HKU Business School — Capstone Project Proposal
Agentic Readiness
Assessment
A re-skinnable enterprise framework for answering a question more boards are asking:
“We have AI in production. Our board wants us to go further — autonomous agents making decisions without human approval. Under what conditions can we safely do that?”
The Enterprise Gap
SME Reality
An HK electronics manufacturer replaced their entire SaaS stack with agentic AI tools, consuming 250M tokens/day (Forrester, 2026). Blast radius: one company.
Enterprise Reality
Cathay Pacific, with 27,000 employees, planes in the air, and regulatory exposure, cannot move at SME speed. The gap between “AI works” and “we trust autonomous AI” is enormous.
Forrester, March 2026
“When Code Gets Cheap, Judgment Gets Exposed” — large organizations lack workflow clarity and governance confidence for AI-generated systems.
Frederic Giron, VP Senior Research Director →Most capstones end with a strategy deck. This one generates actual experimental evidence about AI autonomy — giving students something far rarer: a scientific instinct about technology.
The central research question: where does autonomy break down? Students may discover that autonomy works well where reversibility is high, fails where accountability chains are unclear, and that regulation becomes the dominant constraint in financial services. The bottleneck for agentic systems may not be intelligence — it may be institutional risk tolerance. That pattern itself becomes the research output.
Why Hong Kong Needs Its Own Framework
NIST, EU AI Act, and Singapore's Model AI Governance are strong starting points — but none account for Hong Kong's unique position. This capstone synthesizes a framework tailored to the jurisdiction where international finance meets mainland China.
HK-Specific Regulatory Landscape
- →HKMA GenAI Circular (Nov 2024) — consumer protection principles for AI in banking
- →SFC Circular 24EC55 (Nov 2024) — GenAI in licensed corporations; investment advice classified as “high-risk”
- →PCPD AI Framework (Jun 2024) — first AI-specific data protection framework in Asia-Pacific
- →GenA.I. Sandbox++ (Mar 2026) — HKMA's expanded AI sandbox under Fintech 2030
Cross-Border Complexity
- →PIPL — HK-to-mainland transfers are treated as international under China's data law; requires CAC security assessment or GBA Standard Contract
- →CAC Algorithm Registration — agents serving mainland users with recommendation capabilities must register with the Cyberspace Administration
- →Generative AI Measures — China's 2023 rules don't apply to HK, but any enterprise with mainland operations must comply there
- →Triple compliance — an HSBC or AIA operating across HK, mainland, and EU faces PDPO + PIPL + GDPR simultaneously
No existing framework handles this intersection. The capstone deliverable is an HK-specific agentic governance framework — built from international best practices, localized for the regulatory and cross-border realities HK enterprises actually face.
7-Dimension Framework
Students evaluate operational domains across seven dimensions, each classified on a four-level scale (A–D) with narrative anchors rather than numerical scores. The result is a risk fingerprint per domain — a pattern that preserves reasoning rather than collapsing it into a single number. The framework stays the same; the industry context changes per partner.
Decision Reversibility
Can the action be undone?
Rebooking a passenger vs. cancelling a flight
Failure Blast Radius
If the agent is wrong, how many people or dollars are affected?
One customer complaint vs. system-wide outage
Regulatory Exposure
Does this decision touch safety, privacy, or compliance?
Product recommendation vs. autonomous lending approval
Human Override Latency
How fast can a human intervene? Is that fast enough?
Seconds for content moderation vs. milliseconds for trading
Data Confidence
Does the agent have enough signal to act?
Structured pricing data vs. ambiguous customer intent
Accountability Chain
When the agent acts, who is responsible? Can you audit the decision?
Logged API call vs. opaque model inference
Graceful Degradation
When the agent fails, does it fail safely — or cascade?
Fallback to human queue vs. silent data corruption
One Framework, Many Partners
The assessment framework stays the same. The operational domains change per financial services partner. Each column below represents one potential capstone engagement.
Banking
e.g. HSBCCustomer Onboarding
AI-assisted KYC
→ Autonomous account approval?
Fraud Detection
Real-time alerts for human review
→ Autonomous transaction blocking?
Credit Decisions
AI-scored recommendations
→ Autonomous lending?
AML/CFT
HKMA mandated AI feasibility study (Sep 2024)
→ Autonomous suspicious transaction reporting?
Insurance
e.g. AIAClaims Processing
AI-assisted assessment
→ Autonomous claims approval?
Underwriting
ML risk scoring
→ Autonomous policy pricing?
Fraud Detection
Pattern-based flagging
→ Autonomous claim rejection?
Customer Service
Chatbot triage
→ Autonomous policy changes?
Capital Markets
e.g. HKExMarket Surveillance
AI-assisted anomaly detection
→ Autonomous trading halt?
Algorithmic Trading
SFC-regulated electronic trading
→ Autonomous strategy adjustment?
Compliance
AI-assisted document prep
→ Autonomous regulatory filing?
Risk Management
Real-time exposure monitoring
→ Autonomous position liquidation?
Digital Banking
e.g. Mox, ZA BankCredit Scoring
Alternative data ML models
→ Autonomous lending decisions?
Customer Lifecycle
AI-driven engagement
→ Autonomous product recommendations?
Fraud Prevention
Real-time transaction monitoring
→ Autonomous account freezing?
Regulatory Reporting
Semi-automated HKMA returns
→ Autonomous compliance filing?
5-Week Structure
Framework Design
Synthesize an HK-specific governance framework from international inputs: NIST AI RMF, EU AI Act risk tiers, Singapore Model AI Governance. Layer in HK-specific regulation: HKMA BDAI/GenAI circulars, SFC algo trading rules, PCPD AI framework, and cross-border considerations (PIPL, GBA data flows, CAC algorithm registration).
Domain Mapping
Interview stakeholders or use public information to map the partner's operational domains against the framework. Identify current state.
Gap Analysis & Scenarios
Adapt and extend a pre-built starter scenario library (organized by risk tier) to the partner's specific domains. For each domain, model "what if the agent is wrong" scenarios. Classify risk fingerprints across dimensions. Identify conditions for readiness.
Recommendations & Roadmap
Apply gating rules to risk fingerprints: which domains are ready NOW, which need prerequisites, which should stay human-in-loop. Build the decision tree.
Report & Presentation
Final deliverable to partner leadership. Risk fingerprint map across all operational domains with gating rule outcomes and readiness classifications.
Value Exchange
Corporate Partners Get
- →An independent readiness assessment — not their vendor's pitch deck
- →A risk-scored roadmap for which domains to automate first
- →A governance framework with accountability and audit trails
- →Student talent pipeline — 8 MFFinTech graduates who understand their operations
- →Academic credibility via HKU Business School partnership
Students Get
- →A real consulting engagement with a corporate partner
- →Scientific instinct about AI claims — not just prompt engineering
- →Resume line: “Developed agentic AI readiness framework for [major HK enterprise]”
- →Hands-on experience with NIST AI RMF, EU AI Act, HKMA/SFC circulars, and cross-border data regulation (PIPL, GBA)
- →Potential co-authorship on publishable methodology paper
Research Output
- →An HK-specific agentic governance framework — the first of its kind for this jurisdiction
- →Cross-sector dataset on agentic readiness thresholds in HK financial services
- →Empirical evidence: which domains are universally ready vs. not
- →Framework paper publishable regardless of which partner participates
- →Over multiple semesters: an aggregated dataset of risk fingerprints across HK financial services — a map of where autonomy is safe
Data Model
Framework — Open
Dimensions, classification rubric (A–D levels), gating rules, assessment methodology, risk taxonomy. Published and reusable.
Partner Data — Proprietary
Actual risk fingerprints, operational details, failure modes, specific findings. Confidential to each partner.
Aggregated Insights — Shareable
“Across N enterprises, customer service automation clusters in high-reversibility, low-blast-radius domains; credit decisions cluster in high-regulatory-exposure domains.” Publishable patterns without revealing any single company.
Research Foundation
ConFIRM
William Gazeley et al.Personality-informed synthetic data generation. Different stakeholders (risk-averse ops directors, aggressive CROs, compliance-focused legal) have different thresholds for “ready.” The framework can be personality-aware.
King Wen Learning
Augustin ChanThe readiness framework is itself a form of structure — and structure may be the point. The finding may be: structured decision rules outperform autonomous agents in domains X and Y, but agents outperform in Z. Sometimes sequence matters more than intelligence.
Partners
IRAI Labs
Independent Research AI — Hong Kong, est. 2024
Independent AI research lab with publications in NLP and LLM fine-tuning (ConFIRM, LLM-ADE). Research consulting at the intersection of ML and domain expertise. Active supporter of AI Tinkerers Hong Kong.
Digital Rain Technologies
AI Consulting & Enterprise Architecture — Hong Kong
AI consulting firm specializing in LLM integration and intelligent automation for HK enterprises. Active supporter of AI Tinkerers HKGBA.
Corporate Target List
All companies below are past HKU capstone partners or major HK enterprises with active AI programs. Each partner receives an independent readiness assessment at no cost, plus a team of 8 MFFinTech students who deeply understand their operations.
| Company | Why They'd Care | Status |
|---|---|---|
| HSBC | HKMA GenAI sandbox participant, Basel III AI risk, PIPL cross-border exposure | Past HKU partner |
| HKEx | Market surveillance AI, regtech (Kwan et al. 2024), SFC algorithmic trading oversight | Past HKU partner |
| AIA | Insurance claims AI, cross-border data (HK/mainland/ASEAN), regulatory scrutiny | Past HKU partner |
| Mox / ZA Bank | Digital-native banks, AI-first credit scoring, HKMA virtual bank licensees | 8 licensed digital banks |
| Tencent | WeChat Pay, fintech infrastructure, CAC algorithm registration obligations | Past HKU partner |
| Cathay Pacific | AI chatbot (Fano Labs), BCG-built IOC, Microsoft 365 Copilot — non-financial reference case | Indirect contacts |
Next Steps
Let's Build This Together
The ideal capstone is one where every party gets exactly what they need from the same work. Corporate partners get an independent assessment. Students get a scientific instinct. We get a reusable methodology that generates cross-industry data.
Prepared March 2026 — IRAI Labs × Digital Rain Technologies