Regulatory news and analysis across global markets

HKMA asks banks whether AI agents need a central registry and a Know Your Agent standard

The HKMA launched Project SAGE and a discussion paper on bank use of AI agents, asking who is liable and whether trusted agents should be listed centrally.

At a glance

Published

Regulators

Reading time

5 minutes

Sources for this story are listed at the end, with links to the original documents.

The Hong Kong Island skyline at night seen across Victoria Harbour, with the lit tower of Two International Finance Centre in the centre and the Bank of China Tower on the left.

The Hong Kong Monetary Authority (HKMA) on 2 November launched Project SAGE, short for Securing Agentic Finance with Governance and Enablement, and set up an Agentic Finance Expert Group to support it. On the same day it published a discussion paper on how banks should govern their use of AI agents. In RegMemo’s analysis, the questions the HKMA put to the industry go further than the bank-level controls it outlined in October: they raise the possibility of a market-wide list of trusted agents and a common identity check for software acting on behalf of customers.

Four workstreams, one of them on liability

Project SAGE covers four areas. The first is use cases: the HKMA will support banks and their partners in testing agentic finance in three settings it names, which are business-to-consumer uses such as agentic commerce and everyday payments, business-to-business uses such as procurement and treasury management, and machine-to-machine uses such as usage-based payments for digital services. The second is agent identity, including Know Your Agent (KYA) practices and ways to authenticate an agent’s identity and the authority delegated to it. The third is interoperability standards and protocols. The fourth is the legal and regulatory framework, where the HKMA lists governance, liability and consumer protection.

The expert group draws on four groups: financial institutions, technology providers, professional service firms and academia. Its membership list includes Hong Kong’s three note-issuing banks (Bank of China (Hong Kong), HSBC and Standard Chartered Bank (Hong Kong)), card networks Visa and Mastercard, UnionPay International, payment firms including Adyen, Ant International and WeChat Pay Hong Kong, and technology firms including Amazon Web Services, Google Cloud, Tencent Cloud, JINGDONG Technology and Circle Hong Kong. Clifford Chance, PwC and AIFT sit on it, with Professor Allen Huang of HKUST Business School as the academic member.

The discussion paper asks four questions

The HKMA’s English releases describe the discussion paper only as seeking feedback on supervisory considerations for the governance of agentic AI at banks. HKMA Chief Executive Eddie Yue was more specific in his remarks to the media at Hong Kong FinTech Week, which were delivered in Chinese. In RegMemo’s translation, he said the paper asks how a bank’s governance should work when it uses AI agents, how responsibility should be allocated, whether a central register is needed to record which agents are trusted, and whether the industry should set a “Know Your Agent” standard. He said the aim is to agree rules that give banks more room to use agentic AI within them.

The register question is the one with the widest reach. On 15 October, when it announced its “ART” framework, the HKMA said the paper would explore “a registry of material A.I. agents”, which read as an inventory each bank keeps of its own agents. A central register of trusted agents would work at market level. It would cover agents that third parties, including merchants, platforms and customers, point at a bank, and it would need an operator, admission criteria and a way to remove an agent that misbehaves.

The KYA question follows from the same problem. Know Your Customer rules tell a bank who its customer is. When an AI agent initiates a payment or opens a product, the bank also needs to confirm that the agent is what it claims to be and that the customer gave it the authority it is using. The SAGE workstream on agent identity and the paper’s question on a KYA standard put the HKMA on track to set that test for Hong Kong.

The rest of the FinTech Week package

The HKMA announced three other initiatives in its FinTech Week release. With the Hong Kong University of Science and Technology it launched a post-quantum cryptography toolkit to guide banks through moving to encryption designed to resist attacks by quantum computers. Mr Yue said that transition could take several years.

Under Project Ensemble, the HKMA moved Ensemble TX to a stage that allows 24-hour, seven-day settlement of real-value transactions, including interbank settlement of tokenised deposits. It has completed trial trades in which Recognised Dealers traded tokenised Exchange Fund Bills in the secondary market, and it plans to widen the trials to include regulated stablecoins as a settlement option. With Cyberport it opened tConnect Launchpad, which began accepting applications from fintech and digital asset firms on 2 November.

For retail payments, Hong Kong’s Faster Payment System will link with UnionPay International by the end of 2026, letting users pay by QR code at more than 100 million merchants in UnionPay’s networks across Hong Kong, the Chinese mainland and more than 40 other markets.

What to watch

  • Industry responses to the discussion paper, and whether the HKMA follows with supervisory guidance on agent registries and KYA.
  • The first use cases tested under Project SAGE, and any interoperability standard the expert group proposes.
  • Expansion of the tokenised Exchange Fund Bills trials to settlement in regulated stablecoins.
  • End of 2026: Faster Payment System link with UnionPay International due to go live.

Primary sources

Related: HKMA plans a registry of material AI agents under its new “ART” framework for banks


Photo (cropped): Mstyslav Chernov, CC BY-SA 3.0 via Wikimedia Commons

To Readers of RegMemo

Re The week in financial regulation

When Fridays

The weekly memo

One email at the end of each week: the rules, consultations and enforcement actions we covered, grouped by jurisdiction, with links to the regulators’ own documents.

Latest from the wire