SFC Large Firm AI Survey: Three Talking Points for Landing Agentic AI
Before clients ask what peers are doing, align on the SFC’s published figures and supervisory line: safety-first, accountability anchored in people, controls proportionate to permissions.
When serving Hong Kong financial clients, the question you hear most often is not “how strong is the model?” but “how far along are peers—and how does the regulator see it?” Clients want real cases, not rumour.
Before the SFC published its survey, those conversations drifted easily into hearsay. On 2 November 2026 the Securities and Futures Commission released its first Large Firm AI Readiness Survey (26PR182), setting out both “how far along” and “how the regulator sees it.” This article summarises only figures and policy already stated in the official release—and turns them into three talking points for client meetings. It is not another product deck.
Align on the official numbers (read sample and limits together)
The survey ran July–August 2026 and covered 20 large financial institutions and 78 affiliated Hong Kong licensed corporations. Affiliated corporations’ securities turnover accounted for over 75% of all licensed corporations’ reported securities turnover in the six months to 30 June 2026. The SFC also notes that responses were consolidated at the institution level; reported capabilities may not apply to every affiliated entity or business line, and results must not be taken as representative of all SFC licensees.
Figures in the press release that relate directly to agentic AI include:
- 30% of surveyed institutions already apply agentic AI in business operations; 25% are piloting (with varying degrees of autonomy and human involvement).
- 95% expect to accelerate AI use in the next 12 months.
- 90% have connected AI tools to internal systems.
- 90% are adopting or evaluating frontier AI models for cyber defence.
The report further states that six institutions allow agentic AI in live production and five allow it in controlled pilots or tests—a total of 11 (55%); the remaining nine are still developing or considering use cases. That matches the press release’s “30% in use, 25% piloting” (6/20 = 30%, 5/20 = 25%).
Use cases cited include data retrieval, content drafting, software development, operational workflows, and some trading-related activities. Scaling challenges include technical integration, moving pilots into production, cost and business-value uncertainty, data constraints, and skills gaps.
Numbers answer “how far peers have got”; whether deployment can proceed depends on how supervision is written.
Supervisory line: safety-first, accountability anchored in people, proportionate controls
The SFC’s approach is safety-first, human-anchored, collaboration-led. Dr Ringo Ip, Executive Director (Intermediaries), stressed that as AI autonomy rises, human primacy must not be undermined; scaling requires not only strong models and promising use cases, but reliable infrastructure, sound data, appropriate expertise, and governance that keeps pace with technology.
The closing paragraphs of the release are especially useful in client dialogue. The SFC will focus on ensuring accountability remains with people throughout AI-enabled business processes, including:
- clear objectives;
- explicit scope for data access and authorised actions;
- effective monitoring and intervention; and
- controls proportionate to an application’s authority and potential impact—not human approval of every output or action.
That turns “human in the loop” from a slogan into a design rule: not a manual trigger on every step, but the higher the authority and impact, the more proportionate the control.
Three talking points: permission table, accountability chain, proportionality
We often structure client conversations around three items drawn from the release:
1. Permission table
Document first: which data and tools can the agent or system access? Which actions are authorised? Who approves expansion of scope? The SFC highlights “clear scope for data access and authorised actions”—for financial clients this often gates production readiness earlier than model choice.
2. Accountability chain
“Accountability remains with people” is not abstract. Specify who sets objectives, who monitors day to day, who intervenes on anomalies, and which roles bear responsibility if something goes wrong. Agentic AI can execute multiple steps autonomously; a blurred accountability chain rarely survives the move from pilot to production.
3. Proportionality
Controls should match authority and potential impact—not require human sign-off on every output. Low-impact, reversible actions can be more automated; high-impact, irreversible, or client- and trading-related actions need clear intervention points. Calibrate proportionality so pilots do not stall and risk windows do not widen.
These three points reflect published SFC policy. Dynatech’s Forward Deployed Engineering (FDE) likewise emphasises human-led, AI-driven work: people set boundaries and accountability; agents operate within authorisation—aligned with safety-first, human accountability, while concrete control design still depends on your business and applicable regulation.
Discussing enterprise practice and AI adoption
If your organisation is evaluating agentic AI and wants a conversation framework for permissions, accountability, and proportionate controls, we welcome a short briefing.
You can also reach us on WhatsApp +852 7040 2206 or email info@dynatech.com.hk.
References
