A securities regulator has said out loud what most oversight policies quietly assume: nobody will approve every step an agent takes. The SFC’s answer is to move the control from the click to the record.
What happened
Speaking at Hong Kong FinTech Week 2026 on 2 November, Julia Leung, chief executive of the Securities and Futures Commission, said the SFC will provide additional guidance on agentic AI adoption “as appropriate.” Recognising that human review for every intermediate step is unrealistic, the SFC will develop “practical, principles-based guidance” for applications involving greater autonomy, with a focus on “preserving human accountability and oversight throughout the workflow.”
The stated reason is the nature of the technology: agentic AI “can compound errors across multiple steps, take unauthorised actions and disrupt other firms in unintended ways.”
The SFC also sketched an autonomy gradient. Greater autonomy might start with low-impact, reversible workflows such as selected back-office processes and surveillance. Client advice, portfolio decisions and market-facing execution “require progressively stronger safeguards,” and “the degree of autonomy should be commensurate with the risks when it comes to acting on behalf of clients.”
On how to test accountability, Leung pointed to the GenAI Sandbox++ run by Hong Kong’s financial regulators as a venue to explore whether it is possible to “reconstruct a decision, identify the action taken, explain the outcome, and determine accountability when things go wrong.”
The remarks came with survey data. The SFC’s Large Firm AI Readiness Survey covered 20 large financial groups — about 75% of securities turnover and 45% of clients reported by licensed corporations. All were already using AI in research, analytics and back-office support; for agentic AI, more than half were using or piloting it, and 80% expected further adoption over the next 12 months. The SFC also plans a cybersecurity framework with baseline requirements for all licensed firms and enhanced requirements for higher-risk ones.
Why it matters for KYA
“Human in the loop” is being redefined, not abandoned. Regulators spent 2025 writing oversight expectations that assumed a person approves consequential actions. Leung’s remarks accept that at agent speed the per-step approval is a fiction — and that pretending otherwise produces approval theatre rather than control. The replacement test is whether the firm can reconstruct what the agent did, under whose authority, and who is answerable.
Accountability becomes a data problem. “Reconstruct a decision, identify the action taken, explain the outcome, and determine accountability” is an audit-trail specification in one sentence. For KYA that means the identity record, the mandate and the scope must be captured at the time of action and be sufficient to answer those four questions months later — not reconstructed from chat logs.
Autonomy tiers are delegated-authority tiers. Low-impact reversible workflows first, client-facing advice and execution later, with safeguards scaled to risk: that is a supervisory version of scope attenuation. It implies agents get different credentials, different limits and different monitoring depending on what they are allowed to do on whose behalf.
Principles-based means the burden lands on evidence. No draft guidance, thresholds or timetable were published with the speech. Until the SFC issues its guidance, firms have a clear signal of direction and no bright lines — which puts the weight on their own documentation of agent identity, mandate and intervention history.
Caveats
These are panel remarks and an official synopsis, not a consultation paper or a rule. “As appropriate” leaves timing open, and the survey covers 20 large groups, not the whole licensed population. The autonomy gradient is described qualitatively; no thresholds were given. Firms should treat this as supervisory intent, not a compliance checklist.
Sources
- SFC, “Galvanising responsible innovation for capital markets through AI and tokenisation” — panel remarks by Julia Leung at Hong Kong FinTech Week 2026, 2 November 2026 — sfc.hk (PDF synopsis)
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.