# HKMA BDAI consumer protection principles: Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions (HKMA circular, 5 November 2019)

Source: https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019
Last updated: Oct 5, 2026

The HKMA's circular of 5 November 2019 gives Authorized Institutions four guiding principles on consumer protection in the use of big data analytics and artificial intelligence (BDAI): governance and accountability, fairness, transparency and disclosure, and data privacy and protection. It was issued by the Executive Director (Banking Conduct) after banks asked for guidance at a Balanced and Responsive Supervision roundtable and draws on the OECD's updated effective approaches for financial consumer protection in the digital age. Its transparency principle expects banks to tell customers before service provision that a service is powered by BDAI, to offer a way to ask for review of BDAI-driven decisions, and to explain the data and factors behind decisions on request, except for fraud and money laundering monitoring systems. The HKMA's 19 August 2024 circular extends these principles to generative AI.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) |
| Type | Circular |
| Status | In force |
| Published | Nov 5, 2019 |
| Applies to | All Authorized Institutions in Hong Kong, addressed to their chief executives. AIs are to adopt a risk-based approach commensurate with the risks involved in their big data analytics and AI (BDAI) applications. The circular covers consumer-facing aspects; risk management of AI is dealt with in the HKMA's 1 November 2019 circular. |
| Official text | https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20191105-1-EN/20191105-1-EN.pdf |

## Key points

- Four principle areas: governance and accountability, fairness, transparency and disclosure, and data privacy and protection, applied on a risk-based approach commensurate with the risks of each BDAI application.
- Governance (principle 1): the board and senior management remain accountable for all BDAI-driven decisions and processes; the models must be explainable (no black-box excuse), consistent with the Code of Banking Practice and Treat Customers Fairly Charter, and validated before launch with on-going reviews.
- Fairness (principle 2): BDAI models must produce objective, consistent, ethical and fair outcomes, including compliance with anti-discrimination law, no unjustifiable denial of access to basic banking services, taking account of customers' financial capabilities and digital literacy, and the possibility of manual intervention to mitigate irresponsible lending decisions in higher-risk cases.
- Transparency (principle 3(a)): make clear to customers, before service provision, that the service is powered by BDAI technology and of the associated risks.
- Transparency (principle 3(c) and (d)): provide a mechanism for customers to enquire about and request review of BDAI decisions, with accessible and fair complaint handling and redress, and explain on request and where appropriate what data are used and how the models affect decisions; explanations are not required for systems used to monitor and prevent fraud or money laundering and terrorist financing.
- Data privacy (principle 4): comply with the Personal Data (Privacy) Ordinance including the six Data Protection Principles, pay regard to the Privacy Commissioner's Ethical Accountability Framework and Fintech leaflet, and consider privacy by design, data minimisation and clear, informed consent.
- The HKMA welcomed industry worked examples applying the principles and joint consumer education efforts.
- The circular points banks to the companion circular of 1 November 2019 on High-level Principles on Artificial Intelligence for AI risk management.

## What changed for banks

It set the HKMA's conduct expectations for big data analytics and AI in dealings with customers, adding disclosure, review and redress expectations alongside the supervisory principles of 1 November 2019. It is the base text that the HKMA's 2024 generative AI circular extends rather than replaces.

## Use cases it governs

- [Customer-facing chatbots](https://www.bankingnewsai.com/ai-regulation/by-use-case#customer-chatbots)
- [Fair lending & discrimination](https://www.bankingnewsai.com/ai-regulation/by-use-case#fair-lending)
- [Credit scoring & underwriting](https://www.bankingnewsai.com/ai-regulation/by-use-case#credit-underwriting)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)

## What do the HKMA's BDAI consumer protection principles require of banks?

The HKMA's circular of 5 November 2019 expects Authorized Institutions to apply four guiding principles when they use big data analytics and AI (BDAI) in dealings with customers. Governance and accountability keeps the board and senior management answerable for BDAI-driven decisions and requires explainable, validated models; fairness requires objective and non-discriminatory outcomes, protects access to basic banking services and keeps manual intervention available for risky lending decisions; transparency requires telling customers before service provision that BDAI is used, offering review and redress, and explaining data and factors on request; and data privacy requires compliance with the Personal Data (Privacy) Ordinance and consideration of privacy by design and data minimisation. The banks apply them on a risk-based approach, and the fraud and money laundering monitoring carve-out applies only to customer explanations.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| Principle 1(b) — Explainability of BDAI models | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Keep an appropriate level of explainability of BDAI models and algorithms (no black-box excuse) so the models can be understood by the bank. | Since 5 November 2019 | [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) |
| Principle 1(c) — Existing conduct standards apply | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Adhere to the Code of Banking Practice, the Treat Customers Fairly Charter and other regulatory requirements as for conventional products, consistent with the bank's ethical standards. | Since 5 November 2019 | [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) |
| Principle 1(d) — Validation and on-going review | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Validate BDAI applications before launch and review them thereafter to ensure reliability, fairness, accuracy and relevance of models, data and results. | Since 5 November 2019 | [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) |
| Principle 2(b) and (e) — Fair access and manual intervention | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Do not unjustifiably deny access to basic banking services, and keep the possibility of manual intervention to mitigate irresponsible lending decisions where the automated decision carries higher risk or impact. | Since 5 November 2019 | [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) |
| Principle 3(a) — Disclosure that BDAI is used | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Make clear to customers, before service provision, that the service is powered by BDAI technology and of the associated risks. | Since 5 November 2019 | [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) |
| Principle 3(c) — Enquiry, review and redress | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Provide a mechanism for customers to enquire about and request review of BDAI decisions, with accessible and fair complaint handling and redress. | Since 5 November 2019 | [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) |
| Principle 3(d) — Explanations on request | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | On customer request and where appropriate, explain what data are used and what factors or how the models affect decisions; not required for fraud and money laundering or terrorist financing monitoring systems. | Since 5 November 2019 | [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) |
| Principle 4 — Data privacy and protection | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Comply with the Personal Data (Privacy) Ordinance and its six Data Protection Principles, consider privacy by design and data minimisation, and seek clear and understandable consent where required. | Since 5 November 2019 | [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) |

The circular is the consumer-conduct partner of the 1 November 2019 "High-level Principles on Artificial Intelligence", which covers AI risk management from the banking supervision side. The two were issued four days apart by different HKMA divisions and are meant to be read together.

The HKMA's 19 August 2024 circular on generative AI states that the HKMA expects all authorized institutions to apply and extend these 2019 BDAI Guiding Principles to generative AI in customer-facing applications, adding human-in-the-loop, opt-out and limitation-disclosure expectations.

### What this means in practice

- Add AI disclosure wording at the point of service for every customer-facing BDAI feature, including the associated risks.
- Stand up an enquiry and review route for BDAI-driven decisions and make sure complaint handling staff can obtain explanations from the model owners.
- Keep a documented manual-override path for higher-risk or higher-impact automated lending decisions.
- Exclude AML and fraud monitoring systems from customer-facing explanation duties only after documenting why, because the carve-out is limited to explanations.
- Run privacy-by-design and data-minimisation reviews against the Personal Data (Privacy) Ordinance before launching a BDAI product.

## FAQ

### What are the HKMA's consumer protection principles for AI and big data?

Four: governance and accountability, fairness, transparency and disclosure, and data privacy and protection. The circular of 5 November 2019 sets them out for Authorized Institutions using big data analytics and AI (BDAI) and asks for a risk-based approach commensurate with the risks involved.

### Does the HKMA require banks to tell customers a service uses AI?

Yes, as an expectation. Principle 3(a) says banks should make clear to customers, prior to service provision, that the service is powered by BDAI technology and of the associated risks. The HKMA's 2024 circular repeats the disclosure expectation for generative AI.

### Can customers ask a bank to review an AI-driven decision in Hong Kong?

The circular expects banks to make available a mechanism for customers to enquire and request reviews of decisions made by BDAI applications, with accessible and fair complaint handling and redress, and to explain what data and factors drive the decision on request and where appropriate. Explanations are not required for fraud, money laundering or terrorist financing monitoring systems.

### Is the HKMA's 2019 BDAI circular still in force?

Yes. The HKMA's repository lists it as a current circular, and the circular of 19 August 2024 asks banks to apply and extend these 2019 BDAI Guiding Principles to generative AI.

## Related documents

- [HKMA GenA.I. Sandbox++ joint circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-sandbox-plus-plus-2026) — Joint Circular on the Expansion of Generative Artificial Intelligence Sandbox (HKMA, SFC, Insurance Authority and MPFA, 5 March 2026) (Mar 5, 2026)
- [HKMA GenA.I. Sandbox circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-sandbox-2024) — Generative Artificial Intelligence Sandbox (HKMA circular inviting applications to the GenA.I. Sandbox, 20 September 2024) (Sep 20, 2024)
- [HKMA circular on AI for monitoring of suspicious activities](https://www.bankingnewsai.com/ai-regulation/documents/hkma-ai-aml-monitoring-2024) — Use of Artificial Intelligence for Monitoring of Suspicious Activities (HKMA circular, 9 September 2024) (Sep 9, 2024)
- [HKMA GenAI consumer protection circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024) — Consumer Protection in respect of Use of Generative Artificial Intelligence (HKMA circular, 19 August 2024) (Aug 19, 2024)
- [HKMA High-level Principles on Artificial Intelligence](https://www.bankingnewsai.com/ai-regulation/documents/hkma-high-level-principles-ai-2019) — High-level Principles on Artificial Intelligence (HKMA circular to all Authorized Institutions, 1 November 2019) (Nov 1, 2019)
- [AB 1609](https://www.bankingnewsai.com/ai-regulation/documents/ca-ab-1609-2026) — Customer Service Chatbots (Right to Human Customer Service Act) (Sep 28, 2026)
- [Colorado AG proposed ADMT rules](https://www.bankingnewsai.com/ai-regulation/documents/co-ag-admt-proposed-rules-2026) — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026)
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://www.bankingnewsai.com/ai-regulation/documents/eu-digital-omnibus-ai-regulation-2026-1744) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026)

Last reviewed Oct 5, 2026. Cite the official text (https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20191105-1-EN/20191105-1-EN.pdf) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.