Hong Kong is putting the governance of financial AI agents on its fintech agenda. The Hong Kong Monetary Authority announced Project SAGE on November 2, alongside an expert group and a discussion paper for banks. The initiative raises a practical question for increasingly automated finance: who remains accountable when software can take actions, rather than simply recommend them?
TL;DR
- Financial agents need clearly bounded authority.
- Governance must remain effective when a task crosses several tools.
- A useful control must constrain actions as well as explain decisions.
A mandate needs an enforceable boundary
An agent that summarises an account statement operates within a fairly narrow task. One that changes payment instructions, selects a counterparty or submits a transaction has a different kind of authority. The relevant distinction is what the surrounding system permits the software to change, not how confidently the model describes its intentions.
For a hypothetical corporate payment assistant, a useful mandate might identify permitted beneficiaries, maximum amounts and the period during which access remains active. These are separate decisions. A small payment to an unapproved destination can be unacceptable even when it sits comfortably inside an overall budget.
That suggests governance should be examined at the point where an action becomes binding. A dashboard warning after settlement is valuable for investigation, but it cannot provide the same protection as a permission check before execution. The design question is where that check runs and who can override it.
Supervision must survive a chain of tools
The HKMA had already published an October concept note on agentic-AI governance. SAGE extends the public discussion around how the industry should explore these applications. Its announcement describes an enabling and supervisory initiative; it does not certify a particular agent, trading strategy or payment product as safe.
The difficulty becomes clearer when a task crosses several services. An assistant might read an invoice, use another service to verify bank details, ask a second model to assess an exception and finally call a payment API. Each step can be legitimate in isolation while the combined result exceeds the original instruction.
A control framework therefore needs to preserve the original mandate through delegation. If the first agent cannot change a beneficiary, handing the work to another agent should not create that power. The same principle applies when software retries a failed task or resumes after an interruption.
An audit trail needs the decision context
Recording the final transfer proves that money moved. It does not, by itself, explain which instruction authorised the movement or whether the information used to make it was accurate. An investigation would need the approved mandate, the relevant inputs, the policy version and the identity of any human who approved an exception.
Blockchain records can contribute a shared history for onchain actions, but the record is only as informative as the events captured. If an agent reads a forged invoice outside the chain, a perfectly valid settlement transaction cannot establish that the invoice represented a genuine obligation.
For developers, this creates a case for connecting business records with execution records. The association should be specific enough to investigate a disputed action without unnecessarily exposing confidential customer information. A permanent public log and an unrestricted public disclosure are different design choices.
Adoption will depend on measurable controls
The strongest evidence of a functioning system would include how it handles exceptions: a revoked mandate, an unavailable service, an ambiguous recipient or conflicting instructions. Successful demonstrations of routine tasks reveal much less about the limits that hold when something goes wrong.
Banks and infrastructure providers can evaluate those limits before expanding an agent’s authority. That could mean separating recommendation from execution, testing small permitted actions and requiring additional approval for material changes. These are analytical examples of graduated control, rather than requirements announced for every SAGE participant.
SAGE’s significance is the decision to put governance beside experimentation while financial agents are still being shaped. The outcome to watch is whether that work produces controls institutions can test and operators can enforce, including when an agent’s own reasoning is mistaken.
Written by the News Desk and edited by Samuel Rae.
Leave a Reply