This article is provided for general information and does not constitute legal, regulatory, or compliance advice. It reflects publicly available sources as at 02 October 2026. Supervisory expectations change; institutions should confirm their obligations with their own compliance function and the relevant regulator.
Three weeks ago, Hong Kong's regulators said something specific about where AI in financial services is going. Most of the coverage read it as a milestone announcement. Read as an engineering signal, it is a schedule.
On 27 August 2026, the HKMA, SFC, Insurance Authority and MPFA, with Cyberport, announced the first cohort of the GenA.I. Sandbox++: 36 use cases selected from nearly 100 proposals, involving 30 financial institutions and 27 technology partners. The stated focus of this cohort is agentic AI - systems that take on greater autonomy - tested across end-to-end processes including customer onboarding, payments, insurance claims, and customer interactions.
If your roadmap still treats generative AI as a content-generation feature, that cohort tells you the supervisory conversation has moved on without you.
The direction is clearer from the sequence than from any single announcement.
2024 - Sandbox, banking only. The HKMA launched the GenA.I. Sandbox with Cyberport, focused on banking. The question being answered was feasibility: can generative AI be used in a regulated financial context at all, under observation.
October 2025 - second cohort, wider participation. Twenty banks, 27 use cases, spanning risk, operations and customer-facing workflows, onboarding to Cyberport's Artificial Intelligence Supercomputing Centre with trials commencing in early 2026. The diversity of participants was the point: adoption was no longer confined to the largest institutions.
March 2026 - Sandbox++, cross-regulator. On 5 March the initiative expanded beyond banking to securities and capital markets, asset and wealth management, insurance, MPF and stored value facilities, run jointly by four regulators. Focus areas were stated as risk management, anti-fraud, and customer experience, continuing the "A.I. versus A.I." theme - using AI to defend against AI-enabled threats.
August 2026 - first Sandbox++ cohort, agentic. The shift from content generation to autonomy, explicitly. Selected use cases go beyond generating text to systems that take actions across end-to-end processes.
Two years, four moves, one direction: from can we use this to can we supervise it acting on its own.
A supervisory environment that has moved to agentic testing is telling you what it will be asking about next. Four implications are worth planning against.
A model that drafts a response is evaluated on what it produces. A system that completes an onboarding step, moves a payment, or processes a claim is evaluated on what it did, under what authority, and whether it could have done something else.
That is not a model problem. It is a permissions and orchestration problem, and it usually sits with platform engineering rather than the data science team. Concretely: scoped credentials per task rather than a standing service account, an allow-list of tools the system can invoke, and the ability to answer "what was this system authorised to do on Tuesday" months later.
The cohort's stated scope - onboarding, payments, claims, customer interactions - are precisely the processes that span a core system, a CRM, a document store, a payments rail and a case management tool.
Most institutions can demonstrate control within each of those. Far fewer can reconstruct a single decision path across all five. If an agent touches four systems to complete an onboarding, the audit question is not "did each system log correctly" but "can you show me the sequence". That requires correlation - a shared identifier that travels with the action - and it is far cheaper to add before the integration is built than after.
The anti-fraud framing cuts both ways. If AI is expected to be part of how institutions detect and respond to AI-enabled threats, then AI systems move inside the operational resilience perimeter: monitored, patched, failed over, incident-managed.