Hong Kong Launches Project SAGE: AI Agent Identity, Payments and Governance Explained

Verified 2 November 2026 | Primary announcement: 2 November | Status: Project launched and expert group established; proposed agent identity and interoperability arrangements are not final rules.

An AI agent can now propose a purchase, call a payment API and coordinate work across systems. But who authorized the transaction? Who can revoke permission? Who is accountable if the agent acts incorrectly? Those questions sit at the center of Project SAGE, launched by the Hong Kong Monetary Authority (HKMA) on 2 November 2026. SAGE means Securing Agentic Finance with Governance and Enablement. This is a new regulator-led initiative for the development of agentic finance, not an announcement that every bank must implement a particular new standard immediately. See the original HKMA announcement.

What launched on 2 November?

The HKMA confirmed both Project SAGE and a cross-sector Agentic Finance Expert Group involving financial institutions, technology providers, professional services and academia. The initiative covers four workstreams: real-world use-case exploration, agent identity, interoperability standards, and legal or regulatory considerations. The regulator identifies possible business-to-consumer payments, business-to-business procurement and treasury, and machine-to-machine usage-based payments. These are areas for exploration and validation, not proof of universally available production services. The 2 November release is explicit about this distinction. Reuters reported the launch independently the same day.

Why Know Your Agent matters

Project SAGE raises the concept of Know Your Agent (KYA): how can a bank establish an agent's identity and the authority delegated to it? A conventional service token can authenticate a software connection, but that does not establish that a customer authorized a particular payment amount, beneficiary or purpose. An agent might act for a person, company or another service. Identity and authorization are different controls. The HKMA wants to explore authentication, delegated authority, interoperability, liability and consumer protection. It has not announced a completed universal KYA standard or mandatory registry. Source: HKMA's Project SAGE scope.

My architectural interpretation is to model two principals separately: the technical identity that calls an API, and the person or organization whose authority is being exercised. The delegation should have a defined purpose, scope, limit, expiry and revocation mechanism. If a system cannot reconstruct those facts after a disputed transaction, its auditability is weak even when its AI model performs well. These are implementation recommendations, not newly imposed HKMA rules.

How SAGE differs from the earlier ART Framework

On 15 October 2026, the HKMA announced the ART Framework, emphasizing Accountability, Resilience and Trust in banking AI. That earlier announcement introduced supervisory guidance, expanded testing and plans to explore agentic AI governance. It reported that over 60% of use cases in the second generative AI sandbox cohort involved agentic AI. Read the 15 October ART announcement and its associated governance concept note. On 2 November, the regulator took a separate step by formally launching Project SAGE and establishing its expert group.

There is an important chronology here. The October supervisory guidance is already published. The November project launch is new. Potential future arrangements for agent identity, registries and interoperability remain under discussion. The HKMA's 2 November FinTech Week announcement also says it published a discussion paper seeking industry views on agentic AI governance in banks. Do not confuse a discussion paper with a binding technical implementation standard.

What is available today and what is still uncertain?

Confirmed now: SAGE has launched; its four workstreams are public; the expert group is established; the ART Framework was published in October; and the HKMA says a discussion paper has been published. Not confirmed as available: a live industry-wide agent registry, a production KYA API, a compulsory certification regime, a final interoperability protocol or a universal compliance deadline. The original SAGE statement does not specify those deliverables. Reporting the initiative as a new enforceable standard would overstate the announcement.

Six practical tests for a financial AI-agent pilot

1. Delegation: Record who authorized the agent, the intended task, maximum transaction amount, allowed counterparties, expiry and revocation route. 2. Separation of duties: Distinguish read, recommend, draft and execute permissions. An agent that can draft a purchase order should not automatically release a payment. 3. Transaction evidence: Capture agent identity, delegating principal, tool calls, approval decision, transaction identifier and outcome. 4. Revocation: Cancel permission mid-process and verify that downstream execution stops. 5. Interoperability: Verify the origin and scope of instructions exchanged between agents from different vendors. 6. Human accountability: Decide which actions require approval and who resolves exceptions or disputed transactions.

This is my proposed acceptance-test checklist, not an HKMA-mandated list. It converts the regulator's concerns about identity, delegated authority, interoperability and consumer protection into controls that enterprise teams can validate. The policy direction is documented in SAGE and the ART Framework.

What enterprise architects and SAP teams should take from this

Procurement and treasury are explicitly named as potential SAGE use cases. Imagine an agent connected to an ERP system: it identifies a supplier, prepares a purchase order, requests approval and initiates settlement. Each stage has a different security boundary. The right architecture keeps the existing authorization, approval and audit controls intact even when the interface becomes conversational. A model's ability to plan steps does not create authority to execute them.

For clarity, this is an enterprise AI governance announcement, not a SAP S/4HANA, SAP BTP or SAP SuccessFactors product release. The HKMA has not announced a SAP-specific SAGE integration. The implementation lessons can be applied to SAP and non-SAP environments, but they should not be presented as product availability claims.

Recommended next steps for banks and technology providers

Review the primary SAGE release and the FinTech Week statement. Map existing agent pilots against applicable current supervisory guidance from the ART Framework. Choose one tightly bounded pilot where the agent recommends a treasury action but cannot move funds without separate authorization. Test revocation, audit reconstruction and approval boundaries before granting production write access. Track future HKMA publications for final decisions on KYA, interoperability and agent registries. For independent context, see Reuters' 2 November reporting.

Bottom line: Hong Kong's new initiative recognizes a crucial distinction: an AI agent capable of making a financial decision is not automatically authorized to execute it. SAGE is live as a governance and industry-coordination project; its potential technical standards remain under development. That distinction is the most useful lesson for enterprise AI teams planning production agents.