Risk Rating

For business relationships the entity must review and where appropriate update its assessment of the customer's ML/TF risk when a s 28(4) risk matter changes significantly, when unusual transactions or behaviours arise, and when the Rules require (a nested ser...

Sets the HKMA's approach to validating IRB rating systems and its expectations: the minimum requirements for IRB use, the factors considered in validation (development and implementation of rating systems, ratings of obligors in a connected group, systems and...

Within twelve months of the policy taking effect each agency must create a register of its in-scope AI use cases, which lets the accountable officials record the accountable use case owner for each.

By 31 October each year the entity publishes an annual statement of compliance with the Framework for the previous year, in its annual report or as a standalone statement, containing at least a statement of commitment to child safety, a description of its inte...

Test each change during development and deployment to a depth matching its risk rating, using suitably qualified staff or state-of-the-art automated testing, involve customers where contracts require it, and rate and remediate identified defects against define...

Scanners are hardened; for Moderate and High systems scans are authenticated wherever possible and run with full system authorization avoiding registry and file access limitations (RA-5(5));