Hong Kong Sets Bank AI Controls. Its Agent Registry Remains a Concept.

Hong Kong's new bank AI framework creates an immediate test: can an institution identify each approved AI use, name the person responsible and stop a consequential system before it causes more harm? The Hong Kong Monetary Authority's supervisory guidance asks banks to make those controls operable. Its separate agentic AI concept note raises an industry-wide registry as a possibility. Treating both documents as rules already in force would erase the most useful distinction.

The immediate challenge is evidence inside each bank. An inventory can show what the institution approved. An owner can explain who sets a system's authority. A suspension mechanism can show whether that authority can be withdrawn quickly. A future industry registry might make dependencies visible across institutions, but the HKMA has not specified one as a supervisory requirement.

The older baseline already covered the fundamentals

The 2026 guidance expressly supersedes the HKMA's 2019 high-level AI principles. That is a replacement of supervisory guidance, not the arrival of an AI statute. It calls for policies and controls to be updated in a timely manner but gives no dated compliance deadline. The older document already made boards and senior management accountable for AI-driven decisions. It called for clear responsibilities across the lines of defence, vendor oversight, model validation, ongoing monitoring and contingency measures able to suspend an application promptly and fall back to human or conventional processes.

Even the idea of an AI inventory predates this week's circular at some banks. In a 2023 account of its global responsible AI programme, Standard Chartered said it had an inventory of proposed AI applications, with third-party engagements, and a governance process to challenge them. That bank statement does not establish whether every Hong Kong operation, embedded tool or live use case satisfies the new guidance. It does block the easy claim that the HKMA has just introduced inventorying to an industry that had none.

The change in the published supervisory text is specificity. The new guidance asks an authorized institution to assign an owner to each deployed AI use case. That owner defines the system's authority, oversees controls and monitoring, and escalates problems. The board and senior management retain overall accountability. Reviewers who may intervene need the competence, information, time and authority to challenge, override or stop the system. The HKMA asks institutions to obtain assurance that such oversight works, for example through testing, rather than assuming a human approval box is effective because it exists on a chart.

The guidance also asks banks to keep an up-to-date inventory of AI uses approved for deployment and restrict uses outside it. The guidance's inventory section covers internally built, third-party and embedded solutions. It calls for a definition of AI use and standard fields covering purpose, owner, provider and model, risk classification, lifecycle and approval status, dependencies and key controls. It also asks for controls against unapproved tools and approved tools used for unapproved purposes.

That last distinction is operationally important. A vendor feature embedded in a customer platform can be in an approved product while its AI function, data access or new use has not been separately approved. A useful internal check would trace that feature from the business purpose through the provider, model, data permissions and named owner to an approval record. If the record ends at a procurement contract, the inventory may miss the AI use the HKMA wants a bank to see. That is an analytical test, not evidence that a particular bank has failed it.

Suspension has a risk boundary

The 2019 principles already contemplated prompt suspension. The 2026 response and recovery section goes further for more material or higher-risk uses: it says a built-in mechanism, or equivalent, should enable prompt suspension, revocation of access and prevention of further actions by the affected model. Banks should also prepare credible fallback and recovery arrangements for severe but plausible failures, including a provider failure. The text does not impose the same built-in control on every low-risk application.

The risk classification comes first. The guidance says a bank should assess a use case's purpose, possible customer and operational harm if it fails, and its technical maturity. Material or higher-risk cases face more stringent review, senior management sign-off and independent validation. End-to-end testing should happen before deployment and material changes, with stressed conditions and, where appropriate, adversarial tests. These are supervisory expectations about what banks should do. The circular provides no public evidence that a particular bank has tested an intervention successfully in production.

For an action-taking system, the practical question is where the stop takes effect. Can a responsible employee revoke the agent's tool and data access before the next action, including when a provider is involved? Does the fallback process have enough people and capacity to handle the interrupted work? A policy document cannot answer either question. A timed exercise and an auditable recovery record could. The guidance supplies a basis for asking; it does not publish those results.

A shared registry is a different proposition

The agentic AI concept note discusses agents that plan and act across tools, data and connected systems. It suggests that an inventory of material agents could support monitoring and that component lineage might expose shared dependencies. It then says the HKMA is exploring the possibility of an industry-level registry for material agents deployed by banks. The note says its preliminary considerations are for discussion and do not constitute specific supervisory requirements at this stage. A later discussion paper is meant to set out options and seek views.

The bank inventory and the possible shared registry answer different questions. The first lets a supervisor ask one bank what it has approved, who owns it and how it can intervene. The second might reveal common suppliers or control dependencies across banks. A credible registry proposal would still need to define which agents qualify, what information banks submit, how changes are verified and who can see sensitive architecture details. None of that has been settled in the concept note.

The HKMA's framework announcement says sandbox use cases explored agentic AI. Exploration in a supervised trial is not evidence of live rollout, nor proof that a shared registry would improve incident response. For now, the stronger accountability test is local and observable: find the use case, find its owner, test the intervention and show the record. The sector-wide map remains a proposal.