Summary: Arrangement for Generative A.I. Sandbox ++ (“Sandbox”)
1. Document Overview
The "Generative A.I. Sandbox ++" (the "Sandbox") is a regulatory initiative introduced by the Hong Kong Monetary Authority (HKMA) in collaboration with other financial regulators. Its primary purpose is to provide a controlled environment for authorized financial institutions to develop, test, and pilot innovative Artificial Intelligence (A.I.) and Generative A.I. (GenA.I.) solutions. By facilitating this, the HKMA aims to foster industry-wide innovation, identify best practices, and provide early, targeted supervisory feedback on A.I. safety and risk management.
---
2. Main Content
The Sandbox serves as a bridge between theoretical innovation and practical application. It focuses on enabling institutions to test A.I. models within a secure infrastructure before potential large-scale deployment.
Core Objectives
- Innovation Support: Enabling the financial industry to pilot GenA.I.-based solutions.
- Supervisory Guidance: Providing early feedback on regulatory expectations.
- Best Practices: Sharing insights gained from trials to improve industry-wide A.I. standards.
Focused Areas for Use Cases
- Risk Management: Enhancing creditworthiness evaluations (analyzing unstructured data), suitability requirement compliance for investment products, identifying listing document deficiencies, and underwriting improvements.
- Anti-Fraud Measures: Detecting "deepfake" scams, identifying forged onboarding documents, and reviewing communication/claim anomalies.
- Customer Experience: Implementing advanced chatbots capable of generating personalized responses based on transaction history and real-time claim status updates.
- Broad Societal Benefits: Encouraging projects that address climate risk, promote sustainable development, and expand financial inclusion.
---
3. Key Changes and Requirements
- Mandatory Safety Components: All projects must incorporate A.I. safety frameworks, specifically including bias detection and mitigation, explainable A.I., and A.I. output monitoring.
- "A.I. vs. A.I." Strategy: The HKMA strongly encourages participants to use A.I. as a validation layer to check the accuracy and robustness of their GenA.I. outputs.
- Data Principles: Emphasis on the principle of data minimisation. Institutions are encouraged to use data sanitization techniques (e.g., masking, tokenization, synthetic data).
- Infrastructure: Trials are conducted within a secure environment provided by the A.I. Supercomputing Centre at Cyberport.
---
4. Important Dates
- Project Duration: The Sandbox trial, including preparation and final reporting, generally lasts six to eight months following the announcement of selection results.
- Extensions: Subject to case-by-case approval by the regulator.
---
5. Impact Scope
- Applicability: The Sandbox is open to all entities regulated under:
- Banking Ordinance (Cap. 155) – Authorized Institutions
- Securities and Futures Ordinance (Cap. 571) – Licensed Corporations
- Insurance Ordinance (Cap. 41) – Authorized Insurers and Brokers
- Mandatory Provident Fund Schemes Ordinance (Cap. 485) – MPF Approved Trustees/Intermediaries
- Payment Systems and Stored Value Facilities Ordinance (Cap. 584) – SVF Licensees
- Impact Level: High. It provides a platform for setting the future regulatory tone for GenA.I. adoption across the entire Hong Kong financial sector.
---
6. Compliance Requirements
- Application: Must be submitted by the regulated entity (technology partners can participate but cannot apply alone).
- Evaluation Factors: Applications are evaluated based on Level of innovation, Complexity of solution, Contribution to the industry, and Adherence to fair use.
- Reporting:
- Regular progress updates to the respective regulator.
- Mandatory submission of a final report at the conclusion of the trial detailing outcomes and key learnings.
- Resource Management: Institutions must dedicate sufficient internal resources for project management and technical execution.
- Transparency: Participation details, including identities of participants and technology partners, may be publicly disclosed.
---
7. Technical Details and Metrics
- Data Security: Participants must implement encryption and access controls. A secure transfer mechanism is provided by the Sandbox host.
- Validation: Use cases are not intended for production-grade scale; they are meant to be exploratory and time-bound.
- Technology Partners: While not mandatory, institutions are encouraged to partner with firms. A reference catalogue of providers is available via Cyberport.
- Cost: Participation is free of charge; institutions bear only their internal costs (staffing, commercial engagements).
---
8. Summary of Application Channels (Appendix)
| Type of Institution | Application Channel | Primary Contact |
| : --- | :--- | :--- |
| Authorized Institutions | HKMA Survey Tool platform | GenAI_sandbox@hkma.gov.hk |
| Licensed Corporations | Via Email | GenAI_sandbox@sfc.hk |
| Authorized Insurers/Brokers | Via Email | insurtech@ia.org.hk |
| MPF Trustees/Intermediaries | Via Email | GenAI_Sandbox@mpfa.org.hk |
| SVF Licensees | Via Email | pssvfo@hkma.gov.hk |
Important Disclaimers:
- Non-Endorsement: Admission to the Sandbox does not constitute official regulatory endorsement of the technology or the solution.
- Implementation: If an institution wishes to implement a solution post-Sandbox, they must adhere to the standard regulatory procedures for new technology adoption.
- Flexibility: Sandbox requirements are subject to modification based on the nature of the proposals and ongoing trial observations.