Hong Kong has quietly run one of the most sophisticated GenAI experiments in global banking. Almost no one outside the region is paying attention.
The HKMA GenAI Sandbox selected ten banks for structured testing of generative AI in production use cases — not proofs of concept, not sandboxed pilots insulated from real operations, but genuine production contexts with regulatory visibility into what was being built and how. That’s a different model from what most jurisdictions have managed. It’s a regulator actively accelerating deployment within guardrails rather than waiting for perfect rules before allowing anything to move.
The EU AI Act gets most of the global attention, and not without reason — it’s comprehensive, it’s serious, and it will shape how AI is governed in financial services for a decade. But operationally, it’s been difficult for financial services firms to act on. The obligations are clear; the implementation guidance has lagged. The result is that firms in EU-regulated jurisdictions are spending significant compliance resource on frameworks that aren’t yet stable, while the market for AI deployment moves underneath them.
The sandbox model inverts the dynamic. Deploy in a controlled environment with regulatory oversight, observe what actually happens, then codify into guidance that reflects real operational experience rather than anticipated risk. The guidance that emerges from this process tends to be more specific and more usable, because it’s been calibrated against production deployment rather than derived from first principles.
MAS in Singapore has followed a similar pattern. Their model risk management guidelines for AI and machine learning are more operationally specific for financial services than equivalent guidance from most Western regulators. They address model validation, governance, and ongoing monitoring in ways that align with how model risk actually works in banks, rather than how it works in academic risk management frameworks.
The reason this matters beyond the regulatory detail: APAC financial services firms operate in an environment that is a forcing function for governance sophistication. Multi-jurisdiction compliance is not an edge case here — it’s the baseline. A single product launched across Hong Kong, Singapore, Taiwan, and Southeast Asia faces regulatory requirements from four or more jurisdictions simultaneously, with different definitions of key terms, different data localisation requirements, and different model approval processes. The firms that navigate this routinely have developed governance capabilities that are, in practice, more mature than comparable firms in single-jurisdiction markets.
This shows up in how APAC banks approach AI governance. The frameworks tend to be more specific about accountability — who signed off on what, when, and under what constraints — because the multi-jurisdiction environment creates genuine pressure to document decisions precisely. When a regulator in one jurisdiction asks how a model was approved, the answer can’t rely on institutional context that the regulator shares. It has to be in writing.
The case I find myself making is not that APAC is “ahead” of the West on AI — that’s a reductive framing that erases real variation within the region and ignores genuine Western leadership in model development and frontier research. It’s that the operational sophistication for AI deployment in financial services is more developed in parts of APAC than the global conversation credits, and that the regulatory experiments happening here are worth watching for what they reveal about what actually works.
The next wave of financial services AI case studies isn’t coming from New York or London. Some of the most instructive ones are already happening here, quietly, in production.
P.S. The feature of APAC AI governance that I’d most want to export to other regions is the direct feedback loop between regulatory guidance and production deployment. When guidance is developed by regulators who have observed actual deployments rather than anticipated theoretical ones, the result is guidance that practitioners can use. It sounds obvious. It’s rarer than it should be.