For years, much of Hong Kong’s banking transformation agenda sat on tokenisation pilots, AI roadmaps, and cybersecurity frameworks progressing.

Now, as its financial system moves into 2026,  distinct themes are emerging: digital assets are edging closer to core infrastructure, AI could be reshaping how customers interact with money, and cyber risk is forcing institutions to rethink speed, responsibility and control.

What’s emerging is a more fundamental shift in how banking operates and where its pressure points now lie.

Retail Finance Could Converge Around a Single AI Agent

AI is probably one of the most mentioned catchphrases in 2025, and it’s only gaining more traction in 2026.

According to the report, a clear next step for retail financial services is the emergence of a single AI financial agent that sits between customers and their various banks and investments. It effectively acts as one point of access for management, advice and execution.

Instead of managing multiple apps and fragmented accounts, customers would then be able to articulate their financial goals while the agent optimises and executes across the market.

We’re already seeing early versions of this idea taking shape in other markets. Reuters has reported that British banks have begun piloting agentic AI for customers. Natwest, Starling and Lloyds have informed the paper that they are engaging with the Financial Conduct Authority (FCA) as they prepare for retail customer trials, a major shift from existing back-office AI use.

Crucially, regulators are moving in parallel. The FCA has indicated that it will apply rules like the Senior Managers Regime and the Consumer Duty.

These rules are necessary to hold bosses responsible for wrongdoing and ensure customer interests remain paramount, Financial Conduct Authority (FCA) Chief Data Officer Jessica Rusu shared.

Achieving a similar scale here would involve strong governance and robust data practices, too.

Tokenisation In Hong Kong Is Placing Its Foot Down

Tokenisation was previously considered a future capability as Hong Kong banks explored use cases while the broader ecosystem waited for signs that digital assets would finally move into action.

Thankfully, the wheels started turning in late 2025.

In November, the Hong Kong Monetary Authority (HKMA) launched EnsembleTX, a pilot phase built on the earlier Ensemble Sandbox, which pushed tokenisation into more practical, execution-focused territory.

For the first time, participating banks and industry players were able to facilitate faster and more transparent settlement of tokenised transactions. They used live infrastructure while still operating within a controlled environment, a step which tests how tokenisation might function within real-world banking.

Then, in December 2025, Ant International, HSBC and Swift completed a Proof of Concept (POC) that moved the conversation beyond domestic pilots. It showcased the cross-border transfer of tokenised deposits using ISO 20022 standards.

This particular initiative connected Swift’s global messaging network with HSBC’s tokenised deposit service and Ant International’s blockchain infrastructure. It demonstrated how tokenisation can begin to integrate with existing financial rails rather than sit alongside them.

These moves showcase a shift, where tokenisation in Hong Kong is starting to intersect with core banking infrastructure.

The milestones also align with observations from KPMG’s Hong Kong Banking Outlook 2026 report, which states that traditional banks and Web3 will be moving closer together. Simon Shum, Head of Digital Assets at KPMG China, shared the following statement,

“We expect traditional banks and the digital-asset ecosystem to move closer together. Banks will likely begin offering services such as digital-asset custody and a broader range of tokenised products, particularly as the regulatory framework becomes clearer.”

Simon elaborates, saying that banks will need to focus on “blockchain expertise, ensuring governance and controls are robust and stay close to regulatory developments, particularly around AML, cybersecurity and risk management.”

Soon, Hong Kong is expected to issue its first stablecoin licenses in Q1 2026, with HKMA overseeing approvals for 36 firms that have submitted formal applications.

What else is next?

Automation-Led, Always-On Cyber Defence Is A Non-Negotiable

Cyber threat is a key pressure point this year. AI-powered attacks are enabling hackers to generate highly convincing fake emails and helping them identify vulnerabilities swiftly. Advances in quantum computing are also showcasing the potential to break today’s security controls, like encryption methods.

Combine that with growing supply chain risks, where your service providers become entry points for attackers, and this quickly spells a recipe for disaster if left unchecked. Lanis Lam, Partner of Technology Risk, shared,

“Automation should now be seen as a core enabler of cyber resilience – not just a way to drive efficiency, but the only realistic way to keep pace with the speed and volume of emerging threats.”

While automation can serve as the primary shield for resilience, the cost of delayed response is already being tallied in the wider APAC region.

A recent webinar titled “Inside Asia Pacific’s Fraud Crisis and the Battle to Stop It“ highlighted that the financial losses to fraud in Asia hit US$688 billion in 2024, more than Thailand’s entire GDP.

Troy, Htwe Nyi Nyi, Senior Vice President and GM for APAC at SEON, shared,

“The criminals don’t wait for the onboarding anymore. They try to probe the parameter through device bombs, or maybe mule accounts, and also multiple account creation.”

This widening gap between transaction speed and protection could become even more pronounced in cross-border contexts.

Even when the destination of illicit funds is identified, recovery is often impossible due to fragmented monitoring, jurisdictional barriers and limited real-time coordination.

This results in a system optimised for seamless payments but ill-equipped for seamless fraud prevention, a structural imbalance that automation-led defence is increasingly expected to address.

Automation could enable institutions to introduce friction only when risk signals spike, pausing suspicious transactions, escalating reviews and activating cross-ecosystem alerts, all while allowing legitimate activity to continue uninterrupted.

Therefore, just as payment rails become instant and without borders,  fraud detection, intelligence sharing and accountability should follow in a similar way, too.

Navigating the Terrain of Innovation and Accountability

To thrive in 2026, Hong Kong banks must shift from a defensive posture to a strategic deployment of their significant financial strength. Although it remains a well-capitalised and highly liquid sector, the report indicates that profitability is no longer guaranteed by market conditions.

Benjamin Man, Partner for Financial Services at KPMG China, shares,

“US-China tensions, tariffs and diverging monetary policies are all influencing Hong Kong’s operating environment. Against this backdrop, banks need to make some clear choices about how they use their strong capital and liquidity – how much to direct to managing credit risks, and how much to direct towards new market opportunities.”

To truly ace financial performance, Benjamin shares that banks should allocate to areas where demand is the strongest, while simultaneously focusing on opportunities that offer the most attractive risk-adjusted returns.

Featured image by user8285578 on Freepik