Four Hong Kong financial regulators on August 27, 2026, named the first cohort of the GenA.I. Sandbox++, selecting 36 use cases from nearly 100 proposals. Several involve payments, and one takes on a question the industry has yet to settle: how to identify the software agents that initiate a transaction.
The Hong Kong Monetary Authority (HKMA), the Securities and Futures Commission (SFC), the Insurance Authority (IA), and the Mandatory Provident Fund Schemes Authority (MPFA) run the program with Cyberport, the territory’s government-owned technology park. The 36 use cases involve 30 financial institutions and 27 technology partners. Technical trials are due to start before the end of 2026 on a platform managed by Cyberport’s Artificial Intelligence Supercomputing Centre.
Sandbox++ opens the program to insurers and fund managers
The cohort is organized around three themes: risk management, anti-fraud measures, and customer experience. The original GenA.I. Sandbox opened in 2024 for banks only and focused on content generation. The HKMA announced a second cohort in October 2025. The Sandbox++ extension, launched in March 2026, brought in asset management, insurance, and mandatory provident funds, and shifted the trials toward agentic AI: systems that carry out tasks and make decisions without a human sign-off at each step.
The trials cover customer onboarding, payments, insurance claims, and customer interactions. Named participants include Ant Bank (Hong Kong), WeChat Pay Hong Kong, and HSBC Life (International). The cohort carries over the “A.I. vs. A.I.” approach of earlier rounds, in which one AI system checks the decisions of another, but now applies it to end-to-end processes rather than to single tasks.
Agentic ID ties each agent to a customer and a mandate
The project closest to payments pairs HKT Payment, the payments arm of telecom operator HKT, with Red Date Technology. The two companies are building Agentic ID, a framework based on decentralized identifiers and verifiable credentials that also uses zero-knowledge proofs. It is designed to register, then verify, the software agents that initiate a payment, a wallet top-up, a peer-to-peer transfer, or an interbank transfer.
Know-your-customer (KYC) checks establish that customers are who they say they are. They don’t answer the three questions an autonomous agent raises: whether the agent is linked to an identified customer, whether that customer authorized it, and whether the authorization is still valid at the moment the transaction goes out. Agentic ID is meant to support three controls:
- a bounded mandate that sets approved merchants, accessible accounts, a per-transaction limit, and restrictions on location or dates
- revoking an agent’s authority without closing the account of the customer it acts for
- an audit trail that holds up in a dispute, showing which agent acted, for which principal, and under what instructions
Admission to the sandbox is not approval to launch
A regulatory sandbox lets supervised firms test a technology on live cases, within a limited scope and under the regulator’s watch. Getting in does not amount to approval to go live. Each system remains subject to existing licensing regimes and governance requirements, and any commercial rollout needs a separate decision from the relevant regulator.
Two questions remain open after the announcement. The first is whether an agent identity issued in Hong Kong will be recognized outside the territory. The second is how liability is split among the customer, the account-holding institution, and the agent’s developer when a formally authorized transaction turns out to be one the customer never wanted.
Agent identity is on the agenda of several other payments-industry efforts, from the mandate protocols promoted by the card networks to the agentic commerce alliances formed in 2026. Hong Kong’s approach stands out for its starting point: it puts the question inside a supervisory program rather than in a technical specification published by a private company. The trial results will show whether agent identity becomes a prudential requirement or remains a voluntary market practice.