What does HKMA High-level Principles on Artificial Intelligence say about AI in banking?

What are the key points of HKMA High-level Principles on Artificial Intelligence?

• Principle 1 (governance): the board and senior management remain accountable for all AI-driven decisions and must put a proper governance framework and risk management measures in place; roles of the three lines of defence in developing and monitoring AI must be clearly defined.
• Principles 2 to 8 (application design and development): sufficient expertise (2), appropriate explainability with "no black-box excuse" (3), data of good quality (4), rigorous model validation before deployment, preferably with an independent party (5), auditability through audit logs and documentation (6), management oversight of third-party vendors (7), and being ethical, fair and transparent (8).
• Principle 8 expects banks to ensure AI-driven decisions do not discriminate or show unintentional bias against any group of consumers, and to tell consumers before service provision that a service is powered by AI technology and of the risks involved.
• Principles 9 to 12 (on-going monitoring and maintenance): periodic reviews and on-going monitoring, including re-validation where appropriate (9), compliance with data protection requirements including the Personal Data (Privacy) Ordinance (10), effective cybersecurity measures against threats such as data poisoning and adversarial attacks (11), and risk mitigation and contingency plans (12).
• Principle 12 gives examples of mitigating controls (human-in-the-loop mechanism, prudent risk limits, sample quality assurance checks) and requires contingency measures that can promptly suspend AI applications and trigger fall-back procedures such as human intervention or conventional processes.
• The principles are high-level because the HKMA is mindful that overly prescriptive or rigid requirements may inhibit further development of AI-related technologies; banks may apply them in a proportionate manner.
• The HKMA said it would keep the principles under periodic review and plans to issue separate guidance on consumer protection in AI use, which followed in the circular of 5 November 2019.
• The letter was signed by Raymond Chan, Executive Director (Banking Supervision), and refers to a Q3 2019 survey showing AI use spreading from chatbots and personalised marketing to operational automation, cyber and fraud risk management.

What did HKMA High-level Principles on Artificial Intelligence change for banks?

The letter gave the HKMA a single reference text on AI risk management for banks, issued after its Q3 2019 survey of AI use. It is the baseline to which the HKMA's later circulars on generative AI, AML monitoring and the GenA.I. Sandbox point.

What do the HKMA's High-level Principles on Artificial Intelligence require of banks?

The HKMA's circular of 1 November 2019 sets out 12 high-level principles that banks are expected to take into account when designing and adopting AI and big data analytics applications. They cover governance (board and senior management stay accountable for AI-driven decisions), application design and development (expertise, explainability, data quality, model validation, auditability, vendor oversight and fairness) and on-going monitoring and maintenance (periodic review, data protection, cybersecurity and contingency plans). The principles are proportionate: banks apply them according to the nature of their AI applications and the level of risk, and the HKMA chose a high-level form so as not to inhibit AI-related technologies. They remain the HKMA's reference text for risk management of AI, including generative AI, which the HKMA's 19 August 2024 circular points back to.

The letter sits at the front of a small set of HKMA instruments. The consumer-protection circular of 5 November 2019 expands the transparency, fairness and data-privacy aspects for customer-facing big data analytics and AI, and the circular of 19 August 2024 extends both to generative AI. The AML circular of 9 September 2024 cites the 2019 principles when asking banks to consider AI in ML/TF monitoring.

The HKMA supervises these expectations through its ordinary banking supervision and, for innovation, through engagement: the GenA.I. Sandbox gives banks targeted supervisory feedback on AI pilots, and the HKMA has said it will consider the need for further guidance based on Sandbox trials. The letter itself states no penalty or reporting deadline.

WHAT THIS MEANS IN PRACTICE

• Map every AI and machine learning application, including vendor-supplied ones, to the 12 principles and record the proportionality judgement for each.
• Name accountable board and senior management owners for AI outcomes and document how the three lines of defence split development, validation and monitoring.
• Build audit logs, documentation, data quality metrics and independent validation into the design phase, not after go-live.
• Tell customers before service provision when a service is powered by AI, and keep a tested switch-off and fall-back route for each AI application.
• Include AI-specific attack scenarios (data poisoning, adversarial inputs) in cyber testing and vendor due diligence.