Chu prepares fintech cybersecurity baseline as 75 percent flag risk
The Hong Kong Monetary Authority is developing a Fintech Cybersecurity Baseline to strengthen bank resilience, Executive Director Carmen Chu announced on September 22, 2026. A recent survey showed that 75 percent of institutions identify key risks in emerging technologies.
Supervisory standards for agentic tools
Speaking at the 2026 Fintech Innovation Lab APAC reception, Carmen Chu emphasized that adoption of artificial intelligence and agentic tools requires strict operational safeguards.
The Hong Kong Monetary Authority is collaborating with industry associations to establish a Fintech Cybersecurity Baseline, providing technology providers with explicit security expectations for banking deployments.
“Trust is the foundation of banking,” Chu stated, noting that solutions turning documents and market information into insights need robust governance, data quality, and privacy controls.
The framework seeks to help fintechs move smoothly from proof of concept to full institutional deployment without compromising resilience.
Stock-take exposes privacy and security gaps
The supervisory focus follows the HKMA's recent Tech Maturity Stock-take, which revealed widespread vulnerability concerns among licensed lenders.
About 75 percent of surveyed institutions identified security vulnerabilities, operational disruptions, and regulatory compliance as primary risks linked to new tools.
Additionally, over 60 percent of banks designated cybersecurity and data privacy as major operational hurdles.
The baseline forms part of the regulator's Fintech 2030 strategy.
Checklists cannot replace legacy reform
Standardizing technical baselines is a necessary discipline for scaling artificial intelligence in banking.
However, setting supervisory checklists risks burdening agile startups without fixing banks' own legacy architecture flaws.
The initiative will expedite vendor screening, but real operational transformation remains years away.