The Hong Kong Monetary Authority has become the first banking regulator to build a governance framework specifically for autonomous AI agents, addressing a structural gap in financial regulation: AI systems that can move money, negotiate contracts, and instruct other AI systems without human authorization at each step have no standard way to prove who deployed them, what they are permitted to do, or who is liable when they act2.
HKMA Chief Executive Eddie Yue announced Project SAGE — Securing Agentic Finance with Governance and Enablement — on November 2, 2026, at Hong Kong FinTech Week1. The initiative is backed by a 22-member cross-sector expert group and accompanied by a formal discussion paper asking what "Know Your Agent" (KYA) standards should require in practice.
Why banking regulators face a new category problem
The HKMA's framing draws a sharp line between generative AI and agentic AI. Traditional generative AI operates on a prompt-response model where a human decides what to do with the output. Agentic AI is architecturally different: given a goal and a set of tools — database access, payment APIs, messaging systems — an AI agent plans a sequence of actions, executes them, observes the outcome, and replans, all without human confirmation at each step. In banking, the HKMA says, AI agents are neither natural persons nor legal entities, creating a classification gap that existing regulation cannot address.
The authority's use of AI agents in Hong Kong's financial sector is expanding from internal operations to customer-facing services such as payments. Project SAGE aims to address the regulatory and cybersecurity risks that expansion carries.
SAGE's workstreams and enforcement levers
Project SAGE is structured around four areas: use-case validation, agent identity and authorization, interoperable standards, and governance covering legal liability and consumer protection. The HKMA's discussion paper says a KYA framework would need cryptographically signed agent identity certificates, capability disclosures, behavioral audit logs, and principal attribution records. The paper also floats two enforcement mechanisms: a centralized registry of material AI agents maintained by the HKMA, and effective human intervention mechanisms that could let the regulator suspend specific agent IDs.
HKMA Deputy CEO Arthur Yuen said banks must pair innovation with clear accountability, resilient operating models, and effective human oversight.
ANALYSIS Project SAGE's proposed registry and suspension powers would give the HKMA direct operational control over individual AI agents — a degree of granularity that goes beyond typical financial-technology licensing and moves closer to real-time infrastructure oversight.