HKMA AI guidelines for banks: a private banking guide

Which HKMA AI guidance applies now?

HKMA’s current bank-wide AI supervisory guidance is the 15 October 2026 ART framework: Accountability, Resilience and Trust. Its Supervisory Guidance for Responsible Adoption of Artificial Intelligence, Annex A supersedes the 1 November 2019 High-level Principles on Artificial Intelligence. It covers authorized institutions’ AI adoption, including internal, third-party and embedded applications.

For private-bank know your customer (KYC) teams, the practical question is whether AI can help prepare a client file while preserving the evidence and judgement needed to accept a relationship, corroborate wealth or escalate a concern. This guide focuses on those decisions. The AI guidance applies across authorized institutions; it is not a separate private-banking rulebook.

Read the documents according to their status:

• Binding legal obligations remain in place. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) imposes customer due diligence and record-keeping requirements. The Personal Data (Privacy) Ordinance governs personal-data handling. Using AI does not displace either framework.
• The AML/CFT Guideline contains mandatory requirements. AML-2, paragraphs 1.1–1.8, explains its statutory basis and enforcement relevance. Paragraph 1.6 treats both “must” and “should” as mandatory within that guideline. Non-compliance does not by itself make a person liable to proceedings, but the guideline has evidential and supervisory consequences under AMLO and the Banking Ordinance. Do not treat its private-banking provisions as optional tips.
• Annex A sets supervisory expectations for AI. Banks are expected to apply the nine principles proportionately and improve policies, procedures and controls “in a timely manner”. It does not set a single calendar implementation deadline. These are supervisory expectations, rather than a standalone AI statute.
• Customer-facing GenAI has additional consumer-protection guidance. The 19 August 2024 circular extends the separate 5 November 2019 big-data and AI consumer-protection principles to GenAI. Read its human-oversight wording with the updated 2026 approach below.
• Sandbox practices and proposals have different weight. Annex B shares observations and good practices for banks to consider. Annex C expressly says its agentic-AI concepts do not constitute specific supervisory requirements at this stage.

The private-banking examples and pilot checklist below are AgentKYZ’s implementation recommendations unless attributed to HKMA. For a bank assessing a defined KYC workflow, see our Hong Kong KYC services and agree the bank-specific scope before transferring files.

What the ART framework expects from banks

Principles 1–3 of Annex A address accountability. The board should approve an AI strategy and risk appetite. Each deployed use case needs an owner responsible for its authority, controls and escalation. An up-to-date inventory should cover approved uses, including vendor-provided and embedded AI, with controls against unapproved “shadow AI”. Approval to use a tool for one purpose is not permission to use it for anything.

Resilience, in Principles 4–6, means assessing materiality and risk across the full lifecycle. Banks should test end to end before deployment and material changes, against defined acceptance criteria. Material or higher-risk uses need independent validation and, where appropriate, adversarial testing. They also need credible fallback arrangements and a kill switch or equivalent for prompt suspension. Monitoring, incident response, third-party oversight and sufficient staff expertise all form part of the framework.

Trust, in Principles 7–9, covers output quality, explainability, transparency and fair treatment. Where an output may materially affect a customer, HKMA calls for stronger controls, such as reliable reference sources and/or human validation. Banks should define when an output must be withheld, referred for review or prevented from triggering an action.

For private-bank KYC, apply those expectations to the whole case. A document summariser can affect a risk rating if its summary is copied into the approval record. Assess that downstream use, rather than classifying the tool solely by its name.

Private banking: corroborate wealth, preserve uncertainty

HKMA’s AML/CFT Guideline, Chapter 12, sets a concrete standard for private-bank teams to assess AI-assisted work against:

• Paragraph 12.3 calls for additional customer information, including business or employment background, source of wealth, source of funds, relevant family background and anticipated account activity, and senior-management approval to establish the relationship.
• Paragraph 12.5 requires reasonable, risk-based steps to verify or corroborate source-of-wealth and source-of-funds information. For wealth, the evidence should support a reasonable belief about how the wealth, or most of it, was acquired.
• Paragraphs 12.6–12.7 address adverse-news screening and understanding the purpose of complex structures, including offshore trusts and companies.
• Paragraph 12.9 requires regular and trigger-event reviews. Frequency is risk-based, with at least annual review for high-risk private-banking relationships.
• Paragraph 12.12 calls for reviews of account opening, CDD adequacy and ongoing monitoring by staff independent of the relationship managers (RMs).

Paragraph 12.4 makes the extent of the additional measures in paragraph 12.3 dependent on the services and assessed customer risk. High-risk relationships also require appropriate enhanced due diligence. The list above is a selection of controls relevant to AI-assisted case preparation, not the whole private-banking framework.

An AI-written wealth narrative should therefore distinguish what the client said, what an independent source supports and what remains unresolved. Our recommendation is to link material claims to the underlying document or record, show the relevant date and retain the reviewer’s reasoning where sources conflict. An RM’s familiar account of a long-standing client is not independent corroboration simply because a model rewrites it.

HKMA’s December 2025 high-end money-laundering review identified overreliance on customer representations without sufficient clarification, challenge or corroboration (section 3). It also highlighted changes in customer profiles and gaps between controls for retail high-net-worth and private-banking customers with similar risks. Those findings are useful inputs to a bank’s AI test cases.

There is a proportionality limit too. HKMA’s Smart Tips for Private Banking uses collection, clarification and corroboration. It warns against verifying every piece of wealth information, requesting decades of records mechanically or restarting CDD at each periodic review. Its good-practice example 6 describes AI helping consolidate CDD, corroborate wealth and produce screening results. That is evidence that the use case is relevant, not a performance benchmark for any vendor.

For an inherited-wealth case, for example, ask the workflow to identify the inheritance evidence available, distinguish the estate’s value from the client’s share and flag an unsupported transfer into a personal investment company. Missing evidence should remain an open question. The model should not invent the transaction that would make the narrative coherent.

Human oversight and customer-facing GenAI

HKMA does not require the same human-review arrangement for every AI use case. Annex A (Principle 2 and footnote 3) recognises human-in-the-loop, human-on-the-loop and human-in-command arrangements, with risk-based triggers for approval or intervention. Reviewers need the competence, information, time and authority to challenge, override or stop the system. Banks should test whether that oversight works.

This updates the approach to the 2024 circular’s early-stage human-in-the-loop expectation for customer-facing GenAI. It does not remove separate approval requirements or the other consumer-protection expectations.

For customer-facing services, the 2024 circular (sections 2–4) addresses fair outcomes, understandable disclosure of GenAI use, purpose and limitations, and personal-data protection. During early deployment it calls for opt-out and human intervention as far as practicable; where opt-out cannot be provided, customers should have a channel to request review. Measures with equivalent effect may also be acceptable.

An internal RM assistant can still influence what a client hears. Annex B’s multi-agent RM assistant example (printed pages 21–23) describes decision support with boundaries: the agents do not give final advice, determine suitability, approve communications or execute transactions. Drafts stop with an RM or other authorised person. This is a useful operating model to assess, not a universal rule that every bank must copy.

For a first private-banking KYC pilot, we recommend keeping customer acceptance, material risk-rating changes and client communications outside the AI’s autonomous authority. Set the bank’s approval and escalation rules explicitly. A human signature alone does not establish effective review.

Data, third-party providers and agent permissions

Private-bank files can contain identity documents, family relationships, trust information and financial records. Annex A, Principle 5, sets expectations for approved data purposes and safeguards, compliance with the PDPO, and contractual protection against a provider reusing personal or confidential data for model training or improvement unless specifically authorised by the institution and permitted under applicable requirements.

Ask a provider to explain the complete data path: document storage, model services, retrieval databases, logs and any subcontractors. Confirm location, access, retention, deletion and training arrangements for the proposed deployment. The PCPD’s explanation of the PDPO also makes clear that data users must use contractual or other means to ensure their processors meet the applicable retention and security requirements. Data processors are not directly regulated under the PDPO.

HKMA expects provider due diligence, formal contractual safeguards, ongoing monitoring and consideration of concentration, continuity, substitutability and exit risks. Depending on the use case, contractual provisions should cover audit rights, data protection, material changes, incidents and recovery. An outsourced workflow leaves the bank responsible for AI-generated outcomes.

Agents that can call tools need controls beyond the prompt. Principle 5 says banks should not rely solely on model instructions or filters for cybersecurity assurance. Annex B (section 4.1.3.1) illustrates useful practices: treat retrieved documents as untrusted data, enforce access boundaries, validate tool calls in backend systems and test for cross-user data leakage.

For a KYC agent, our suggested boundary is read access to approved case evidence, draft-only outputs and separate permission to change a customer record. Test whether a malicious instruction inside an uploaded document can bypass that boundary.

Annex C explores intent-based accountability, component lineage and a possible industry-level registry for material AI agents. The registry is a proposal for exploration, not an existing registration obligation in that note. Current Annex A expectations already cover AI inventories, oversight and controls; banks should not defer those while agent-specific policy develops.

Test a private-banking workflow before live use

The following are our recommended pilot checks, applying Annex A’s testing and oversight expectations to private-bank KYC. Agree acceptance criteria before running the cases, including what must block approval and what requires escalation.

1. Contradictory wealth evidence: give the workflow a client declaration and a source record with different sale proceeds. It should expose the discrepancy and cite both, rather than silently choose one.
2. Complex ownership: use a trust or company chain with an unresolved control link. The file should distinguish documented ownership from assumptions and retain the missing evidence as an exception.
3. Screening ambiguity: include similar names with conflicting identifiers and Chinese/English name variants relevant to the bank’s client base. Check whether the workflow preserves the reasons for review instead of automatically clearing or merging identities.
4. Changed risk profile: add a new wealth contributor or unexplained third-party transfer to an otherwise familiar periodic-review file. Test whether the change reaches the appropriate reviewer.
5. Unauthorised retrieval or action: request another client’s file and place a hostile instruction inside a document. Access restrictions and action permissions should hold even if the model follows the instruction.
6. Failure and intervention: interrupt the provider, test the stop mechanism and have a reviewer reject an unsupported conclusion. Check that the case stays controlled, the intervention is recorded and fallback work can proceed.

Keep the approved use-case scope, risk assessment, test results, independent validation where applicable, residual-risk acceptance and deployment approval together. Principle 4 of Annex A also calls for lifecycle documentation and, as far as practicable for material or higher-risk outputs, records enabling audit and outcome tracing. Useful records can include sources, model versions, configurations and relevant inputs. Set retention and access under the bank’s applicable obligations rather than retaining all personal data indefinitely.

Treat KYC preparation separately from transaction monitoring. The 9 September 2024 circular called on institutions with significant Hong Kong operations to undertake AI feasibility studies and formulate implementation plans for ML/TF monitoring, with board sign-off and submission by the end of March 2025, subject to individual supervisory communication on timing. The 19 November 2025 follow-up says HKMA will track implementation progress and keep monitoring effectiveness under review. A KYC pilot does not by itself discharge those separate expectations.

Where AgentKYZ fits in a private bank’s KYC workflow

AgentKYZ prepares KYC cases for human review: reading documents, mapping ownership, screening sanctions, politically exposed persons and adverse media, and preparing a reasoned assessment. Reviewers check the findings against your AML policy, record their conclusions and escalate unresolved cases. The case file keeps supporting evidence and the audit trail together. Your bank retains final approval and responsibility for its KYC decisions.

That gives a private-bank team a defined workflow to evaluate against its AI governance and AML requirements. Start with a bounded use case, such as preparing periodic-review files for assessment, and ask to see how the review handles an unsupported wealth claim or an incomplete ownership chain. Case-level evidence and review records support scrutiny; model validation, independent assurance and the bank’s deployment approval are separate assessments. Using AgentKYZ does not guarantee regulatory acceptance.

Your team can use AgentKYZ’s AI KYC software directly, or agree managed KYC support in Hong Kong. Confirm the institution’s required data arrangements, testing evidence, provider-change process and division of responsibilities before processing live files.

For a group operating in both markets, our MAS AI risk management guide covers Singapore’s separate framework and implementation dates. It is not a timetable for HKMA-regulated operations. Securities-sector obligations also need their own assessment. AML-2, paragraph 1.3, footnote 1, requires registered institutions and associated entities that are authorized institutions to have regard to the relevant SFC guideline provisions. Our SFC AML guide focuses on licensed corporations rather than replacing the HKMA bank framework.

Bring your approved AML policy, the proposed case population and an anonymised sample with known gaps to an AgentKYZ demo. Ask us to show the evidence a reviewer receives and the decisions your authorised team keeps.