Summary
- 1 Nov 2019, High-level Principles on AI (Banking Supervision): 12 risk principles in three groups.
- Governance: board and senior management stay accountable for all AI-driven decisions; clear three lines of defence.
- Design and development: skilled staff, explainability ("no black-box excuse"), good data, rigorous validation (preferably independent), audit logs, vendor due diligence, fair and transparent use with AI disclosed before service.
- Ongoing: periodic review and monitoring, data protection under the PDPO, AI cybersecurity (data poisoning, adversarial attacks), and contingency plans that can suspend AI and fall back to humans.
- 5 Nov 2019, BDAI consumer protection circular (Banking Conduct): four areas, governance and accountability, fairness, transparency and disclosure, data privacy and protection. Includes manual intervention for higher-risk lending decisions, a way for customers to ask for review of AI decisions, and explanations on request (not needed for fraud or AML systems).
- 19 Aug 2024, GenAI consumer protection circular: banks must apply the 2019 BDAI principles to customer-facing GenAI plus extra safeguards: defined scope, a responsible-use policy, human in the loop in the early stage, an opt-out to a human where practicable (or a review channel), and disclosure of GenAI use, purpose and limits.
- The 2024 circular says the 2019 High-level Principles remain the reference for AI risk management, including GenAI, and will be updated over time.
Who it applies to
- All authorized institutions (licensed banks, restricted licence banks, deposit-taking companies) in Hong Kong.
- Vendors are covered indirectly: principle 7 requires banks to do due diligence on AI vendors against the same principles and review them periodically.
Key dates
- High-level Principles on Artificial Intelligence circular (risk management, 12 principles)
- Consumer Protection in respect of Use of BDAI circular (4 areas)
- Consumer Protection in respect of Use of Generative AI circular extends the 2019 BDAI principles to GenAI
Full date record
| Date | Event |
|---|---|
| 2019-11-01 | High-level Principles on AI |
| 2019-11-05 | BDAI consumer protection circular |
| 2024-08-19 | GenAI consumer protection circular |
Penalties and enforcement
- None stated in the circulars. Enforcement is through HKMA supervision of banks under its general powers.
- All three circulars were listed as "Current" in the HKMA regulatory repository on 2026-10-19.
What it means for an Indian company
- If you build credit, chatbot or marketing AI for Hong Kong banks, expect due diligence against all 12 principles: explainability evidence SC-AI-024 Explain AI-assisted decisions, validation reports SC-AI-016 Independent model validation, audit logs SC-AI-032 Logging and record keeping, AI security testing SC-AI-029 AI-specific security controls (prompt injection, model abuse).
- Build features the bank needs to meet conduct rules: AI disclosure banners SC-AI-022 Disclose AI interaction to users, human review and opt-out flows SC-AI-027 Right to contest and human review for individuals, complaint routing SC-AI-028 Customer grievance redressal for AI.
- Provide a "kill switch" and manual fallback for your AI module (SC-AI-033 Business continuity and fallback for AI).
- Personal data must meet Hong Kong's PDPO; check cross-border data flows from India (SC-AI-011 Lawful basis and consent for personal data used in AI).
- The same evidence largely covers RBI FREE-AI and MAS AI Risk Management Guidelines.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when HKMA AI Guidance for Banks is done.
Glossary
- Authorized institution (AI, in HKMA usage): a bank or deposit-taker licensed by HKMA. Not to be confused with artificial intelligence.
- BDAI: big data analytics and artificial intelligence.
- GenAI: generative AI that creates text, images, audio, video or code.
- PDPO: Hong Kong's Personal Data (Privacy) Ordinance.
- Human in the loop: a person checks or approves AI output before it takes effect.
Key takeaways
- Three current HKMA circulars: risk principles (Nov 2019), consumer protection (Nov 2019), GenAI consumer protection (Aug 2024).
- Core asks: board accountability, explainability, validation, audit logs, vendor oversight, disclosure, human review and fallback.
- Supervisory, not statutory; no fines in the text.
Official sources
- High-level Principles on Artificial Intelligence (1 Nov 2019), PDF, accessed 2026-10-19
- Consumer Protection in respect of Use of BDAI (5 Nov 2019), accessed 2026-10-19
- Consumer Protection in respect of Use of Generative AI (19 Aug 2024), accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.