How the HKMA’s AI Circulars Turn Transaction Monitoring Model Governance Into a Board Question

HKMA AI transaction monitoring policy now sits in a short sequence of documents: a circular of 9 September 2024, a circular of 19 November 2025 and a report sent to banks on 22 June 2026. Read together, they show a regulator that backs AI in anti-money laundering monitoring and, in the same breath, puts accountability for it on senior management and Boards.

The documents do not require every bank to deploy AI by a set date. They ask banks to study the question, plan for it, report progress and, in the words of the June 2026 report, be able to explain and govern what they deploy. That moves the question for a risk leader from which model to buy to who owns it.

This article follows the documents in order, separates what banks were asked to do from what Boards must be able to show, and sets out a governance map that applies to fraud and anti-money laundering teams alike.

The HKMA moved from asking banks to study AI in 2024, to tracking adoption in 2025, to describing in 2026 the governance Boards must be able to evidence.

What the HKMA has asked banks to do

The HKMA’s thematic review of transaction monitoring systems, shared with banks on 17 April 2024, already expected them to optimise monitoring performance with regard to their size, business scope and ML/TF risks. It covered governance and oversight, data quality, detection scenarios, threshold setting and periodic review, and included how banks use AI. The circular of 9 September 2024 then asked banks with significant operations in Hong Kong to study AI in their monitoring systems and to prepare implementation plans based on the result.

By the circular of 19 November 2025, 48 authorized institutions had assessed feasibility. The HKMA reported that more than 30% had already adopted AI in their monitoring systems and that, on the timelines banks gave, adoption would pass 80% over the following 12 to 24 months. Use cases were concentrated in risk detection and alert prioritisation, which the HKMA read as scope for broader and deeper adoption. It said it would keep tracking progress against the submitted plans and keep the effectiveness of banks’ monitoring systems under regular review.

The circular of 22 June 2026 shared a report with four case studies, announced a second workshop on agentic AI for 23 June 2026 and reminded banks with significant Hong Kong operations that their plans should be kept under review, with progress and new use cases reported when called for.

Where accountability sits when a model influences a decision

The June 2026 report is direct. Where AI systems influence risk assessments or decision pathways, it says, responsibility remains with senior management and Boards, technology does not replace governance, and institutions must be able to explain how models operate, how outcomes are validated and how risks such as bias, drift or over-reliance are managed. Supervisory tolerance for experimentation exists within well-defined guardrails, not outside them.

It also says that over the next 24 months Boards and senior management are expected to demonstrate progress across the HKMA’s supervisory priorities, anchored to each institution’s plan. That is the closest any of the documents comes to a deadline, and it is a deadline for evidence rather than for deployment.

One statement in the report frames the gap. It says that while more than half of financial institutions report AI deployment within risk functions, fewer than one third operate fully integrated model governance frameworks across lines of defence. The report does not name the source of that figure, so it is best read as the HKMA’s characterisation of the problem rather than a measured Hong Kong rate.

Holistic architecture or building blocks

The November 2025 circular describes two routes. Some banks replaced reliance on rules-based monitoring with a holistic approach that rebuilds the data structure and applies advanced analytics to a wider range of customer and transaction data. Others adopt AI as building blocks, adding use cases that make existing processes more effective. The June 2026 report says banks should not adopt AI for its own sake, that early initiatives have mostly been point solutions, and that building-block work should feed an enterprise blueprint designed from data ingestion to alert disposition.

The report’s four case studies show how different the routes are. The outcomes below are as reported by the banks in the HKMA publication and have not been independently verified.

Four governance controls the report points to

The report says Boards should expect clear evidence that AI improves detection while reducing unnecessary alerts, accelerates investigations without compromising judgement and prioritises genuinely higher-risk activity. Its call to action then lists four things institutions should do. The report does not present them as legal rules, and each can be tested by a Board or an internal audit team.

Why one model estate serves fraud and AML teams

Two of the report’s cases concern money mules, and mule networks sit across payment fraud and money laundering. In the large-bank case, a business-led team drew in AML, fraud, data and technology staff, used prevention tools to freeze payments in near real time with investigation teams in support, and could respond to a high risk score or a typology match with a due diligence review, an unusual activity report or payment controls. The report says business and risk colleagues validated the model outcomes for explainability and that the models were subject to formal model governance.

The practical point for a group is that a model scoring a customer for mule risk is a fraud model and an AML model at once. Whoever owns it needs authority over both uses.

How Nexiant supports governed AI in monitoring

FraudShield, Nexiant’s specialist transaction-monitoring brand, is built around real-time detection, configurable rule logic and case-management workflows. For a bank answering the HKMA’s questions, the useful tests of any monitoring capability are whether rules and model outputs sit in one case record, whether a score change can be traced to a reason, and whether analysts can record why they overrode an alert. Nexiant brings these questions together across fraud and anti-money laundering as a design discipline, not as a claim about one integrated system.

Frequently Asked Questions

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.