What does HKMA GenAI consumer protection circular say about AI in banking?

What are the key points of HKMA GenAI consumer protection circular?

• Scope: customer-facing GenAI applications; the HKMA expects all authorized institutions to apply and extend the 2019 BDAI Guiding Principles to them and to continue a risk-based approach.
• Governance (principle 1): the board and senior management remain accountable for GenAI-driven decisions and must consider customer impact through an appropriate committee under the governance framework; define the scope of customer-facing GenAI so it is not used in unintended areas; have policies on responsible use and related controls.
• Validation (principle 1(c)): proper validation of GenAI models and, during the early stage of deploying customer-facing GenAI, a "human-in-the-loop" approach where a human retains control of decision-making so outputs are accurate and not misleading.
• Fairness (principle 2(a)): outputs must not lead to unfair bias or disadvantage; approaches include anonymising certain data categories, using comprehensive and fair datasets, and bias adjustments during validation and review.
• Opt-out (principle 2(b)): in the early stage of deployment, customers should as far as practicable be able to opt out of GenAI and request human intervention on GenAI-generated decisions; if opt-out cannot be offered, provide channels to request review, and other measures with the same effect are acceptable.
• Transparency (principle 3): disclose the use of GenAI to customers and communicate its purpose and the limitations of the models.
• Data privacy (principle 4): comply with the Personal Data (Privacy) Ordinance and pay due regard to the Privacy Commissioner's Guidance on the Ethical Development and Use of Artificial Intelligence (18 August 2021) and Model Personal Data Protection Framework (11 June 2024).
• Banks are encouraged to use BDAI and GenAI proactively to enhance consumer protection, for example to identify vulnerable customers, customers needing more product information, or transactions warranting fraud alerts.

What did HKMA GenAI consumer protection circular change for banks?

It brought generative AI explicitly inside the HKMA's 2019 consumer-protection regime at the moment banks were moving from internal chatbots and coding to customer-facing GenAI. It did not create a separate rulebook; it added GenAI-specific expectations such as human-in-the-loop, opt-out and limitation disclosure to the existing four principles.

What does the HKMA require of banks using generative AI with customers?

The HKMA's circular of 19 August 2024 expects Authorized Institutions to apply the four 2019 consumer-protection principles to customer-facing generative AI and adds GenAI-specific safeguards. Banks should define and limit the scope of each customer-facing GenAI use, keep a human in the loop during early deployment so outputs are accurate and not misleading, offer customers an opt-out and human intervention where practicable (or a review channel), guard against unfair bias, disclose both the use of GenAI and its limitations, and comply with the Personal Data (Privacy) Ordinance and the Privacy Commissioner's AI guidance. The HKMA flags lack of explainability and hallucination as risks that can harm customers more than ordinary BDAI. The expectations are supervisory guidance applied on a risk-based approach.

The circular reflects an HKMA survey of AI use in the banking sector (annexed to the circular) and the observation that most GenAI adoption was then still internal, such as chatbots for staff and coding, with customer-facing use expected to grow. It cross-refers to the 1 November 2019 "High-level Principles on Artificial Intelligence" for risk management of AI including GenAI and says that circular will be updated from time to time.

The HKMA paired the guidance with the GenA.I. Sandbox (announced 13 August 2024), under which banks can pilot GenAI use cases and receive targeted supervisory feedback, and the HKMA said it would consider the need for further supervisory guidance based on Sandbox trial results.

WHAT THIS MEANS IN PRACTICE

• Inventory every customer-facing GenAI feature (chatbots, product recommendation, robo-advice) and document its defined scope and out-of-scope uses.
• Keep a human reviewer in the loop for early-stage deployments and record the criteria for removing that control.
• Provide an opt-out or review route for GenAI-generated decisions and test it with real customer journeys.
• Add customer-facing wording that discloses GenAI use, its purpose and its limitations, including hallucination risk.
• Test outputs for bias and for hallucination before launch, and align data practices with the Privacy Commissioner's guidance.