InvestNot yet confirmed elsewhere1 publisher2 min readPublished
Hong Kong regulators test blockchain IDs that tie AI agents' payments to verified customers
HKT Payment is testing, in a Hong Kong regulator's sandbox, a blockchain 'agentic ID' that ties an AI agent's payments to a verified person or company. The pilot brings the question of whom an agent acts for under supervisory review, though the report describes a test and no rule.
The Investor · Invest desk

HKT Payment plans to test an agentic ID in a regulator sandbox. Financial firms must confirm agent authority beyond KYC, could screen out unverified agents, and still need access controls and approvals. Raonsecure is building AAM to limit agents to permitted tasks.
- capability HKT Payment Plans to test an agentic ID in the regulator's GenA.I Sandbox++ that verifies identity when an AI agent pays or transfers, claim 2
- constraint Financial firms Must separately confirm the customer gave the agent authority to send money, and how far; KYC alone does not grant it, claim 6
- capability Financial firms' screening Could screen out agent requests whose identity or transaction authority has not been verified, claim 11
- cost Payment firms' security Still need separate access controls and transaction approvals, since a verified agent can be hijacked, claim 12
- capability Raonsecure Signed an April agreement with Upstage; building AAM, which gives each agent an identity and role and only permitted tasks, claim 8
| Who | How | Kind | Claim |
|---|---|---|---|
| HKT Payment | Plans to test an agentic ID in the regulator's GenA.I Sandbox++ that verifies identity when an AI agent pays or transfers | capability | 2 |
| Financial firms | Must separately confirm the customer gave the agent authority to send money, and how far; KYC alone does not grant it | constraint | 6 |
| Financial firms' screening | Could screen out agent requests whose identity or transaction authority has not been verified | capability | 11 |
| Payment firms' security | Still need separate access controls and transaction approvals, since a verified agent can be hijacked | cost | 12 |
| Raonsecure | Signed an April agreement with Upstage; building AAM, which gives each agent an identity and role and only permitted tasks | capability | 8 |
What happened
- HKT Payment, the financial arm of Hong Kong telecoms group HKT, was selected in August for the regulator's GenA.I Sandbox++ program.
- HKT Payment is building the ID with blockchain firm Red Date Technology to cut the risk of impersonation and unauthorised transactions.
- In South Korea, Raonsecure signed an April agreement with Upstage to build Agentic AI Management, which restricts each agent to permitted tasks.
- Officials from the Ethereum Foundation, Google and Coinbase took part in proposing ERC-8004, a standard giving agents an identifier verifiable on the blockchain.
- Mysten Labs said on the 6th it is developing Verifiable Agent Arbiter with Google Cloud to keep tamper-evident records of what agents do.
Why it matters
- constraint Payment firms cannot retire access controls or transaction approvals on the strength of an agent ID, because a verified agent can still be hijacked, so the ID is a cost added to the controls they already run.
- precedent A regulator-led pilot makes agent mandates a supervisory subject in Hong Kong, so firms there should expect to be asked how they verify an agent's authority before they offer agent payments.
- decision Firms that want to cap agent spending now must choose between building to existing Ethereum-ecosystem limit standards and waiting to see what Hong Kong's regulators conclude.
Know-your-customer checks establish who a customer is. When that customer's AI agent asks for a transfer, the firm still has to confirm separately that the customer gave the agent authority to send money, and how far it may go [6]. The Sedaily report describes this as the gap the new IDs are meant to close [6]. HKT Payment's version is built to prove on whose behalf an agent is acting [5], and the category's broader aim is to keep agents inside approved limits [3]. A firm holding such IDs could refuse requests from agents whose identity or authority does not verify [11].
The rest of the field is organised differently. Of the four efforts the report describes, only HKT Payment's runs inside a regulator's program [15], and it pairs one payments firm with one blockchain supplier [4]. Google is involved in two of the other three, through the ERC-8004 proposal and the Mysten Labs arbiter [16]. Hashed chief executive Kim Seo-joon wrote in February that agents from different companies need a neutral basis of trust that no single company controls [7]. Blockchain, he argued, lets several companies check an agent's identity, reputation and task data within one shared framework [7]. In an April report, a16z crypto said there was still no widely used method to prove on whose behalf an agent acts or what authority it holds [14].
Three outcomes fit the evidence. Hong Kong's regulators [1] could turn the binding of agent to customer into guidance, so that supervised firms have to show a mandate check for every agent payment. They could accept an open standard such as ERC-8004 [9], leaving no single vendor in control of the identity layer. Or the sandbox could close as a test. Spending limits would then stay a feature each bank designs and prices for itself.
We think the first is the most likely in Hong Kong. A regulator is running the test [1], and the gap it targets sits with the financial firm, which carries the authority check today [6]. The counter-case is that a sandbox is an experiment. The report does not give the pilot's cost or timeline, or say whether spending caps are part of what the regulator is testing. If the program ends without a stated expectation on agent mandates, or if banks adopt open spending-limit standards before the regulator says anything, this view is wrong, and agent limits remain a product decision.
What to watch
- Whether Hong Kong's regulators publish findings or guidance from GenA.I Sandbox++ that address agent mandates or spending caps.
- Whether HKT Payment's agentic ID interoperates with ERC-8004 or stays a single-vendor build with Red Date Technology.
- Whether any sandbox participant reports dropping a manual approval step for agent payments once agent IDs verify.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence38
- Adoption12
- Hype gap+20
- Incentives55
- Confidence40
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A pilot project led by financial regulators to verify the identity of AI agents is under way in Hong Kong, according to the financial industry on the 11th.
- [2]
HKT Payment, the financial subsidiary of Hong Kong telecommunications company HKT, was selected in August as a participant in the regulator's GenA.I Sandbox++ program and plans to test an 'agentic ID' that verifies identity when an AI agent makes a payment or transfer on a user's behalf.
- [3]
The idea is to issue a kind of digital ID to AI agents that make payments or transfers on behalf of people, and to ensure they handle tasks only within approved limits.
- [4]
HKT Payment is developing the agentic ID with blockchain technology firm Red Date Technology; the aim is to reduce the risk of impersonation and unauthorized transactions.
- [5]
The agentic ID links an AI agent to an individual or company whose identity has been verified, proving on whose behalf the agent is carrying out financial transactions.
- [6]
Verifying a customer's identity through KYC does not mean transaction authority has been granted to an AI agent acting for that customer; if an agent requests a transfer, the financial firm must separately confirm whether the customer gave the agent authority to send money and how far transactions are permitted.
- [7]
Kim Seo-joon, chief executive of Hashed, said in a February blog post that AI agents from different companies need a neutral basis of trust that no single company controls, and that with blockchain multiple companies can check an agent's identity, reputation and task verification data within a shared framework.
- [8]
Raonsecure signed an agreement with Upstage in April and is building Agentic AI Management (AAM), which assigns each AI agent an identity and role and allows it to perform only permitted tasks, drawing on blockchain technology Raonsecure applied to South Korea's mobile ID.
- [9]
ERC-8004, a leading Ethereum standard, gives AI agents a unique identifier verifiable on the blockchain and manages user ratings and verification results; officials from the Ethereum Foundation, Google and Coinbase took part in the proposal.
- [10]
Standards have also appeared in the Ethereum ecosystem for assessing the risk level of cryptocurrency wallets used by AI agents and for limiting transaction amounts and the scope of their actions.
- [11]
Financial firms could use such technology to screen out requests from AI agents whose identity or transaction authority has not been verified.
- [12]
The technology does not block external hacking that uses AI; because even a verified AI agent can be hijacked or abused, separate access controls and transaction approval procedures are needed.
- [13]
Mysten Labs said on the 6th that it is jointly developing Verifiable Agent Arbiter (VAA) with Google Cloud; an agent's instructions, results and tool use are stored in a company-managed cloud, with proof data that the records have not been tampered with linked to the blockchain.
- [14]
a16z crypto noted in an April report that there is still no widely used method to prove on whose behalf an AI agent acts and what authority it holds.
- [15]
Of the four agent identity or verification efforts the report describes (HKT Payment/Red Date agentic ID, Raonsecure/Upstage AAM, ERC-8004, Mysten Labs/Google Cloud VAA), one runs inside a regulator's program.
- [16]
Google is involved in two of the three efforts outside the Hong Kong sandbox: the ERC-8004 proposal and the Mysten Labs VAA project.
Sources
1 independent publisher whose own reporting we read for this story.
- en.sedaily.comCan Blockchain Verify AI Agents as AI-Driven Hacking Surges?
1 article · October 10, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI Agent IdentityFollow
- Regulatory SandboxesFollow
- Agentic paymentsFollow
- Blockchain-based digital identityFollow
Entities
- HKT PaymentFollow
- HKTFollow
- Red Date TechnologyFollow
- GenA.I Sandbox++Follow
- RaonsecureFollow
- UpstageFollow
- ERC-8004Follow
- Ethereum FoundationFollow
- GoogleFollow
- Google CloudFollow
- CoinbaseFollow
- Mysten LabsFollow
- Verifiable Agent ArbiterFollow
- Agentic AI ManagementFollow
- a16z cryptoFollow
- HashedFollow
- Kim Seo-joonFollow