Hong Kong retail bank auditors need to be trained to audit AI agents handling scam alerts, account servicing and investment product checks. The work means testing verdicts, approvals and certificates from the decision record, provenance of instructions, and bilingual output. Audit opinion stays with them. The HKMA, SFC, PCPD and the Personal Data (Privacy) Ordinance frame oversight.
What do internal auditors at a Hong Kong retail bank cover?
Scams dominate retail risk. Customers are targeted by impersonation, investment and romance scams, and money moves fast through the local instant payment system. Auditors test how the bank detects and intervenes in suspicious payments, how it identifies and closes mule accounts, and how it handles customers who report losses. Virtual banks, operating without branches, face the same issues with fewer human touchpoints.
The other major area is wealth. Retail banks distribute investment and insurance products through branches and apps, and auditors test suitability, disclosure and the handling of vulnerable customers. The HKMA supervises banks, while the SFC sets expectations for investment product sales; internal audit reports to the board's audit committee and must remain independent.
What changes when agents arrive?
Agents tend to arrive in scam operations and servicing. Each capability carries a depth earned on the bank's own cases.
- Scam alert triage (depth 2). The agent assembles payee history, device data and the customer's pattern, and drafts a recommendation to hold or release. An analyst decides and, where needed, calls the customer.
- Mule account review (depth 1). It flags accounts with mule indicators for investigation.
- Account servicing (depth 3 within limits). It processes low-risk requests made through authenticated channels, such as statement preferences.
- Suitability file checks (depth 1). It compares the risk profile with the product sold and flags mismatches.
Audit's own agent, at depth 1, can test every scam alert released in a period from the append-only record, and at depth 2 draft workpapers in English or Chinese.
What must auditors learn, and what stays with them?
The first thing to master is what should never be allowed. Releasing a held payment to a payee the customer has never paid, after a scam warning, should not sit with an agent. Neither should raising transfer limits on an instruction that came by email or chat outside the authenticated app. Our list of what internal auditors should never let an AI agent do turns these into tests.
Provenance comes next. An instruction from the authenticated banking app is signed by an identified customer. A message that claims to be from the customer but arrived by another route is external, and an external claim cannot authorise a payment. Auditors should test that every limit increase and new-payee release rested on signed or sealed evidence.
Language follows. Customer communications run in Chinese and English, and a scam warning that is clear in one and vague in the other is a weakness. Auditors should sample both. Our guide on how internal auditors review an AI agent's decisions includes sampling design.
Certification is the last core skill. Agent certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day. Pryme Intelligence Academy covers this in its free Foundations track, which suits auditors new to agents.
What stays with the auditor: the plan, the opinion, ratings and reports to the audit committee.
Which Hong Kong rules shape oversight and literacy?
The HKMA supervises authorised institutions, including virtual banks. It has set out expectations for banks using AI and big data, including board and senior management accountability, explainability, fair treatment of customers and ongoing monitoring. It also expects strong controls against scams and mule accounts. When agents operate these controls, audit needs the literacy to test them.
The SFC regulates investment product sales by registered institutions, so suitability checks performed with an agent remain subject to its conduct expectations. The Personal Data (Privacy) Ordinance governs customer data, and the PCPD enforces it. Its data protection principles cover purpose, accuracy, retention, security and use, and the PCPD has published guidance on AI. Our piece on the PDPO and training staff who use AI agents covers the detail.
FATF Recommendations shape AML expectations, and ISO/IEC 42001 and the Basel Committee's operational resilience principles help structure the audit programme.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day training plan
Days 1 to 30. All auditors learn the basics: depth, the minimum chain, the four verdicts and the record. The head of audit maps each agent with its capabilities and certificate dates.
Days 31 to 60. Pilot an audit of scam alert triage. Test every released alert for who decided, the provenance of the customer's instruction, bilingual warnings and certificate currency.
Days 61 to 90. Extend to limit increases and new-payee releases, write the standing programme and set up banking corrections for audit's agent.
Questions people ask
Can an agent call a customer to confirm a suspicious payment?
Contact during a suspected scam is sensitive and benefits from human judgement. Most banks should keep the call with a person, with the agent preparing the facts.
Do virtual banks need different audit tests?
The tests are similar but cover more, since more steps are automated. Audit should pay particular attention to held items and how quickly people act on them.
Why is audit the real control?
It independently tests whether bounds and approvals held across thousands of decisions. Our piece on why internal auditors are the real control explains, and the guide to AI agent skills by role covers others.