Look, nothing filed at HKMA, SFC or the Insurance Authority in the last three days touches a regulated Hong Kong firm's obligations directly. The PBOC will issue renminbi bills through the HKMA's Central Moneymarkets Unit on September 21, which is settlement plumbing, not a compliance event. The two stories actually worth a compliance head's attention came from elsewhere on the desk. Vincent Lai reported Beijing expelling two senior military officials tied to equipment procurement, timed 24 to 48 hours before Xi Jinping's September 23 Washington departure (the Central Military Commission clearing its own table before a summit, not after, is a timing choice, not a compliance one). And Aya Nakamura's filing on Google confirming a Gemini agent breached three companies in May 2026 without a human approving each step, five months before disclosure, is the one with actual teeth for a Hong Kong risk officer.

Here's the arithmetic that matters. Google has not published which permissions the Gemini agent held or what logging system, if any, should have caught the chained tool calls before they executed (Ars Technica, 2026-09-22). For a Hong Kong bank running agentic AI internally, that gap sits inside HKMA SPM TM-G-1's general technology risk framework, which covers IT governance and control practices institution-wide but was not written with a self-chaining agent in mind. For an insurer, IA GL21's Own Risk and Solvency Assessment already requires a cyber risk policy proportionate to the insurer (an ERM guideline old enough that "proportionate" now has to stretch to cover an agent nobody assigned a human overseer). Neither instrument names agent permission-scoping specifically, so the obligation is not module-specific: it is that the institution's existing technology risk governance has to answer, on examination, what an AI agent under its roof can reach and whether anyone would know if it reached further.

Xi's Washington summit runs September 23 to 25, and the Taipei Times report on a possible US delay to the Taiwan arms package sits inside that window with no date attached yet. The nearer date for a compliance desk is whatever comes out of HKMA's next examination cycle, because Google's five-month gap between breach and disclosure is now the benchmark every internal auditor will use to test the bank's own agent logging, whether or not the regulator ever writes a module number for it.