The Hong Kong Monetary Authority published a discussion paper on agentic AI in banking in November 2026. What records does it expect a bank to keep for each AI agent and for the actions the agent takes, and which agents would have to be reported to a proposed HKMA registry?

What should I check, step by step?

1. List every agentic deployment, including pilots, and open a record for each before it reaches production. The paper treats unapproved tools and approved tools used outside their limits as shadow AI that the record should help you find.

2. For each deployment, write down the approved business intent: what it may do, what it must escalate, its limits and approval conditions, who it serves, and when its authority should be reviewed or withdrawn.
3. Name the accountable, business, technical and control owners and the authorised users. The paper says using outside models, cloud services or tools doesn't move accountability away from the bank.
4. Give each deployment its own identity and credentials where you can. The paper warns that shared or borrowed accounts break the link between an action and the authority behind it.
5. Log each action with: what it did, what it affected, when, the instruction or event that triggered it, the data and tools used, the permissions and controls relied on, and any human approval or intervention.
6. Record suspensions, restorations and material changes to models, prompts, tools, data sources, workflows and permissions as they happen, not afterwards.
7. At retirement, close the record and say what happened to the agent's memory, accumulated state, credentials and retained data.
8. Run the paper's two-step materiality test (reach, then oversight) for each deployment before production and after every material change, and keep the evidence behind the conclusion.

What does the HKMA's agentic AI discussion paper expect banks to record for each AI agent deployment?

The paper's practical test is whether a bank can explain any material action a deployment has taken, identify the authority behind it, name the components and dependencies involved, and produce enough evidence for independent assurance, incident investigation and remediation. It notes that when software acts, the log takes the place of a person's memory and signature, so attribution has to be designed in from the start because it may not be possible to rebuild later.

• The deployment record follows the agent from conception through design, testing, production, changes, suspension and retirement. The paper also expects component lineage: the models, data sources, tools, systems, interfaces, providers and credentials each deployment uses, so the cause and reach of an incident can be traced.
• Logs should be retained, accessible and dependable enough to support internal audit, investigation and reconstruction of material events. In discussing enforceable controls, the paper lists tamper-evident logs, approval records, access reviews and test results among the evidence a bank can use to show an agent's tools and permissions stayed within approved limits.

How does the HKMA decide whether a bank's AI agent is material?

Step one asks about reach. A deployment has reach if it can change a customer's or the bank's position (moving funds, changing accounts or data, making commitments, or deciding a customer's entitlement such as credit), discharge a duty owed to an authority or market (for example closing a regulatory alert), or support a critical operation. An agent that only drafts, researches or summarises has none, and the assessment stops there. Reach must also be significant, measured against thresholds the bank already uses, and a fast stream of small reversible actions can count if it outpaces the bank's ability to stop it.

• Step two asks whether genuine human approval of each action stands between the agent and the harm. If not, the deployment is material. If so, it is not material unless the action is irreversible, so a payment-release agent with a person approving every payment is still material because settled payments may not be reversible. A read-only agent that is the only automated fraud monitor is also material, because a critical operation depends on its accuracy.
• Deployments that share a model, platform, orchestrator or other critical dependency are also assessed together, since one failure could hit them all. The independent control owner endorses each assessment, and it is redone after changes, incidents or evidence that an approval gate isn't working.

When does the HKMA treat human approval of an AI agent's action as genuine?

Approval counts only if the approver sees the substance of the action, has the authority and practical ability to reject it, rejection is accepted as a legitimate outcome, and the action stays pending until a decision is made. If any of these is missing, the paper treats the deployment as ungated.

• A bank claiming a gate needs continuing evidence that it still works. In practice that means keeping each approval with what the approver was shown, who decided, the decision and the time, and tracking how often approvers reject, so a gate that has become a rubber stamp shows up in the data.
• Material deployments would be notified to the HKMA, either before production or soon after; the paper asks which. A notification would draw on the internal record and evidence: owners and who may instruct the agent, how each action is tied to the agent and the human authority behind it, how the audit trail is retained, and the stop mechanism with evidence it has been tested.