# HSBC scores 52 out of 100 on the Agent Readiness Index

HSBC reaches level 3, Connectable. Web experience is the strongest area at 91 out of 100. Identity and delegation is the weakest at 0.

HSBC was scanned on October 15, 2026. Its score is 52 out of 100, level 3, Connectable. An agent can connect through an MCP server or a public API program. To reach level 4, Trusted: Let customers authorize agents: OAuth with PKCE, a registration path and documented delegate controls.

Website: [hsbc.com](https://www.hsbc.com)

## Score by area

| Area | Score | What it asks |
| --- | --- | --- |
| Discoverability | 78 out of 100, worth 15 points | Can an agent find and read your pages? |
| Protocol access | 64 out of 100, worth 20 points | Can an agent connect to you through MCP or an API? |
| Identity and delegation | 0 out of 100, worth 20 points | Can a customer give an agent limited access without sharing a password? |
| Web experience | 91 out of 100, worth 15 points | Does your site work when an agent uses it? |
| Voice and IVR | Not measured yet | What happens when an agent calls your phone line? |
| Policy and governance | 36 out of 100, worth 10 points | Do your terms allow agents that act for customers? |

## What is holding HSBC back

1. **OAuth and OpenID metadata**, 5 points lost. No OAuth or OpenID metadata was found on the 4 hosts that answered. 10 other hosts did not answer the scanner and could not be checked. Agents cannot discover where to send a customer to approve access. Fix: Publish /.well known/oauth authorization server and /.well known/oauth protected resource for the customer facing APIs.
2. **Developer and data sharing program**, 4 points lost. No developer portal or data sharing program was found on public pages. Fix: Document the program, the standard in use for example FDX in US banking, the supported partners and a sandbox.
3. **PKCE and client registration**, 4 points lost. No authorization server metadata, so PKCE and client registration could not be confirmed. Fix: Require PKCE with S256 and support client ID metadata documents or dynamic client registration for approved agent clients.
4. **Passkeys at sign in**, 4 points lost. No passkey signal was found on the sign in page or in the published pages read. A prompt that starts only after a person types is not visible to the scan. Fix: Offer passkeys with conditional UI on the sign in page and for step up approvals.

## What already works

- MCP server
- Robots policy for user triggered agents
- Sign in page loads for a declared agent in a browser

## How HSBC compares

The average score for banks is 40.6 out of 100 across 46 organizations. The average across all 1,421 scored organizations is 42.2 out of 100.

## Similar organizations

- [JPMorgan Chase](https://readyindex.ai/jpmorgan_com), 55 out of 100
- [Byline Bank](https://readyindex.ai/bylinebank_com), 53 out of 100
- [Itaú](https://readyindex.ai/itau_com_br), 53 out of 100
- [Wells Fargo](https://readyindex.ai/wellsfargo_com), 52 out of 100
- [Greenlight](https://readyindex.ai/greenlight_com), 50 out of 100
- [Bank of America](https://readyindex.ai/bankofamerica_com), 49 out of 100

## More on this report

- [This report as markdown](https://readyindex.ai/hsbc_com.md)
- [This report as JSON data](https://readyindex.ai/api/reports/hsbc_com)
- [How the score is worked out](https://readyindex.ai/method)
- [All leaderboards](https://readyindex.ai/leaderboards)
- [Every scored organization](https://readyindex.ai/organizations)
- [Scan your own website](https://readyindex.ai/)

---
Source: https://readyindex.ai/hsbc_com
Updated: 2026-10-15
From the Agent Readiness Index by Encore AI. When you quote a score, please link to the report it came from.