HKMA AI Model Risk Management: Supervisory Policy Manual CR-G-14 and AI Governance for Hong Kong Banks

Hong Kong banks looking for a single rulebook that governs AI model risk the way SR 11-7 or PRA SS1/23 do in other jurisdictions will not find one. That matters for how you build your compliance program: you are assembling evidence against a set of supervisory expectations spread across several documents, not checking boxes against one numbered module.

HKMA has deliberately not issued a single AI-specific rulebook the way some regulators have. Instead, it treats AI and ML models as a category within its existing model and technology risk supervision, and fills gaps with targeted circulars as new AI use cases emerge — generative AI chatbots, agentic systems, AML screening models. Examiners we've seen in the region apply the same underlying tests regardless of which document they cite: is there a complete inventory, is validation independent, and does the board actually see model risk reporting that means something.

The HKMA's November 2019 circular, "High-level Principles on Artificial Intelligence," is the foundational document. It sets out four principle areas — governance and accountability, fairness, transparency and disclosure, and data privacy and protection — and expects the board and senior management to remain accountable for every AI-driven decision regardless of how the model was built or who built it. HKMA has since extended practical guidance through the GenA.I. Sandbox, run jointly with Cyberport, which lets banks trial generative AI use cases in a supervised technical environment before full production rollout. Ten banks and four technology partners made up the Sandbox's first cohort in December 2024, with a second cohort following in 2025.

For banks running significant operations across Hong Kong, Singapore, Australia, and India, HKMA's expectations sit alongside MAS (FEAT principles plus the March 2026 ABS Handbook), APRA (CPS 230), and RBI (FREE-AI). The practical question for a regional CRO is not which framework is "strictest" on paper — it's which one will actually get tested at your next on-site exam, and HKMA's examiners have been probing AI governance since 2023.

Six Governance Obligations HKMA Examiners Actually Test

Model Inventory Completeness

Every AI model touching a Hong Kong-regulated bank's operations belongs in a model inventory — not just customer-facing models, and not just the ones the business unit remembers to register. Internal risk models (stress testing, credit portfolio, operational risk) are in scope alongside chatbots and credit scoring engines. Composite AI pipelines — a chain of models and rule layers producing one output — must be inventoried as a system, not just as separate components.

HKMA's examination approach leans hard on completeness. A bank with beautifully documented models but an incomplete inventory still gets a governance finding, because the inventory gap itself is the risk: you cannot validate, monitor, or report on a model you haven't registered. We've seen banks get tripped up specifically on shadow deployments — a vendor's embedded scoring model inside a KYC tool that nobody classified as "AI" until an examiner asked.

Risk Tiering by Consequence, Not by Technology

Risk classification has to reflect the model's role in consequential decisions — credit, pricing, compliance, AML screening — the degree of automation versus human review, the volume of decisions it drives, and for newer AI types, its opacity. A black-box model making millions of retail credit decisions carries materially higher systemic risk than the same architecture applied to a small commercial book, and your tiering should say so explicitly. High-risk models earn tighter validation cycles, more frequent monitoring, and board-level visibility.

Documentation That Survives an Independent Reviewer

For AI models, documentation has to cover the training dataset (source, date, size, representativeness), the architecture and why it was chosen, the training methodology and hyperparameters, and the evaluation methodology with its metrics. For models built on third-party foundation models or transfer learning — which now means most generative AI deployments — the bank must document the upstream model's training data, evaluation, and known limitations, even when the vendor built it. That obligation does not disappear because you bought the model instead of building it; it just means your vendor contracts need a documentation clause, not a shrug.

Independent Validation With Real Teeth

Validators must sit outside the development reporting line and have standing authority to block a model from going live if validation turns up unresolved risk. For AI specifically, validation scope must cover data quality and representativeness, out-of-sample performance, robustness across subpopulations and under distribution shift, and — for models feeding regulated decisions — fairness testing across protected characteristics. HKMA expects written findings with remediation tracked to closure before production, not a verbal sign-off in a committee meeting that nobody wrote down.

Limits of Use That Are Actually Enforced

A model validated for Hong Kong retail credit scoring using Hong Kong property data should not quietly migrate into commercial lending or into a different market without revalidation. HKMA's exam approach specifically tests whether limits of use are documented, enforced in production, and monitored — not just written down once and forgotten. For autonomous AI systems, this extends to defining exactly what the system can decide on its own versus what must escalate to a human, in writing, before deployment.

Monitoring and Board Reporting Calibrated to Risk

High-risk AI models need daily or weekly performance monitoring; lower-risk models can run on a quarterly cadence. Monitoring for AI specifically needs to catch distribution shift before performance degrades past acceptable thresholds, not after. Board and senior management reporting should cover inventory changes, validation status, material issues and remediation, and forward-looking risk from planned deployments — and for generative AI, hallucination rate and compliance violation trends belong in that report too.

Three questions settle most HKMA AI governance exams: is the inventory complete, do high-risk models have independent validation with remediation tracked, and does senior management actually see model risk reporting on a regular cycle. Banks that cannot answer yes to all three walk into a compliance gap the examination will find for them.

APAC Model Risk Comparison at a Glance

India Banks Operating in Hong Kong: Dual-Jurisdiction Reality

State Bank of India, ICICI Bank, HDFC Bank, Bank of India, Bank of Baroda, Canara Bank, and Indian Overseas Bank all run Hong Kong entities under HKMA authorization. Each one is on the hook for its own Hong Kong AI governance — the India parent's model risk program does not substitute for it. HKMA's supervisory approach is entity-level, full stop.

That creates a specific, recurring problem for India banks that build AI models centrally and roll them out across geographies including Hong Kong. Using a group model in Hong Kong requires the local entity to register it in its own inventory, confirm it was validated for Hong Kong's data and regulatory context (India validation does not carry over), assign a named owner inside the Hong Kong entity rather than solely in India, and run Hong Kong-specific performance monitoring. In practice, this means India technology teams building AI for multiple APAC geographies should document to the toughest jurisdiction's standard from day one — which for model risk purposes is HKMA or MAS — rather than retrofitting documentation market by market after the fact.

Structurally, FREE-AI's sutras and HKMA's governance expectations point the same direction — fairness testing, performance monitoring, documented decision logic, named accountability. A governance program built to satisfy HKMA's more prescriptive validation, documentation, and monitoring expectations will, in practice, cover FREE-AI's principles too. India banks with Hong Kong operations are better served using HKMA's stricter requirements as the implementation template and checking FREE-AI alignment against that baseline, rather than running two parallel governance programs.

What to Do About It

• Pull your AI model inventory and confirm it covers internal risk models and vendor-embedded models, not just customer-facing ones — this is the single most common examination finding.
• Map each Hong Kong AI deployment's "limits of use" documentation against what it is actually doing in production today, not what it was approved to do at launch.
• For any group model shared from an India (or other) parent, confirm the Hong Kong entity has its own named owner, its own validation record for Hong Kong data, and its own monitoring — not a inherited sign-off.
• Add an AIBOM-style documentation clause to AI vendor contracts covering upstream foundation-model training data and known limitations before renewal.
• Bring hallucination rate and compliance-violation trend data into board-level model risk reporting now, ahead of your next exam cycle.

Zytra's governance platform produces the model inventory, risk tiering documentation, validation tracking, and monitoring evidence that HKMA examination requires — for Hong Kong entities and their India, Singapore, and Australia counterparts in one governance program.

Talk to sales