The Agentic Compliance Playbook: Implementing HKMA-Compliant Video Onboarding

Start with what the regulator actually said. The Hong Kong Monetary Authority has issued supervisory guidance directing authorized institutions to deploy multi-layered deepfake detection across remote onboarding channels, and the direction is unambiguous: a human staring at a video feed is no longer an acceptable control. The threat model that guidance responds to is a market flooded with camera injection toolkits, virtual driver frameworks, and synthetic video generators that a trained reviewer cannot reliably tell from a genuine capture. When the supervisor writes that visual inspection is obsolete, the institutions that keep a person in the liveness loop are documenting a control they can no longer defend.

The scale behind the guidance is what makes it urgent. Deepfake presentation attacks are no longer a boutique threat run by specialists; they are industrialized. Detection systems across regulated finance screened more than 6 billion deepfake checks in the past year, a volume that only makes sense in a world where synthetic media is cheap, automated, and pointed directly at banking onboarding funnels. The cost of getting the verdict wrong compounds on both sides: fraud losses when a synthetic identity gets through, and abandoned applications when a clumsy check drives a genuine customer away. PYMNTS research puts revenue lost to identity verification failures at $34 billion annually across financial services.

An HKMA-compliant video onboarding stack answers the guidance with architecture, not headcount. This playbook builds it in five phases. Phases 1 and 2 move verification to the client edge and hand continuous monitoring to autonomous agents. Phase 3 constructs the proof architecture that turns every capture into examiner-grade evidence. Phase 4 migrates you off software-only liveness without opening an onboarding gap. Phase 5 instruments the measurement loop that keeps the program supervisory-ready as the 2026 mandate stack tightens.

Pull quote

“A human in the liveness loop is not a control the HKMA will credit in 2026. It is a witness to a fraud the reviewer was never equipped to see.”

— deepidv Compliance Engineering

**Phase 1: Hardening Client-Edge Ingestion and Camera Pipelines**

Server-side processing of uploaded static images introduces processing latency and leaves applications vulnerable to virtual camera scripts operating behind mobile web views. Verification engines must evaluate device signatures and hardware attestations directly at the point of capture.

The failure is architectural, not incremental. A camera injection toolkit sits between the sensor and the application, feeding a synthetic video stream into the browser or web view before your pipeline ever receives a frame. Everything downstream then faithfully processes imagery it had no way to authenticate: the cloud model scores pixels it cannot vouch for, and the reviewer approves a face that was never in the room. Provenance has to be established where the light actually hits the hardware. That is why the first verification layer belongs on the client, bound to the silicon, and not in a server that only ever meets the attacker's output.

**The Edge Telemetry Validation Matrix: three core verification layers**

Hardware Enclave Attestation. Execute a cryptographic challenge exchange with the mobile device's secure enclave to confirm live capture from a physical lens. The handshake terminates in silicon, so a virtual camera driver or emulator cannot forge a valid response without defeating the hardware root of trust itself. This is the layer that neutralizes the entire injection class the HKMA guidance targets, and it is the layer a human reviewer could never provide. Review integration specifications on our Technology Hub, and see how the same primitive underpins both online verification and in-person verification.

Verifiable Credential Ingestion. Utilize the Arc gateway to ingest decentralized digital wallet attributes, mDL tokens, and eID credentials via the Arc Gateway. Wallet-issued and government-issued credentials arrive already signed by the issuing authority, which lets the engine skip redundant document capture for credentialed applicants while keeping the cryptographic chain intact end to end. Where a physical document is still required, pair the capture with NFC verification of the chip and document verification of the printed data page so the credential and the physical artifact are checked against each other, with biometric matching binding the live face to the credential photo.

Sub-150ms Execution Boundary. Complete all client-edge signal evaluation and liveness checks within 150 milliseconds to eliminate onboarding drop-off and maximize conversion. Speed is a security property here, not just a product one: verification that finishes inside a UI transition closes the window that injection tooling needs to inject, and it is invisible to the genuine user who simply proceeds. Run face liveness and deepfake detection inside that budget, compiled for on-device execution, so the full presentation-attack surface is covered without a server round trip.

**Pitfalls in the intake layer**

The most common pitfall is partial coverage. Teams attest the native mobile app, ship it, and leave the mobile web flow on legacy cloud capture, and within days the fraud traffic migrates to the weaker door. Enforce the same attestation matrix on every ingestion surface, native and web, or you have simply told the adversary which channel to use. The second pitfall is treating the 150 millisecond boundary as a server-side SLA. The budget is client-edge by definition; a fast cloud round trip is still a round trip that an injection toolkit can sit inside. Measure the boundary on the device, from sensor capture to signal verdict, and treat any surface that cannot meet it as a gap to close rather than an exception to document.

**Phase 2: Deploying Autonomous Compliance Agents**

Static database matching executed on fixed schedules cannot keep pace with evolving fraud vectors or changing regulatory mandates. Autonomous agents deliver continuous monitoring and real-time threat containment across active user accounts.

The HKMA guidance is not a one-time gate; it describes an ongoing supervisory expectation, and injection techniques evolve faster than any quarterly model-refresh cycle. A detection model tuned against last quarter's toolkits degrades silently against this quarter's, and a watchlist re-screened on a monthly batch is three weeks stale the day after it runs. Continuous supervision means the compliance logic runs as a resident process that evaluates events as they occur. The practical way to build that is to assign the work to purpose-built agents with defined authority, defined inputs, and a defined record of what they did.

**Operational Role Blueprint for Luna and Arbiter**

Luna (Compliance Co-Pilot). Luna ingests regulatory alerts, watchlists, and policy updates in real time, automatically updating risk-scoring rules and writing the audit log as she goes. When the HKMA publishes an updated expectation or a name lands on a sanctions delta at 09:14, the affected controls and customer risk scores are updated at 09:14, not at the next scheduled review. Luna wires directly into sanctions list screening, continuous monitoring, and the risk scoring engine, so a single material event propagates across every control domain at once. Learn more at the Luna Agent Hub, and see how she plugs into the broader KYC compliance program.

Arbiter (Autonomous Red Agent). Arbiter simulates adversarial attacks against onboarding endpoints, testing edge defenses against virtual camera drivers and synthetic persona kits before a real attacker does. Concentrating verification at the client edge is a strength in defense and a single boundary an adversary will study relentlessly; Arbiter's continuous red-team probes are how you guarantee that boundary holds. Every model update, threshold change, and rule deployment is re-attacked with the latest injection toolkits, and each finding opens a case in the same queue your analysts already work. Explore test parameters at the Arbiter Red Suite, and pair its findings with the deepfake detection telemetry it exercises.

Pull quote

“Concentrating verification at one edge is only safe if something attacks that edge every day. Arbiter exists so the first serious adversary your video stack meets is one you employ.”

— deepidv Red Team Practice

**Pitfalls in agent deployment**

The first pitfall is granting the agents visibility without authority. If Luna can detect a synthetic-media match but cannot suspend an in-flight onboarding pending human review, you have built a faster alarm on the same broken response loop; wire the co-pilot to containment actions with human-in-the-loop confirmation for high-impact verdicts. The second pitfall is feeding the agents from stale mirrors of watchlist and guidance data. Event-driven response is only as fresh as its slowest feed, so every upstream source, from the sanctions list to the supervisor's own bulletins, needs a monitored latency budget of its own.

**Phase 3: Building the Proof and Audit Architecture for HKMA Examiners**

Phases 1 and 2 produce decisions. Phase 3 makes them provable. An HKMA examiner testing an outcomes-based control will not accept a policy binder describing what your system should do; they will ask you to demonstrate what it did for a specific customer on a specific day. The unit of proof is the capture event: an append-only record written at the moment of every onboarding attempt and every subsequent recalculation, capturing what the device attested, what the models concluded, and why. Assembled in time order, those events are the onboarding's living evidence, and the ability to replay them is what an outcomes-focused supervisor means by assurance.

Each capture event must answer a fixed set of questions without a human assembling context after the fact. What did the hardware enclave attest, and did the challenge-response terminate in genuine silicon. What did the liveness and deepfake models score, by model version. What credential was ingested through Arc, and how was it verified. What verdict resulted, and which rule set produced it. Who, if anyone, was escalated to, and how did the case close. If any answer requires an analyst to reconstruct it from three vendor portals after the examiner asks, you are running a fragmented stack at the evidence layer, which is precisely the layer where supervisory findings are written.

The proof architecture also changes what your reviewers do. When the enclave attests provenance and the models document their own reasoning, level-one review stops being a hopeless guessing game against synthetic media and becomes verdict validation, which is where human judgment actually earns its cost. This is the practical answer to the guidance: the human moves from the liveness loop, where they were structurally outmatched, to the exceptions queue, where an attested, machine-reasoned case arrives with its evidence already attached. For the forensic layer underneath the case record, see our telemetry forensic framework for identity tampering.

Pull quote

“Examiners have stopped grading intent. The only thing an outcomes-based review credits is a decision you can replay, attested from the silicon up.”

— deepidv Compliance Practice

**Phase 4: Migrating Off Software-Only Liveness Without a Compliance Gap**

No supervisor will accept an onboarding outage as the price of a better architecture, so the migration pattern is shadow-first. Run the hardware-attested video stack in parallel with the incumbent software-only liveness system, feeding both the same live traffic, and compare verdicts for a full onboarding cycle before the new stack makes a single production decision. The shadow period is not dead time: it calibrates thresholds against your real applicant population, surfaces exactly how many injection attempts the software-only system was passing, and produces the before-and-after evidence that makes the migration itself defensible to your board and to the HKMA.

Cut over one surface at a time. Start with the highest-volume onboarding channel, where the sub-150ms edge stack delivers an immediate conversion gain and the cleanest attack telemetry; then extend to the remaining native and web surfaces; then retire the manual video-review desk, which is the moment hardware attestation formally replaces human liveness inspection. Keep the incumbent system in listen-only mode for one further cycle after each cutover so you can prove parity, then decommission it. Institutions that skip the staged cutover and switch everything at once are gambling their authorization on a system with no production history.

**Phase 5: Measurement and Supervisory-Readiness**

A hardware-attested stack gives you, for the first time, metrics that describe the control the HKMA is actually asking about. Instrument five from day one. Attestation coverage: the share of captures that completed a genuine enclave challenge-response, by channel, with any un-attested surface flagged as a live gap. Edge execution time: the client-side verification budget, held under 150 milliseconds at the 95th percentile. Injection interception rate: the share of Arbiter-simulated and live injection attempts blocked at the edge, tracked per model version so drift is visible. Verdict precision: the share of escalations that survive human review. Event-to-response latency: the time from a guidance or watchlist change publishing to the affected controls updating, which is the number that proves continuous monitoring is more than a slide.

Supervisory-readiness is the rehearsed ability to demonstrate all of this on demand, and the direction of travel across regulators makes it non-optional. Global authorities are converging on outcomes-based compliance testing, and the 2026 mandate stack keeps tightening around the same principle the HKMA guidance embodies: prove the outcome, not the intent. In the United States, the public-comment window on the stablecoin customer identification program mandates closes on August 21, extending the same attestation expectations toward digital-asset onboarding and crypto rails. An institution that can replay any customer's attested onboarding history and show live interception metrics walks into that examination with evidence. An institution with a manual review desk and a policy binder walks in with a narrative.

Rehearse the examiner walkthrough quarterly, end to end, with the people who would actually run it. Pull a random customer. Replay their onboarding from the capture log. Show the enclave attestation result, the liveness and deepfake model versions that scored the capture, and the credential Arc ingested. Show Arbiter's most recent findings against the production edge and the closure record for each. Then show the program-level metrics trending across quarters. That walkthrough, executed cold, is the difference between an outcomes-based examination and an enforcement conversation. For the trust architecture beneath the whole program, see our note on the architecture of trust for agentic AI compliance.

Build the five phases in order and the obsolete control the HKMA warned about, a human squinting at a video feed they were never equipped to authenticate, gives way to architecture: provenance attested from the silicon, synthetic media intercepted at the edge, risk recalculated the moment guidance or a watchlist changes, and every capture writing its own evidence. Visual human inspection does not survive this decade of supervision; the only question is whether you retire it on your schedule or a regulator's. For the guidance context driving the shift, see our coverage of the HKMA deepfake-detection guidance, and pair this guide with the companion playbook on continuous KYA and BSA verification.