HKMA SPM

HKMA SPM AML/CFT + Banking Ordinance + sectoral coordination. AML/CFT MODULE FAMILY: (1) AML/CFT GUIDELINES - HKMA implementation of FATF Recommendations + Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615); KYC + CDD + EDD + screening + reporting + ongoing monitoring + transaction monitoring + SAR/STR + politically exposed persons (PEP) + sanctions; (2) AMLO IMPLEMENTATION - banks + RLBs + DTCs + remittance agents + money services operators (MSOs); JFIU (Joint Financial Intelligence Unit) coordination; (3) FATF MUTUAL EVALUATION + HKMA follow-up + sectoral assessment + remediation; (4) SECTORAL EXERCISES + supervisory dialogue + thematic reviews; HKMA AML/CFT supervisory communications. BANKING ORDINANCE (CAP. 155) INTEGRATION: SPM modules operate within Banking Ordinance + sub-regulations including Banking (Capital) Rules (Cap. 155A) + Banking (Disclosure)

• AML/CFT compliance program
• Banking Ordinance compliance
• FIRO + resolution + DPS records

• AML/CFT gaps
• Banking Ordinance compliance gaps
• FIRO + resolution weak

HKMA SPM Corporate Governance + Internal Control + Auditing modules. CG CORPORATE GOVERNANCE MODULES: (1) CG-1 Corporate Governance of Locally Incorporated AIs - board composition + independent directors + executive accountability + governance structure + fitness and propriety; key supervisory expectations for HKMA banks; (2) CG-2 Systems of Control - 3-lines-of-defense + risk management + compliance + internal audit + control environment; (3) CG-3 Code of Conduct - ethical conduct + behavioural standards + conflicts of interest + professional integrity + whistleblowing; (4) CG-5 Guideline on a Sound Remuneration System - executive + senior management remuneration aligned with risk + performance + long-term + clawback + adjustments; FSB Principles for Sound Compensation Practices + Basel principles; (5) CG-6 Competence and Ethical Behaviour - workforce capability + ethical standards + tr

• CG compliance evidence + board records
• IC framework + stress test results
• Internal audit reports + IIA alignment

• CG compliance gaps
• IC framework weak
• Internal audit weak

HKMA SPM financial risk management modules. CR CREDIT RISK MANAGEMENT: (1) CR-G General Principles - sound credit risk policies + processes + scoring + monitoring + portfolio management + concentrations + Basel principles alignment; (2) CR-G-7 Collateral and Credit Risk Mitigation - collateral management + netting + derivative collateral + Basel III CRM techniques + valuation + haircuts; (3) CR-G-13 Counterparty Credit Risk Management - derivatives + securities financing + CCR exposures + IMM + EAD calculation + EE/PFE/PD/LGD; (4) CR-G-* various sub-modules covering specific credit areas (large exposures + provisioning + impairment + classification + connected lending + others). MR MARKET RISK MANAGEMENT: MR-G + sub-modules covering trading book + market risk capital + VaR + stress testing + back-testing + FRTB; Basel III FRTB implementation; market risk capital approaches. IR INTEREST R

• Risk management framework per area
• Basel III compliance evidence
• Stress testing + ICAAP records

• Risk management weak
• Basel III gaps
• Stress testing weak

HKMA SPM crosswalk to international + sectoral standards. (a) BASEL III - BCBS Basel III capital (Pillar 1/2/3) + liquidity (LCR + NSFR) + leverage + IRRBB + FRTB + SMA operational risk + IRB + standardised approaches; HKMA implements via Banking (Capital) Rules + SPM modules (CA + IR + MR + OR + LM + CR); (b) FSB FINANCIAL STABILITY BOARD principles - operational resilience + recovery + resolution + cybersecurity + outsourcing + cyber-incident response + cyber lexicon; HKMA OR-2 + RR + SA + TM aligned; (c) FATF RECOMMENDATIONS - AML/CFT + KYC + CDD + EDD + SAR + sanctions; HKMA AMLO + sectoral AML/CFT supervision; (d) IOSCO INTERNATIONAL ORGANIZATION OF SECURITIES COMMISSIONS - coordinates with SFC for securities + futures + asset management; (e) IAIS INTERNATIONAL ASSOCIATION OF INSURANCE SUPERVISORS - coordinates with HK Insurance Authority for insurance entities; (f) IMF FSAP + Artic

• Multi-framework crosswalk + compliance
• Cross-border supervisory engagement
• Voluntary standards adoption

• Multi-framework alignment ad-hoc
• Cross-border engagement weak
• Sectoral coordination weak

HKMA SPM implementation roadmap + AI compliance + supervisory dialogue. ORGANIZATIONAL ROLES at AI: (a) BOARD + RISK COMMITTEE - SPM governance oversight + module-by-module compliance + sectoral risk integration + reporting; (b) CHIEF EXECUTIVE OFFICER (CEO) - executive accountability + supervisory engagement + tone-from-the-top; (c) CHIEF RISK OFFICER (CRO) + HEAD OF OPERATIONAL RISK - SPM module compliance lead + integrated risk management; (d) CHIEF FINANCIAL OFFICER (CFO) + TREASURER - Basel + capital + liquidity + ICAAP + regulatory reporting; (e) CHIEF COMPLIANCE OFFICER + MLRO - AML/CFT + AMLO + supervisory engagement + regulatory reporting + sanctions; (f) CHIEF INFORMATION SECURITY OFFICER (CISO) + TECHNOLOGY RISK OFFICER - TM module compliance + C-RAF + sectoral cybersecurity (verified separately); (g) GENERAL COUNSEL + LEGAL - Banking Ordinance + sub-regulations + module inter

• Role inventory + RACI
• Module compliance + remediation
• Supervisory dialogue records

• Roles undefined
• Module compliance gaps
• Supervisory engagement weak

HKMA SPM international coordination + 2024-2025+ pipeline. INTERNATIONAL COORDINATION: (a) BASEL COMMITTEE ON BANKING SUPERVISION (BCBS) - HKMA implements Basel III capital + liquidity + leverage + LCR + NSFR + IRB + IRRBB + FRTB + SMA op risk + Basel IV emerging; HKMA represents HK in BCBS; (b) IOSCO INTERNATIONAL ORGANIZATION OF SECURITIES COMMISSIONS - coordinates with SFC; (c) FINANCIAL STABILITY BOARD (FSB) - HKMA represents HK + sectoral coordination; (d) FATF - AMLO + AML/CFT mutual evaluation; (e) BIS BANK FOR INTERNATIONAL SETTLEMENTS - HKMA member + central bank coordination; (f) IMF FINANCIAL SECTOR ASSESSMENT PROGRAM (FSAP) - HK periodic FSAP + recommendations + follow-up; (g) IAIS INTERNATIONAL ASSOCIATION OF INSURANCE SUPERVISORS - coordinates with HK Insurance Authority; (h) SINGAPORE MAS + UK PRA + ECB + AUSTRALIA APRA + FEDERAL RESERVE + OCC bilateral memoranda + supervi

• International framework alignment
• Pipeline + emerging risk readiness
• Sectoral exercises + supervisory engagement

• International alignment weak
• Pipeline not tracked
• Sectoral engagement gaps

HKMA SPM status + Hong Kong International Financial Centre (IFC) positioning + future. ADOPTION: ~150+ HKMA AUTHORISED INSTITUTIONS (AIs) subject to SPM + module-by-module compliance; major participants include local + foreign + Mainland Chinese banks (HSBC + Hang Seng Bank + Standard Chartered Hong Kong + Bank of China Hong Kong + DBS Hong Kong + Citi + UBS + Goldman Sachs + Morgan Stanley + JPMorgan + Bank of America + Wells Fargo + ICBC + China Construction Bank + Bank of Communications + Industrial and Commercial Bank of China Asia + many others); RLBs + DTCs + foreign-bank branches + VBs (Virtual Banks - ZA Bank + Mox + Livi + Welab + Ant Bank + Fusion + Airstar + Ping An OneConnect); ~100 percent SPM applicability + sectoral implementation. HONG KONG IFC POSITIONING: HK as major international financial centre + Asia-Pacific gateway + China connection + global bank presence + asset

• SPM compliance + sectoral engagement
• IFC positioning + competitive analysis
• Strategic initiatives readiness

• Compliance gaps
• IFC positioning weak
• Strategic initiatives lag

HKMA SPM Operational Risk + Resilience + Recovery + Outsourcing modules. OR OPERATIONAL RISK MANAGEMENT: (1) OR-1 Operational Risk Management - sound operational risk governance + risk identification + assessment + mitigation + monitoring + reporting + RCSA + loss event management + Basel III operational risk capital (SMA standardised measurement approach implementation); (2) OR-2 Operational Resilience - HKMA Operational Resilience Framework + Important Business Services + Impact Tolerances + Mapping + Testing + Self-Assessment; aligned with FSB Operational Resilience Principles + UK PRA + FCA approach + APRA CPS 230; effective 2022 + phased + sectoral exercises. RR RECOVERY + RESOLUTION PLANNING: RR-1 Recovery Planning - sound recovery plans + governance + governance + scenarios + recovery options + triggers + assessment + HKMA review; Financial Institutions (Resolution) Ordinance (FIR

• OR-1/2 compliance evidence
• Recovery plan + scenarios
• Outsourcing risk management

• OR compliance gaps
• Recovery planning weak
• Outsourcing risk poorly managed

HKMA SPM Technology Management (TM) module family + coordination with sectoral cybersecurity frameworks. TM MODULE FAMILY: (1) TM-G-1 General Principles for Technology Risk Management - foundational module on technology risk governance + framework + roles + IT strategy + policies + risk assessment + project management + system development + change management + IT operations + capacity + problem + incident + information security + access + privileged access + network + crypto + DLP + vulnerability + endpoint + monitoring + threat intel + IR; SEPARATELY TRACKED in this corpus as detailed module; ~26 sub-section codes (TM-G-1.2.1 through TM-G-1.7.3); (2) TM-G-2 Business Continuity Planning - sound BCP + DR + IT continuity + RTO/RPO + critical service identification + testing + crisis management + supplier dependency; (3) TM-G-3 Information Technology + Cyber Risk Management - cyber risk-spe

• TM module compliance per AI
• Technology risk management framework
• Cybersecurity coordination

• TM compliance gaps
• Cybersecurity coordination weak
• Supervisory communications not tracked

HKMA SPM module lifecycle + versioning + consultation. KEY LIFECYCLE STAGES: (1) HKMA INTERNAL REVIEW + INDUSTRY ENGAGEMENT - identification of need for new module or revision based on sectoral risk + international framework changes + emerging issues + HKMA assessment; (2) DRAFT MODULE + CONSULTATION - HKMA issues draft module for industry + sectoral consultation; ~3-6 months consultation period + public comment + stakeholder engagement; (3) HKMA FINALISATION - HKMA reviews comments + makes amendments + finalises module + sectoral communication; (4) EFFECTIVE DATE + TRANSITION - typically 6-12 months transition for AIs to implement + supervisory expectations; (5) SECTORAL IMPLEMENTATION + COMPLIANCE - AIs implement + integrate into governance + risk management + reporting; HKMA supervisory dialogue + thematic reviews; (6) ONGOING SUPERVISORY DIALOGUE + REMEDIATION - HKMA assesses complia

• Module compliance per current version
• Sectoral engagement + consultation
• Recent update tracking + transition

• Version tracking weak
• Sectoral engagement absent
• Transition implementation incomplete

HKMA Supervisory Policy Manual (SPM) umbrella structure. SPM is the foundational HKMA supervisory framework + collection of ~60+ supervisory policy modules organised by subject area; modules cover all aspects of HKMA banking + financial institution supervision in Hong Kong SAR; supplemented by HKMA Circulars + sectoral cybersecurity frameworks (notably C-RAF v2.0 + CFI verified separately) + supervisory communications. MODULE NUMBERING: each module identified by LETTER PREFIX (CA + CG + CR + IR + LM + MR + OR + IC + AC + TM + RA + AML + CB + RR + SA + DI + many others) + NUMBER (1 + 2 + G + E + S + M + N) + SUB-NUMBER (G-1 + G-2 + G-3 etc); examples: CG-1 + CG-2 + CR-G + CR-G-7 + TM-G-1 + TM-G-2 + OR-1 + OR-2 + LM-1 + AML + AMLO. MODULE TYPES: (a) G - General (foundational + cross-cutting) e.g. CG-1 + TM-G-1; (b) E - Electronic (e-banking + digital) e.g. TM-E-1; (c) S - Specific Supervis

• SPM module inventory + applicability
• Version tracking + transition records
• Sectoral implementation evidence

• Module applicability misunderstood
• Version tracking gaps
• Implementation incomplete