics, and beneficial owner information to banks or their technical service providers, they must also concurrently review mainland cross-border data transfer, trade secrets, and the basis for authorization, so as to avoid uploading materials without boundaries merely to pass automated review.

Rule differences also arise in cross-border scenarios. Where the same group uses a unified agent in the Mainland, Hong Kong and Southeast Asia, it may simultaneously face different requirements on data, outsourcing, anti-money laundering and consumer protection. The more prudent approach is not to let the model automatically select the "most permissive rules", but rather to delineate data and action authority by jurisdiction, entity and business type, and to refer conflicts that cannot be resolved to authorized personnel for handling.

Chinese enterprises can begin with four tasks

First, inventory all AI use cases capable of affecting accounts, credit, payments, screening and customer rights and interests, registering not only self-developed models but also AI functions embedded in software. The use-case inventory should state the business owner, models and vendors, accessible data and systems, actions that may be taken, and human intervention points.

Second, extend authority controls from personnel accounts to agent identities. Each agent should have independent, minimal and revocable authority; payments, changes to payee information, release of high-risk transactions or outward transfer of sensitive data should not rely on natural-language prompts as the sole boundary.

Third, complete the contracts. Agree with AI service providers, system integrators and data providers on data-use restrictions, notice of model or rule changes, log availability, audit assistance, incident response, service continuity and exit migration. Interface agreements between enterprises and banks should also specify when instructions are deemed valid, how anomalies are notified, who has authority to withdraw them and how erroneous transactions are handled.

Fourth, design exception handling that can be rehearsed. At a minimum, test prompt injection, erroneous data, model drift, third-party interruption, authority overreach and repeated erroneous operations, confirm that systems can pause, isolate and recover, that personnel know to whom to escalate, and that records needed for dispute handling can be preserved.

Conclusion

The general supervisory guidance in the ART framework already applies to all authorized institutions in Hong Kong, and banks should promptly enhance their controls; the agentic AI concept paper currently sets out only preliminary considerations, and arrangements such as an industry register have not yet become specific supervisory requirements, with the HKMA to issue a separate discussion paper. The legal status of the two must be distinguished.

The direction, however, is clear: when AI begins to take action on behalf of institutions, supervision will follow the governance methods familiar to the banking sector, restoring authority, accountability, the three lines of defense, operational resilience, vendor management and audit records to business processes. For Chinese enterprises, in the face of more automated