Quincecare Duty in the Age of Automated Screening: Navigating Uncharted Territory in Hong Kong

The way banks monitor and process transactions has changed dramatically over the past decade. Where once human bankers were responsible for scrutinizing payments and investigating suspicious activity, today those decisions are increasingly outsourced to algorithms and artificial intelligence.

This digital shift creates profound legal and operational questions—especially around the Quincecare duty, the obligation of banks to act with reasonable care when they suspect fraud.

In Hong Kong, the courts have recently clarified this duty in human-led contexts. But as automation and regulatory integration reshape transaction monitoring, the question remains: how should Quincecare principles apply when it is machines—not people—making the first call?

From Human Oversight to Algorithmic Precision

The Quincecare duty has long been anchored in the idea of the “reasonable banker.” In practice, this meant a professional exercising judgment: noticing unusual patterns, escalating concerns, and—when necessary—refusing to process payments.

The landmark PT Asuransi Tugu Pratama Indonesia TBK v Citibank NA [2023] decision confirmed that banks cannot adopt a passive stance. When “features of the transaction” suggest wrongdoing, they must actively investigate.

But that case—and the duty itself—was framed in a world where humans reviewed suspicious transactions. In today’s environment, millions of payments flow through automated systems calibrated by algorithms, machine learning models, and preset thresholds. These systems are fast and consistent, but they lack the context, intuition, and discretion of a human banker.

This creates a fundamental tension: how can a duty built on human cognition be applied to algorithmic systems?

Hong Kong’s Regulatory Response

The Hong Kong Monetary Authority (HKMA) has taken bold steps to address rising fraud risks in this new landscape. Several initiatives directly intersect with the Quincecare framework:

• E-Banking Security ABC (2025).

  
  

  • “Authenticate in-app”: requiring bound devices instead of SMS OTPs for key activities.

  • “Bye to unused functions”: allowing customers to deactivate risky functions like third-party payee registration.

  • “Cancel suspicious payments”: enhancing alerts under the Suspicious Account Alert mechanism.

    
    

• Suspicious Account Alert Mechanism.Rolled out progressively since 2023, this provides warnings across Faster Payment System (FPS), internet banking, ATMs, and branch transactions.

  
  

• Scameter and Scameter+.Police-led systems integrated with banking channels to warn customers if a recipient account is deemed high-risk.

  
  

• Money Safe.A deposit protection feature enabling customers to ring-fence funds from outbound transfers unless re-verified.

  
  

Together, these measures create a new baseline for what counts as “reasonable” detection and intervention. In effect, regulators are helping redefine the Quincecare duty for the digital era.

Legal Questions in the Age of Automation

This shift raises questions Hong Kong’s courts have yet to fully test:

1. What is a “reasonable banker” when the banker is an algorithm?If reasonableness is benchmarked against compliance with HKMA standards, courts may interpret automated adherence to regulatory alerts as fulfilling the duty.

   
   

2. When is an automated system “put on inquiry”?In human terms, being “on inquiry” arises when red flags are visible. For algorithms, it may mean when system alerts, regulatory data (e.g., Scameter warnings), or suspicious account markers are triggered.

   
   

3. What constitutes adequate inquiry?Historically, banks had to question customers or escalate concerns internally. In an automated environment, does adequate inquiry mean escalation to a human review team? Or is automated cancellation sufficient?

   
   

4. What role does governance play?Courts may focus more on how banks calibrate, audit, and govern automated systems rather than expecting algorithms to replicate human intuition.

   
   

Wider Implications Across Asia-Pacific

These debates are not unique to Hong Kong. Across Asia-Pacific, regulators are tightening fraud and AML expectations, and automation is central to compliance strategies:

• Singapore. MAS has mandated real-time scam intervention, requiring banks to block or delay payments flagged as high-risk and introduce pre-transaction warnings.

  
  

• Australia. AUSTRAC and ASIC continue to highlight scam response obligations, with growing expectations that AI and data sharing underpin detection frameworks.

  
  

• India and Indonesia. Banks are under pressure to scale automated detection as digital adoption surges, but fragmented systems create blind spots that complicate any “reasonable banker” benchmark.

  
  

• Regional cross-border payments. With the rise of real-time payment systems like Singapore’s PayNow or Hong Kong’s FPS, the ability of automated systems to detect fraud in seconds—before funds move offshore—has become mission-critical.

  
  

Each jurisdiction will need to grapple with how legal duties designed for humans translate to systems governed by data, algorithms, and regulation.

Practical Considerations for Banks

Until the courts provide clarity, financial institutions in Hong Kong and beyond face uncertainty. Some practical steps are emerging as best practice:

• System design and calibration. Automated tools must be continuously updated to reflect evolving fraud patterns and regulatory mandates.

  
  

• Human oversight protocols. Clear thresholds should determine when an automated flag is escalated for manual review.

  
  

• Audit trails. Detailed logs of system alerts, responses, and escalations will be vital for demonstrating compliance.

  
  

• Governance and accountability. Banks should ensure their compliance and risk committees regularly review how automated systems align with Quincecare obligations.

  
  

• Cross-border learning. Institutions operating across Asia-Pacific should monitor how different regulators define reasonable conduct in automated contexts, preparing for convergence or divergence in standards.

  
  

The Road Ahead

The evolution of Quincecare duty in the era of automation is uncharted legal territory. Courts in Hong Kong—and eventually across Asia-Pacific—will need to balance three realities:

1. The protective purpose of Quincecare, ensuring customers are not left unprotected against fraud.

   
   

2. The operational realities of modern banking, where automation is essential to handle transaction volumes.

   
   

3. The regulatory frameworks that increasingly define what “reasonable” detection looks like.

   
   

The likely outcome is a hybrid model: a “reasonable banker” who is neither fully human nor fully algorithmic, but instead a blend of automated precision, regulatory compliance, and human oversight.

For now, the message is clear. Banks cannot assume that automation shields them from duty. Instead, they must actively design systems and governance frameworks that reflect both regulatory expectations and the evolving legal interpretation of reasonableness.

The journey has just begun—but it will define how trust, liability, and customer protection operate in the next era of digital banking.