# HKMA GenAI consumer protection circular: Consumer Protection in respect of Use of Generative Artificial Intelligence (HKMA circular, 19 August 2024)

Source: https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024
Last updated: Oct 5, 2026

The HKMA's circular of 19 August 2024 tells Authorized Institutions to apply and extend the 2019 BDAI consumer-protection principles to generative AI in customer-facing applications and adds extra safeguards under each of the four principle areas. The most operational are human-in-the-loop validation in the early stage of deployment, a clearly defined scope for each customer-facing GenAI use, an option for customers to opt out of GenAI and request human intervention (or, if opt-out is not possible, a channel to request review), and disclosure of both the use of GenAI and the limitations of the models. The HKMA singles out lack of explainability and hallucination as risks that could cause even more significant impact on customers. It was signed by the Executive Director (Banking Conduct), states no penalties, and has no end date.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) |
| Type | Circular |
| Status | In force |
| Published | Aug 19, 2024 |
| Applies to | All Authorized Institutions in Hong Kong using generative AI (GenAI) in customer-facing applications such as customer chatbots, customised product delivery, targeted sales and marketing, and robo-advisors. Internal uses such as coding assistants are not the focus of the circular, though the HKMA's 2019 AI risk principles still apply to them. |
| Official text | https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20241107-1-EN/20241107-1-EN.pdf |

## Key points

- Scope: customer-facing GenAI applications; the HKMA expects all authorized institutions to apply and extend the 2019 BDAI Guiding Principles to them and to continue a risk-based approach.
- Governance (principle 1): the board and senior management remain accountable for GenAI-driven decisions and must consider customer impact through an appropriate committee under the governance framework; define the scope of customer-facing GenAI so it is not used in unintended areas; have policies on responsible use and related controls.
- Validation (principle 1(c)): proper validation of GenAI models and, during the early stage of deploying customer-facing GenAI, a "human-in-the-loop" approach where a human retains control of decision-making so outputs are accurate and not misleading.
- Fairness (principle 2(a)): outputs must not lead to unfair bias or disadvantage; approaches include anonymising certain data categories, using comprehensive and fair datasets, and bias adjustments during validation and review.
- Opt-out (principle 2(b)): in the early stage of deployment, customers should as far as practicable be able to opt out of GenAI and request human intervention on GenAI-generated decisions; if opt-out cannot be offered, provide channels to request review, and other measures with the same effect are acceptable.
- Transparency (principle 3): disclose the use of GenAI to customers and communicate its purpose and the limitations of the models.
- Data privacy (principle 4): comply with the Personal Data (Privacy) Ordinance and pay due regard to the Privacy Commissioner's Guidance on the Ethical Development and Use of Artificial Intelligence (18 August 2021) and Model Personal Data Protection Framework (11 June 2024).
- Banks are encouraged to use BDAI and GenAI proactively to enhance consumer protection, for example to identify vulnerable customers, customers needing more product information, or transactions warranting fraud alerts.

## What changed for banks

It brought generative AI explicitly inside the HKMA's 2019 consumer-protection regime at the moment banks were moving from internal chatbots and coding to customer-facing GenAI. It did not create a separate rulebook; it added GenAI-specific expectations such as human-in-the-loop, opt-out and limitation disclosure to the existing four principles.

## Use cases it governs

- [Customer-facing chatbots](https://www.bankingnewsai.com/ai-regulation/by-use-case#customer-chatbots)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Fair lending & discrimination](https://www.bankingnewsai.com/ai-regulation/by-use-case#fair-lending)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)

## What does the HKMA require of banks using generative AI with customers?

The HKMA's circular of 19 August 2024 expects Authorized Institutions to apply the four 2019 consumer-protection principles to customer-facing generative AI and adds GenAI-specific safeguards. Banks should define and limit the scope of each customer-facing GenAI use, keep a human in the loop during early deployment so outputs are accurate and not misleading, offer customers an opt-out and human intervention where practicable (or a review channel), guard against unfair bias, disclose both the use of GenAI and its limitations, and comply with the Personal Data (Privacy) Ordinance and the Privacy Commissioner's AI guidance. The HKMA flags lack of explainability and hallucination as risks that can harm customers more than ordinary BDAI. The expectations are supervisory guidance applied on a risk-based approach.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| Principle 1(a) — Define the scope of customer-facing GenAI | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Clearly define the scope of customer-facing GenAI applications so they are not used in unintended areas. | Since 19 August 2024 | [HKMA GenAI consumer protection circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024) |
| Principle 1(b) — Policies and controls | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Develop proper policies and procedures on the responsible use of GenAI in customer-facing applications and put related control measures in place. | Since 19 August 2024 | [HKMA GenAI consumer protection circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024) |
| Principle 1(c) — Validation and human-in-the-loop | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Validate GenAI models and, in the early stage of deployment, keep a human in control of decision-making so model-generated outputs are accurate and not misleading. | Since 19 August 2024 | [HKMA GenAI consumer protection circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024) |
| Principle 2(a) — No unfair bias | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Ensure outputs do not lead to unfair bias or disadvantage for any customers or groups, for example through anonymising data, representative datasets and bias adjustments during validation. | Since 19 August 2024 | [HKMA GenAI consumer protection circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024) |
| Principle 2(b) — Opt-out and review | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | In the early stage of deployment let customers opt out of GenAI and request human intervention as far as practicable; otherwise provide channels to request review of GenAI-generated decisions. | Since 19 August 2024 | [HKMA GenAI consumer protection circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024) |
| Principle 3 — Transparency and disclosure | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Disclose the use of GenAI to customers and communicate its purpose and the limitations of the models. | Since 19 August 2024 | [HKMA GenAI consumer protection circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024) |
| Principle 4 — Data privacy and protection | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Comply with the Personal Data (Privacy) Ordinance and pay due regard to the Privacy Commissioner's GenAI-related guidance, including the 2021 ethics guidance and the June 2024 Model Personal Data Protection Framework. | Since 19 August 2024 | [HKMA GenAI consumer protection circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024) |
| Base text — 2019 BDAI Guiding Principles | [HKMA](https://www.bankingnewsai.com/ai-regulation/hkma) | Continue to apply the 2019 BDAI principles on governance, fairness, transparency and data privacy to GenAI on a risk-based approach. | Since 5 November 2019 | [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) |

The circular reflects an HKMA survey of AI use in the banking sector (annexed to the circular) and the observation that most GenAI adoption was then still internal, such as chatbots for staff and coding, with customer-facing use expected to grow. It cross-refers to the 1 November 2019 "High-level Principles on Artificial Intelligence" for risk management of AI including GenAI and says that circular will be updated from time to time.

The HKMA paired the guidance with the GenA.I. Sandbox (announced 13 August 2024), under which banks can pilot GenAI use cases and receive targeted supervisory feedback, and the HKMA said it would consider the need for further supervisory guidance based on Sandbox trial results.

### What this means in practice

- Inventory every customer-facing GenAI feature (chatbots, product recommendation, robo-advice) and document its defined scope and out-of-scope uses.
- Keep a human reviewer in the loop for early-stage deployments and record the criteria for removing that control.
- Provide an opt-out or review route for GenAI-generated decisions and test it with real customer journeys.
- Add customer-facing wording that discloses GenAI use, its purpose and its limitations, including hallucination risk.
- Test outputs for bias and for hallucination before launch, and align data practices with the Privacy Commissioner's guidance.

## FAQ

### Does the HKMA's generative AI circular apply to banks?

Yes. It is addressed to the chief executive of all Authorized Institutions and concerns the use of generative AI in customer-facing applications, from the consumer-protection perspective. The HKMA expects all authorized institutions to apply and extend the 2019 BDAI Guiding Principles to GenAI.

### Must Hong Kong banks offer an opt-out from generative AI?

As far as practicable and in the early stage of deploying customer-facing GenAI, yes: customers should be able to opt out of GenAI and request human intervention on GenAI-generated decisions. Where an opt-out cannot be provided, banks should provide channels to request a review of the GenAI-generated decisions, and other measures with the same effect are acceptable.

### What does the HKMA say about human-in-the-loop for GenAI?

During the early stage of deploying customer-facing GenAI applications, authorized institutions should adopt a human-in-the-loop approach, with a human retaining control of the decision-making process so that model-generated outputs are accurate and not misleading.

### When did the HKMA's generative AI circular take effect?

The circular is dated 19 August 2024 and states no separate effective date or deadline; it is a current circular on the HKMA's repository. The HKMA's August 2024 GenA.I. Sandbox gives banks supervisory feedback on GenAI pilots.

## Related documents

- [HKMA GenA.I. Sandbox++ joint circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-sandbox-plus-plus-2026) — Joint Circular on the Expansion of Generative Artificial Intelligence Sandbox (HKMA, SFC, Insurance Authority and MPFA, 5 March 2026) (Mar 5, 2026)
- [HKMA GenA.I. Sandbox circular](https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-sandbox-2024) — Generative Artificial Intelligence Sandbox (HKMA circular inviting applications to the GenA.I. Sandbox, 20 September 2024) (Sep 20, 2024)
- [HKMA circular on AI for monitoring of suspicious activities](https://www.bankingnewsai.com/ai-regulation/documents/hkma-ai-aml-monitoring-2024) — Use of Artificial Intelligence for Monitoring of Suspicious Activities (HKMA circular, 9 September 2024) (Sep 9, 2024)
- [HKMA BDAI consumer protection principles](https://www.bankingnewsai.com/ai-regulation/documents/hkma-bdai-consumer-protection-2019) — Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions (HKMA circular, 5 November 2019) (Nov 5, 2019)
- [HKMA High-level Principles on Artificial Intelligence](https://www.bankingnewsai.com/ai-regulation/documents/hkma-high-level-principles-ai-2019) — High-level Principles on Artificial Intelligence (HKMA circular to all Authorized Institutions, 1 November 2019) (Nov 1, 2019)
- [AB 1609](https://www.bankingnewsai.com/ai-regulation/documents/ca-ab-1609-2026) — Customer Service Chatbots (Right to Human Customer Service Act) (Sep 28, 2026)
- [Colorado AG proposed ADMT rules](https://www.bankingnewsai.com/ai-regulation/documents/co-ag-admt-proposed-rules-2026) — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026)
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://www.bankingnewsai.com/ai-regulation/documents/eu-digital-omnibus-ai-regulation-2026-1744) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026)

Last reviewed Oct 5, 2026. Cite the official text (https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20241107-1-EN/20241107-1-EN.pdf) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/hkma-genai-consumer-protection-2024
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.