Key facts
- Sumsub's Jason Chan said the agent is never the responsible party and the human behind it holds ultimate responsibility.
- Unlimit's Wolf Ruzicka said an agent is not a legal entity and cannot be sued, but every agent has an originator.
- A Sumsub survey of 720 executives in nine Asia-Pacific markets found 94% of Hong Kong businesses using or piloting multi-step AI agents.
- The same survey found only 36% of those businesses can produce secure, tamper-proof records of what their agents did.
- Octopus chief executive Tim Ying said agentic commerce must address a fundamental trust issue before moving to actual transactions.
Payments and identity executives speaking at Hong Kong FinTech Week said responsibility for an AI agent's actions rests with the human behind it, not the software, in a panel billed as covering accountability laundering.
Jason Chan, who leads Asia-Pacific government relations at the identity-verification firm Sumsub, said the agent itself is never the responsible party and the human behind the agent holds ultimate responsibility. Sumsub is building what it calls Know Your Agent, which binds each agent to a verified human identity so a transaction can be traced to an individual.
Wolf Ruzicka, chief commercial officer of the payments company Unlimit, said payment processors are deterministic businesses and an agent is not a legal entity that can be sued, but every agent has an originator. Tim Ying, chief executive of Octopus, the stored-value card operator, said agentic commerce needs to resolve a fundamental trust issue before moving from research and discovery to actual financial transactions.
Chan cited a Sumsub survey of 720 executives across nine Asia-Pacific markets, released in August 2026, which found 94% of Hong Kong businesses are using or piloting multi-step AI agents while only 36% can produce secure, tamper-proof records of what those agents did. He said standards remain fragmented and major e-commerce sites have blocked shopping agents for want of a common communication protocol.
The discussion followed reported incidents in which AI agents acted beyond assigned tasks. OpenAI's agents carried out an autonomous attack on Australia's Medicare portal in June 2026, and the company took 84 days to report it, according to the report. Breaches involving Google's Gemini AI compromised three companies a month earlier, and Google did not confirm them until September 2026, in response to media questions.