AI Regulation Tracker / Signal
Hong Kong Expands Its Generative AI Sandbox Across Four Financial Regulators
On March 5, 2026, four Hong Kong financial regulators, the HKMA, SFC, Insurance Authority, and MPFA, joined with Cyberport to launch GenA.I. Sandbox++, expanding an AI testing program that had covered only banks to firms across securities, asset and wealth management, insurance, and MPF. It is a supervised testing program, not a new rule.
On March 5, 2026, four of Hong Kong's financial regulators put their names to the same announcement, which does not happen often. The Hong Kong Monetary Authority, the Securities and Futures Commission, the Insurance Authority, and the Mandatory Provident Fund Schemes Authority, working with Hong Kong Cyberport, said they were launching an expanded version of the city's generative-AI sandbox and calling it GenA.I. Sandbox++.
The idea behind a sandbox is simple. It is a supervised space where a firm can build and pilot an AI use case with the regulator watching and helping, rather than shipping it live and hoping the supervisory questions come later. The HKMA started running one for banks in 2024. What changed in March is the reach.
What actually expanded
The original sandbox was a banking program. GenA.I. Sandbox++ opens the same kind of supervised testing to firms across the rest of the financial system: securities and capital markets, asset and wealth management, insurance, the MPF pension system, and stored value facilities. That is the whole point of the four-regulator setup. Each authority supervises a different slice of the market, so covering the market meant getting all four to sign the same circular.
The regulators kept the focus tight. The program centers on a short list of high-impact areas: risk management, anti-fraud, and customer experience, plus what the announcement frames as using AI to manage AI-related risks. Participants get supervisory guidance as they build, technical support, and free access to GPU computing at Cyberport's AI Supercomputing Centre, which lowers the cost of actually running the models.
The HKMA's chief executive, Eddie Yue, tied the move to the city's longer-term plan. In the announcement he said, "The launch of the GenA.I. Sandbox++ marks a significant milestone under our 'Fintech 2030' strategy." The SFC's chief executive, Julia Leung, put the pitch to firms plainly: "We encourage licensed corporations to actively participate in this Sandbox to harness the boundless potential of A.I."
What this is, and what it is not
I want to be precise, because a four-regulator announcement can read heavier than it is.
This is a program, not a rule. GenA.I. Sandbox++ does not impose an AI disclosure requirement, a control standard, or a filing duty on anyone. A Hong Kong firm that never applies to the sandbox has no new obligation because this launched. Nothing in the existing rulebook changed on March 5. What the regulators created is an invitation and a facility: come test your AI use case in here, with our guidance and our GPUs, instead of out there on your own.
What it signals is a supervisory posture. When four authorities coordinate to build a shared testing lane rather than issue a shared prohibition, they are telling the market they intend to supervise AI adoption up close and encourage it in bounded ways. That is the useful read. It is a direction of travel, not a duty you are required to follow.
It also matters that this is voluntary and sector-specific. The regulators are not certifying that any AI use case is safe or approved. They are offering a controlled place to find out, and keeping the risk questions, data quality, governance, model oversight, close to the work while it happens.
What this means for US firms in Hong Kong
The Insurance Authority and the MPFA are not US regulators, and this program carries no weight over US filings or US operations. But Hong Kong is one of the largest financial hubs in Asia, and plenty of US banks, asset managers, and insurers run regulated operations or subsidiaries there. For them the sandbox is not abstract.
If you have a Hong Kong-regulated entity, this is a live channel to test an AI use case with the local supervisor in the room, on subsidized compute, before you deploy it into a market where four regulators have just said they are paying attention to AI. That is worth knowing whether or not you apply. Even if you do not, the posture is a useful benchmark. A serious APAC hub has chosen supervised experimentation over restriction, concentrated on risk management, anti-fraud, and customer experience, and built the machinery to watch AI adoption sector by sector.
The through-line is governance, same as everywhere else. A sandbox lowers the cost of testing, but it does not answer the questions your own controls have to answer: where did the data come from, who reviews the model's output, and can you show your work if a US or Hong Kong examiner asks. The program gives firms a place to work those questions out with a supervisor. It does not settle them for you.
What to do now
Read the announcement for what it is, a supervised testing program that now spans four sectors, not a new rule that binds Hong Kong firms. If you run a Hong Kong-regulated entity, check whether an AI use case you are already planning fits the sandbox's focus areas and whether the application window is still open before you decide. Keep a named person accountable for any AI system you pilot, in the sandbox or outside it. Write down your governance answers, data provenance, review steps, and sign-off, before you need them. And do not treat participation, or the program itself, as regulatory approval of any particular AI use. It is a place to test under supervision, nothing more and nothing less.
Questions professionals are asking
Which regulators launched the GenA.I. Sandbox++?
Four Hong Kong financial regulators launched it jointly on March 5, 2026: the Hong Kong Monetary Authority, the Securities and Futures Commission, the Insurance Authority, and the Mandatory Provident Fund Schemes Authority, in collaboration with Hong Kong Cyberport Management Company Limited.
Is this a new AI rule for Hong Kong firms?
No. It is a voluntary supervised testing program, not a rule, standard, or filing requirement. It expands where firms can test AI use cases under supervision. It does not create, change, or remove any legal duty for firms that do not take part.
What changed compared with the earlier sandbox?
The generative-AI sandbox that the HKMA ran for banks in 2024 now reaches the rest of the financial system: securities and capital markets, asset and wealth management, insurance, MPF, and stored value facilities. The focus stays on risk management, anti-fraud, and customer experience, with technical support and free GPU computing at Cyberport's AI Supercomputing Centre.
Does this affect US financial firms?
Not directly. These are Hong Kong regulators and the program carries no authority over US filings or operations. But US banks, asset managers, and insurers with Hong Kong-regulated entities can use the sandbox to test AI use cases with the local supervisor, and everyone else can read it as a benchmark on how a major APAC hub is supervising AI.
Does joining the sandbox mean the regulators approve your AI use case?
No. The sandbox is a controlled place to test with supervisory guidance. It is not a certification that a use case is safe or approved. Your own governance, data quality, model oversight, and sign-off, still has to hold up on its own terms.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal, accounting, or audit advice. Confirm how any program or requirement applies to your situation with qualified professionals in the relevant jurisdiction.