What the First Results From Hong Kong's Bank AI Sandbox Actually Show

sourceCode | BFSI Technology Insight | 2 October 2026

Key Takeaways

• The HKMA has published the closest thing banking has to regulator-observed AI evidence: a report on the first cohort of its GenA.I. Sandbox, shared 31 October 2025, covering 15 use cases run by 10 banks with 4 technology partners.

• The report discloses real cross-institution data - up to 80% reductions in document-preparation time, 86% of outputs rated favourable, fine-tuning that beat prompting alone - but not which of the 15 use cases reached production and which stalled. That omission is itself a finding.

• A newer, broader programme, GenA.I. Sandbox++ (HKMA, SFC, Insurance Authority, MPFA; launched March 2026), announced its first cohort (36 use cases, 30 institutions, 27 tech partners) on 27 August 2026 - a selection, not a results report. Trials weren't scheduled to begin until later in 2026, so no "first results" for this programme exist yet.

• The one concrete account of what happens after a sandbox proof-of-concept - Hang Seng Bank's own writeup of its fraud-investigation use case - describes a system still experimental eleven months in, with hallucinations and data quality cited as the reasons it hasn't moved further.

• The useful signal for a 2027 roadmap isn't a scoreboard of winners and losers. It's the pattern in what the regulator was willing to quantify versus what it left undisclosed - which maps closely onto where most vendor-led AI business cases go quiet.

Introduction

Every bank's AI steering committee has, by now, sat through some version of the same slide: a vendor case study, three logos, a percentage improvement with no denominator, and a strong implication that this is normal. It is one of the more persistent distortions in enterprise technology decision-making - not because vendors lie, exactly, but because the selection effect is total. Nobody publishes the pilot that got quietly archived.

That is what makes Hong Kong's approach to generative AI supervision worth real attention from a CTO or Head of Digital sitting in Sydney, Singapore, Toronto or London. The HKMA, working through Cyberport's AI Supercomputing Centre, has spent two years running named banks through structured, supervised generative AI trials and then publishing - with real numbers, if not a full scorecard - what it found. That is a categorically different evidence base to a vendor whitepaper: the institutions are named, the methodology is disclosed, and the regulator has no commercial stake in a flattering answer.

The public narrative around this programme has also gotten slightly ahead of what has actually been published. The premise behind this piece was that "first results" of a programme called GenA.I. Sandbox++ landed in August 2026. Having gone back to the HKMA's own releases and the underlying report, that isn't quite right - and the correction matters more than the original premise, because it says something about how regulators are choosing to disclose AI evidence at all.

What HKMA's Sandbox Actually Is - And What It Has Reported So Far

There are, at time of writing, two related but distinct programmes, and conflating them is the single most common error in secondary coverage.

The original GenA.I. Sandbox launched in 2024 as an HKMA-Cyberport initiative confined to banking. Its first cohort ran 15 use cases across 10 banks - Bank of China (Hong Kong), China CITIC Bank International, China Construction Bank (Asia), Citibank (Hong Kong), Dah Sing Bank, Hang Seng Bank, HSBC, Livi Bank, Societe Generale and Standard Chartered (Hong Kong) - with four technology partners (Aereve, Alibaba Cloud, Baidu, Forms Syntron), selected from more than 40 submitted proposals. Use cases clustered into three themes: risk management (financing approval, AML suspicious-transaction reporting, enhanced KYC), fraud detection (investigator assistants, fraudulent account-opening defences) and customer-facing tools (financial-knowledge advisors, chatbots). The HKMA and Cyberport shared outcomes at a symposium on 31 October 2025, attended by more than 500 practitioners, and followed it with a written report - Responsible Innovation with GenA.I. in the Banking Industry - containing the performance data this article relies on.

A second cohort of the same (still banking-only) programme was announced on 15 October 2025: 27 use cases, 20 banks and 14 technology partners, selected from over 60 proposals, with a declared shift toward AI governance, "AI vs AI" quality-assurance concepts and adversarial testing against deepfake-enabled fraud. Trials for this cohort were still running through 2026 at the time of writing, with no outcome report yet published.

GenA.I. Sandbox++ is a different, larger thing: a joint initiative launched on 5 March 2026 by the HKMA, the Securities and Futures Commission, the Insurance Authority and the Mandatory Provident Fund Schemes Authority, extending the sandbox model beyond banking into securities, asset and wealth management, insurance, pensions and stored-value facilities. Applications were accepted through 30 June 2026, and the first cohort - 36 use cases from close to 100 proposals, across 30 financial institutions and 27 technology partners, including named participants such as Hang Seng Bank, WeChat Pay (Hong Kong) and Ant Bank (Hong Kong) - was announced on 27 August 2026. The focus is explicitly agentic: end-to-end processes such as customer onboarding, payments and insurance claims, with an emphasis on autonomous decision-making rather than content generation alone.

The important distinction: the August 2026 announcement is a selection announcement, not a results report. Technical trials on Cyberport's infrastructure were slated to begin only "later in 2026," so GenA.I. Sandbox++ has produced a roster, not results. The genuine regulator-observed outcome evidence available right now is nearly a year old and belongs to the original, smaller, banking-only first cohort. That is the evidence this piece is built on - more useful than it first appears, not because it's recent, but because it's real.

Why Regulator-Observed Evidence Is Worth More Than Vendor Demos - Even a Thin Version of It

The HKMA's first-cohort report is not a comprehensive outcomes study. It is closer to a structured field note. But even a thin regulator-observed dataset beats a thick vendor one, for three specific reasons that matter to a technology buyer.

First, the institutions are named and the comparison is cross-sectional. Ten banks ran generative AI through the same supervised environment, under the same disclosure obligations, evaluated by the same selection panel (which included named academics from CUHK, PolyU and HKU). A vendor case study is one company's account of one deployment; this is ten institutions' worth of pattern, visible at once.

Second, the technical detail is oddly specific for a regulatory document, and specificity is the tell that separates observed data from marketing copy. The report states that Parameter-Efficient Fine-Tuning (LoRA) reduced hardware requirements against full fine-tuning with accuracy loss below 3%; that prompt engineering alone was "inadequate to consistently produce high-quality outputs" and had to be combined with retrieval-augmented generation and supervised fine-tuning; that bias was assessed across more than 500 test results per relevant use case; and that data preparation consumed resources comparable to model fine-tuning itself. That reads like a document written by people who had to explain, to a supervisor, why something did or didn't work - not one written to sell anything.

Third, the failure modes are named, not laundered. Hallucination and factual inaccuracy are described as the central technical obstacle across the cohort, not a footnote. Hang Seng Bank's own published account of its fraud-investigation use case - extracting and summarising fraud-investigation information via an on-premises LLM - states plainly that "the occurrence of GenA.I. errors (hallucinations) poses a main challenge to adoption," that it achieved above 90% extraction accuracy only against synthetic test data, and that it "remains in experimental phase," with production deployment still undetermined and human-in-the-loop validation retained throughout. That is a bank telling the market, in writing, that a plausible, well-resourced use case - inside a supervised sandbox, with a major bank's engineering effort behind it - had not cleared the bar for production eleven months in. That is precisely the kind of data point vendor marketing never contains.

What the Numbers Actually Show - And What They Deliberately Don't

Taken at face value, the disclosed metrics are genuinely strong. Suspicious transaction report preparation time fell 30-80%. Document and memo processing that took roughly a day fell to around five minutes. Production time for comparable-quality outputs fell around 60% against manual methods. A fine-tuned model reviewing fraud case narratives achieved full (100%) coverage where traditional sampling covered only a fraction of cases. Users rated 86% of outputs favourably across the cohort, and more than 70% of AI-generated credit-assessment outputs were rated valuable reference material by the staff using them. Read together, those numbers describe a technology that, inside a well-resourced, supervised environment with human review retained, does what generative AI is supposed to do for document-heavy, judgment-adjacent banking work.

What the report does not do is say how many of the 15 use cases actually reached production, versus how many were extended, redesigned, or quietly shelved. It reports aggregate performance across the cohort's three thematic clusters, not a use-case-by-use-case scorecard with a pass/fail column. Given that this is a regulator whose supervisory function depends on precision, that omission is a choice, not an oversight - it suggests the HKMA judged the aggregate narrative safe to disclose while judging use-case-level pass/fail data too commercially sensitive to publish this early. Regulators disclosing outcome data about live commercial deployments is new territory globally; it would be more surprising if the first attempt were fully granular than if it weren't.

What Most Banking AI Roadmaps Get Wrong

Set against this evidence, the more common failure pattern in banking AI programmes outside the sandbox becomes easier to name, because the sandbox report essentially lists the difference between what worked and what didn't, even without saying which use case landed on which side.

Most roadmaps still treat prompting a general-purpose model as the default technical approach, reaching for fine-tuning only when something breaks. The sandbox found the opposite ordering more reliable: domain-specific fine-tuning of smaller, purpose-built models outperformed general models, and prompting alone was explicitly deemed insufficient for consistent quality. Most roadmaps also underweight data preparation, treating it as a preliminary step rather than a workstream comparable in size to the model work itself - the exact inversion the sandbox flags as one of its clearest lessons. And most roadmaps treat hallucination risk as a single, uniform concern, rather than mapping it against the specific cost of being wrong in each context - a suspicious-transaction-report draft that's 80% right and human-reviewed is a very different risk profile to an autonomous claims decision, and the shift toward "AI vs AI" oversight in later cohorts is a tacit admission that uniform tolerance doesn't scale as use cases move from assistive to agentic.

A Framework for Reading Your Own Roadmap: The Graduation Line

The single most useful thing a CTO can take from this evidence base isn't a benchmark to beat. It's a diagnostic for figuring out which of your own AI initiatives look like the sandbox's disclosed successes, and which look like Hang Seng's undisclosed-but-published stall.

We're calling this the Graduation Line - the point at which a generative or agentic AI use case has cleared enough of the sandbox's implicit criteria to be treated as a genuine production candidate, rather than a perpetual pilot. It has five factors, each drawn directly from what the HKMA cohort's disclosed evidence and Hang Seng's own account show actually separated progress from stagnation:

1. Data foundation readiness - is the data already structured and accessible, or does the project quietly include an unbudgeted data-engineering programme? The sandbox treats this as comparable in effort to the model work; most business cases treat it as a rounding error.
   
   
2. Method fit - has the team matched the technical approach (prompting, retrieval-augmented generation, fine-tuning, or a hybrid) to the task, rather than defaulting to whichever the team already knows? This match mattered more than model choice in the cohort's own findings.
   
   
3. Error-consequence mapping - is there an explicit statement of what a hallucination costs in this workflow, with the human-review layer sized to that cost rather than applied as a blanket safeguard? Hang Seng's use case kept a human in the loop throughout - a design decision, not a placeholder.
   
   
4. Evidence trail - can the team produce the disclosure the sandbox's participants had to produce (bias testing across a meaningful sample, accuracy loss against a baseline, favourability data from real users) if a regulator or board risk committee asked tomorrow?
   
   
5. Production commitment, not extension commitment - is there a scheduled decision point, with named owners, to deploy, redesign or retire the use case - or an open-ended "continue testing" status, the exact status Hang Seng described eleven months in?
   
   A use case that scores well on the first four factors but has no answer for the fifth is, functionally, exactly where several of the sandbox's own participants appear to sit: technically credible, well-evidenced, and stalled anyway.

The Counterargument: Don't Over-Read a Small, Selected Sample

None of this should be read as a verdict on generative AI in banking generally, and it's worth being explicit about why.

Fifteen use cases across ten banks, later thirty-six across thirty institutions, is a curated, not representative, sample - self-selected by institutions confident enough to submit, and further filtered by a panel prioritising innovation and industry value. Selection bias cuts both ways: participants are likely more capable than the market average, but the chosen use cases may also have been picked because they were plausible sandbox candidates, not the bank's highest-value AI opportunities. Hong Kong's supervisory posture - a close, hands-on regulator running institutions through shared infrastructure - is also not universally transferable to an unsupervised internal pilot under a different regulatory relationship. And the agentic focus of the newer Sandbox++ cohort tests genuinely different risk territory - autonomous, multi-step decision-making - than the largely assistive, human-reviewed work in the first cohort's disclosed results. Evidence about drafting assistance and case-narrative summarisation should not be quietly extended to claims about autonomous agents making financial decisions; that evidence doesn't exist yet, from this programme or, to our knowledge, any comparably rigorous one.

The sourceCode’s Perspective

We spend a fair amount of time with banking technology leaders who have already run a pilot, got a good number, and then watched the initiative stall somewhere between the pilot readout and the production budget cycle. What's striking about the HKMA evidence, even in its incomplete form, is how closely it matches those post-mortems: the technical numbers were fine. What stopped the project was some combination of unbudgeted data work, a mismatch between the chosen method and the task's actual error tolerance, or the absence of anyone with the authority and evidence base to make a production call.

The sandbox's own restraint - strong aggregate metrics, silence on production status - is a useful mirror for how internal AI governance actually behaves. Institutions are far more comfortable telling a steering committee a pilot "performed well" than committing to a dated go/no-go decision. The Graduation Line is built to force that fifth factor into the open, because it's the one boards ask about last and regret not asking about first. Talk to us here!

Conclusion

The genuinely new information from Hong Kong's banking AI sandbox isn't a headline result - it's a data point about disclosure itself. A regulator ran ten banks through supervised generative AI trials, published real cross-institution performance figures, and chose not to publish which use cases made it to production. A newer, larger, cross-sector version of the programme has just picked its next cohort and has no results at all yet.


That's not a story about generative AI succeeding or failing in banking. It's a story about how much of the "did it actually work" question still lives in institutions' own undisclosed decision processes - exactly where the Graduation Line is built to help a technology leader look.

FAQ

Did the HKMA report which AI use cases succeeded and which failed? No. The first-cohort report discloses aggregate metrics across three thematic clusters (risk management, fraud detection, customer-facing) but no use-case-by-use-case breakdown of what reached production, was extended, or was discontinued.

What is the difference between GenA.I. Sandbox and GenA.I. Sandbox++? GenA.I. Sandbox is the original HKMA-Cyberport, banking-only programme, now in its second cohort. GenA.I. Sandbox++, launched March 2026, is a joint HKMA-SFC-Insurance Authority-MPFA initiative extending the model across securities, asset management, insurance and pensions, with a focus on agentic AI.

Have first results from GenA.I. Sandbox++ actually been published? Not as outcome data. The 27 August 2026 announcement covered selection of the first Sandbox++ cohort - 36 use cases, 30 institutions, 27 tech partners - with trials scheduled to begin later in 2026. No performance results had been published as of this piece's publication date.

What were the headline performance figures from the first (pre-++) cohort? A 30-80% reduction in suspicious-transaction-report preparation time, roughly 60% lower production time versus manual methods, 86% of outputs rated favourable by users, and full coverage of fraud case narratives by a fine-tuned model versus partial coverage under traditional sampling.

Should a bank outside Hong Kong treat these results as generalisable? Treat them as a strong existence proof for defined, human-reviewed use cases in a closely supervised environment - not as a benchmark for agentic AI, and not as evidence any vendor approach will transfer without the data-readiness and governance investment the sandbox identifies as decisive.

Reference List

Crowdfund Insider (2026) Hong Kong Regulators Widen GenA.I. Sandbox Across Financial Services. Available at: https://www.crowdfundinsider.com/2026/03/265493-hong-kong-regulators-widen-gena-i-sandbox-across-financial-services/ (Accessed: 2 October 2026).

Fintech News Hong Kong (2025) HKMA Hosts GenAI Symposium to Share Sandbox Findings and AI Insights. Available at: https://fintechnews.hk/36132/ai/hkma-genai-symposium/ (Accessed: 2 October 2026).

Fintech News Hong Kong (2025) Banks Can Slash Production Time by Up to 60% with GenAI, HKMA Report Reveals. Available at: https://fintechnews.hk/36534/ai/hkma-genai-sandbox-report/ (Accessed: 2 October 2026).

Hang Seng Bank (2025) HKMA GenA.I. Sandbox - Fraud Investigation Automation. Available at: https://www.hangseng.com/content/dam/hase/pdf/hkma_genai_sandbox_2025_fraud_investigation.pdf (Accessed: 2 October 2026).

Hong Kong Monetary Authority (2025) Report on the First Cohort of GenA.I. Sandbox: Responsible Innovation with GenA.I. in the Banking Industry. Available at: https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20251031-6-EN/20251031-6-EN.pdf (Accessed: 2 October 2026).

Hong Kong Monetary Authority (2025) HKMA announces second cohort of GenA.I. Sandbox to advance responsible A.I. innovation. Available at: https://www.info.gov.hk/gia/general/202510/15/P2025101500258.htm (Accessed: 2 October 2026).

Hong Kong Monetary Authority (2026) First cohort of GenA.I. Sandbox++. Available at: https://www.info.gov.hk/gia/general/202608/27/P2026082600563.htm (Accessed: 2 October 2026).

King & Wood Mallesons (2026) Gen AI in Financial Services: Latest Regulatory Developments in Hong Kong & Chinese Mainland. Available at: https://www.kingandwood.com/hk/en/insights/latest-thinking/gen-ai-in-financial-services-latest-regulatory-developments-in-hong-kong-chinese-mainland.html (Accessed: 2 October 2026).

OpenGov Asia (2026) Hong Kong Regulators Launch First GenA.I. Sandbox++ Cohort. Available at: https://opengovasia.com/hong-kong-regulators-launch-first-gena-i-sandbox-cohort/ (Accessed: 2 October 2026).

The Standard (2026) Hong Kong unveils first cohort of GenA.I. Sandbox++. Available at: https://www.thestandard.com.hk/innovation/article/341121/Hong-Kong-unveils-first-cohort-of-GenAI-Sandbox (Accessed: 2 October 2026).

Timothy Loh LLP (2025) HKMA and Cyberport co-host GenA.I. Symposium to share outcomes of GenA.I. Sandbox. Available at: https://www.timothyloh.com/insights/latest-news/hkma-and-cyberport-co-host-gena-i-symposium-to-share-outcomes-of-gena-i-sandbox-20251031 (Accessed: 2 October 2026).