After HKMA’s ART Framework: What Banks Need Before Deploying Agentic AI
The more an agent can plan automatically, the clearer people must write intent and stop conditions first.
On 15 October 2026, the Hong Kong Monetary Authority (HKMA) published the ART framework and, at the Finance + A.I. Forum co-hosted with Cyberport, marked the successful close of technical testing for the second cohort of the GenA.I. Sandbox. Public figures show that more than 60% of use cases explored agentic A.I.—systems that can plan automatically and execute multi-step tasks within authorised, controlled scope.
HKMA Deputy Chief Executive Arthur Yuen noted that the shift from generative to agentic A.I. is an important new stage for banking innovation. Under Fintech 2030, ART aims to give banks a clear basis for responsible development and deployment of A.I. For mid-sized banks and finance teams, this is not about buying another model licence—it is about testing AI Agent governance in real work.
The three pillars of ART: Accountability, Resilience, Trust
ART stands for Accountability, Resilience, and Trust.
Accountability: When an Agent plans steps, calls tools, or touches customer and transaction flows, you must be able to answer: Who approved the intent and scope? Who is responsible if something goes wrong? Can audit reconstruct the decision chain? This aligns with intent-anchored accountability—responsibility is anchored in the intent people set.
Resilience: Agentic systems connect more data, tools, and operating processes. Resilience is not only hardware. It also means you can change permissions and processes, handle and isolate anomalies, and keep operations running even when an Agent drifts.
Trust: Trust comes from verifiable behavioural boundaries: how data is used, whether outputs can be reviewed, and whether external commitments still sit with people. HKMA has updated its supervisory guidance on responsible adoption of artificial intelligence, and is working with Cyberport and the University of Hong Kong on a training-data sharing platform centred on data quality.
Takeaways for teams planning to use AI Agents
Permissions and scope: Under what identity does the Agent operate? What is the minimum privilege? Draw a clear line between “run automatically” and “must involve a person.”
Audit trail: Trace every plan step, tool call, and result, and assign people to review both outcomes and process.
Human oversight and stop conditions: Judgement, customer management, and other high-risk actions should stay under human control. Write clearly when people intervene, change, or stop the flow.
Privacy and data integrity: Customer and operating data must follow the institution’s existing privacy and data policies. HKMA stresses data quality first—if the input is incomplete, generation and results will not be good either.
Forward deployment: embed governance in the workflow
Dynatech’s stance is Human-led, AI-driven: people own intent, judgement, and stop conditions; AI accelerates repetitive and multi-step work. We do not lead with tool licences. We lead with Forward Deployment (FDE)—people on site, installing Agents, Skills, and workflows with business, compliance, and IT, and writing permissions, audit, and intervention into the design stage.
Start with one controllable process; jointly define intent, authorisation, and human review points; leave an auditable trail on the existing workflow; then distill skills and roles the organisation can reuse. Training can support this; the spine is still deployment.
The more an agent can plan automatically, the clearer people must write intent and stop conditions—two sides of the same ART coin.
If your organisation is evaluating AI Agents in real workflows, we welcome a short consultation.
References
- HKMA announces the ART framework to promote responsible adoption of A.I. in banking (15 Oct 2026)
- First cohort of GenA.I. Sandbox++ (27 Aug 2026; 36 use cases, 30 financial institutions, 27 technology partners)
