Technology Risks and Rewards from Process Automation and Artificial Intelligence

In recent years, the Hong Kong Monetary Authority (HKMA) has actively encouraged banks in Hong Kong to replace rules-based robotic process automation (RPA) with AI-enhanced transaction monitoring (TM) systems to improve efficiency and effectiveness in detecting financial crimes. Banks must conduct comprehensive pre-implementation assessments addressing unique needs, system suitability, resource impacts, and integration with existing infrastructure. Crucially, banks retain full responsibility for TM outcomes—even when using third-party vendors—and must design systems adaptable to evolving transaction patterns and risk scenarios, with senior management overseeing development and ongoing governance.

Pádraig Walsh, who leads the TMT practice at Tanner De Witt, recently examined this policy in an article published in Banking Today, the official journal of the Hong Kong Institute of Bankers. The key points are:

1. Regulatory Shift:
   • HKMA actively promotes AI-enhanced TM systems to replace rules-based RPA systems, improving efficiency and effectiveness in detecting suspicious activities.
   • Banks must conduct pre-implementation assessments covering needs, system suitability, and resource impact.
2. AI Advantages:
   • Reduced False Positives: AI systems prioritize alerts using contextual data (e.g., customer profiles, historical patterns), cutting manual review workload (Case Study 1).
   • Enhanced Detection: Identifies complex money-laundering typologies and networks faster than RPA.
   • Resource Optimization: Focuses efforts on high-risk cases, streamlining due diligence.
3. Critical Success Factors:
   • Data Quality: TM systems depend on mature, well-governed data from core banking/payment systems.
   • Governance: Senior management oversight, stakeholder alignment, and periodic system reviews (e.g., annual performance against KPIs) are mandatory.
   • Risk Mitigation: Banks must address AI limitations (e.g., bias, “hallucinations”) through testing, transparency logs, and fallback mechanisms.
4. Legal & Contractual Considerations:
   • Procurement Models: In-house, third-party, or co-development options require rigorous due diligence, especially for IP rights (e.g., training data ownership).
   • Contract Safeguards: Key clauses should cover data usage rights, output ownership, error liability, regulatory compliance, and termination rights if systems breach laws.
5. Implementation Best Practices:
   • Structured planning, cross-functional collaboration, and phased testing (Case Study 2).
   • Adherence to HKMA’s High-Level Principles on AI (2019) to ensure responsible innovation.

Please refer to the full article for the complete regulatory analysis, implementation case studies, and actionable frameworks.