AI Regulation Tracker / Financial services

HKMA Tells Banks a Human Must Stay in the Loop on Customer-Facing GenAI

In a circular issued August 19, 2024, the Hong Kong Monetary Authority set out consumer-protection principles for generative AI in customer-facing banking. Institutions must let customers opt out of GenAI and request human intervention, and must keep a human in control of decisions. It remains the operative supervisory expectation in 2026.

By Anthony Guerriero · The Leveraged Years Regulatory Research · Published July 21, 2026 · Last updated July 21, 2026

The short version

On August 19, 2024, the Hong Kong Monetary Authority issued a circular on consumer protection in the use of generative AI, addressed to all authorized institutions. It builds on the 2019 Big Data Analytics and AI guiding principles and adds expectations for GenAI used in customer-facing applications such as chatbots and robo-advisors. Two requirements stand out. Customers must be able to opt out of GenAI and ask for a human, and banks must keep a human in the loop with real control over decisions. This is a supervisory circular, not primary legislation, but the HKMA expects every authorized institution to follow it, which makes it effectively binding on the banks it covers. It is not new for 2026, but it is still the live standard, and any US bank or financial group running consumer GenAI through a Hong Kong authorized institution is inside its scope.

Regulatory Briefing

Instrument: HKMA circular, Consumer Protection in respect of Use of Generative Artificial Intelligence
Authority: Hong Kong Monetary Authority (HKMA), addressed to all authorized institutions
Jurisdiction: Hong Kong; applies to authorized institutions supervised by the HKMA, including local subsidiaries and branches of foreign banking groups
Bindingness: Supervisory circular and guiding principles. Not primary legislation, but the HKMA expects all authorized institutions to follow and extend it, so it operates as an effectively binding supervisory expectation for the banks it covers.
What Changed: GenAI in customer-facing banking now carries explicit HKMA expectations on governance and accountability, fairness, transparency and disclosure, and data privacy, including opt-out, human intervention, and human-in-the-loop control.
Who This Affects: Authorized institutions using GenAI in chatbots, product and service delivery, targeted sales and marketing, and robo-advisory, and the compliance, risk, and technology teams that support them.
Effective: Issued August 19, 2024, and in force as an ongoing supervisory expectation.
Primary Source: HKMA regulatory index, Consumer Protection in respect of Use of Generative Artificial Intelligence, brdr.hkma.gov.hk
Last Verified: July 21, 2026

Hong Kong did not wait for a general AI law to tell banks how to use generative AI with their customers. The Hong Kong Monetary Authority issued a circular on August 19, 2024, addressed to every authorized institution, setting out how consumer protection has to work when a bank puts GenAI in front of the people it serves. It sits on top of the 2019 guiding principles on Big Data Analytics and AI, and it extends that framework to the newer and messier problem of generative models that produce fluent output which can be wrong.

The circular groups its expectations under four familiar headings: governance and accountability, fairness, transparency and disclosure, and data privacy and protection. What gives it teeth is the specific customer-facing conduct it calls for. The HKMA is direct that a person has to remain in charge. In its words, banks should adopt a "human-in-the-loop" approach, "with a human retaining control in the decision-making process." That single phrase settles the design question for any bank tempted to let a model run customer decisions end to end. It cannot.

What does the circular require banks to do?

The headline obligation for anyone building customer-facing GenAI is choice. The circular states that "during the early stage of deployment, customers are provided with the option to opt out of using GenAI and request human intervention for decisions generated by GenAI, at their discretion as far as practicable." Read that plainly. A customer who does not want to be handled by a generative model should be able to say so and reach a human. Beyond that, banks are expected to validate their GenAI models properly, monitor outputs on an ongoing basis to catch harmful or misleading results, and keep governance and accountability clear so that responsibility for a GenAI decision always lands on a named part of the institution rather than on the model.

The applications the HKMA has in mind are the obvious ones. Customer chatbots, the design and delivery of personalized products, targeted sales and marketing, and robo-advisory in wealth and insurance. These are exactly the areas where a persuasive but wrong answer can cost a customer money or push an unsuitable product, which is why the regulator wants a human check available and a monitoring loop running behind the automation.

Is this circular binding, and is it new?

Be precise on both points, because they are easy to overstate. On bindingness, this is a supervisory circular and a set of guiding principles, not an ordinance passed by the legislature. It does not read like a statute with its own penalty clause. But the HKMA supervises authorized institutions, and it expects all of them to follow and extend these principles. In the supervisory world that is not a suggestion. An authorized institution that ignored it would be answering to its regulator, so for the banks in scope the practical effect is binding. On timing, this is not a fresh 2026 development. The circular dates to August 2024. We track it here because it remains the operative standard, GenAI adoption in banking has only accelerated since, and a lot of US professionals still have not mapped their Hong Kong operations against it.

What US financial professionals should take from it

If you advise or operate a US banking or wealth group that runs a Hong Kong authorized institution, this circular already applies to your consumer GenAI there, and you should confirm three things. First, that customers of the Hong Kong entity can opt out of GenAI and reach a human on decisions that affect them. Second, that a human genuinely retains control in the decision loop rather than rubber-stamping model output. Third, that you have documented validation and ongoing monitoring of the models, with clear accountability inside the institution. More broadly, treat Hong Kong as a preview. The combination of opt-out, human intervention, and human-in-the-loop control is becoming the common shape of financial-services GenAI supervision across markets, and a control framework built to satisfy the HKMA will travel well when the next regulator asks the same questions.

Questions professionals are asking

Is the HKMA GenAI circular legally binding?

It is a supervisory circular and set of guiding principles, not primary legislation with its own penalty clause. But the HKMA expects all authorized institutions to follow and extend it, and it supervises those institutions, so in practice it operates as an effectively binding expectation for the banks it covers. Ignoring it would put an authorized institution at odds with its regulator.

Do banks have to let customers avoid GenAI?

Yes, as far as practicable. The circular says customers should be provided with the option to opt out of using GenAI and request human intervention for decisions generated by GenAI, at their discretion. In customer-facing applications a person should be able to decline GenAI handling and reach a human on decisions that affect them.

What does human-in-the-loop mean here?

The circular calls for a human-in-the-loop approach with a human retaining control in the decision-making process. A bank cannot let a generative model run customer decisions end to end. A person must stay in the loop with genuine control, supported by proper model validation and ongoing monitoring of outputs to catch harmful or misleading results.

Does this affect US banks?

It affects US banking and wealth groups that operate through a Hong Kong authorized institution, because the circular applies to those institutions. Consumer GenAI run through the Hong Kong entity should already meet the opt-out, human-intervention, and human-in-the-loop expectations. It also previews where financial-services GenAI supervision is heading in other markets.

RELATED BRIEFINGS

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how HKMA supervisory expectations apply to your institution with qualified Hong Kong financial-services counsel.