Supervisory Policy Manual CR-S-5 Credit Card Business

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To provide guidance to AIs on the management of risks associated with credit card business Classification A non-statutory guideline issued by the MA as a guidance note Previous guidelines superseded Guideline 3.6 "Referees in Applications for Credit Cards or Loans" dated 23.01.96; Circular on “Credit Card Lending” dated 21.06.01; and “Best Practices for Credit Card Operations” (Annex to Circular on “Bankruptcy and Consumer Credit Lending” dated 22.02.02) Application To all AIs that engage in credit card business directly or through their subsidiaries or affiliated companies controlled by them Structure

1. Background and scope
   1.1 Introduction
   1.2 Basic features of credit cards
   1.3 Types of credit cards
   1.4 Sources of income for credit cards
   1.5 Areas covered in the Code of Banking Practice
   1.6 Application to other unsecured consumer finance
2. Major risks in credit card business
   2.1 Credit risk

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
2.2 Operational risk
2.3 Liquidity risk
2.4 Legal and reputation risks
3. Board and senior management oversight
3.1 Business strategies
3.2 Risk management controls
4. Account solicitation and approval process
4.1 Marketing programmes
4.2 Application information
4.3 Verification of documentation and credit checking
4.4 Underwriting criteria
4.5 Controls over approval process
4.6 Credit limit assignment
4.7 Card issuing controls
4.8 Approval of new merchants
5. Account and portfolio management
5.1 Cardholder account management
5.2 Merchant account management
5.3 Portfolio quality and analysis
5.4 Fraud control
5.5 Delinquency management
5.6 Restructuring and debt relief plans
6. Provisioning and charge-off
6.1 General
6.2 Overdue period
6.3 Loan classification and provisioning
6.4 Charge-off
Annex A: Scoring systems

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 —————————

1. Background and scope
   1.1 Introduction
   1.1.1 This module is aimed at providing general guidance to AIs
   on the risks associated with credit card business, and the systems of control expected of them in managing such business. It also sets out the best practices that they should aim to achieve1 .
   1.1.2 Experience has shown that the quality of AIs’ credit card
   portfolios mirrors the economic environment in which they operate. Very often, there is a strong correlation between an economic downturn and deterioration in the quality of such portfolios. The deterioration may become even more serious if AIs have relaxed their credit underwriting criteria and risk management standards as a result of intense competition in the market. It is therefore important for AIs to maintain prudent policies and practices for managing the risks of their credit card business which are relevant to the market environment that they operate in.
   1.1.3 To facilitate a better understanding of the risks involved,
   the basic features of credit cards and their associated operations are highlighted in subsections 1.2 to 1.4 below.
   1.2 Basic features of credit cards
   1.2.1 The term “credit card” generally refers to a plastic card2
   assigned to a cardholder with a credit limit that can be used to purchase goods and services on credit or obtain cash advances.
   1.2.2 Credit cards allow cardholders to pay for purchases made
   over a period of time, and to carry a balance from one

If AIs have adopted some practices that may not fully align with those recommended in this module, they are expected to provide justifications for the approach taken and be able to demonstrate that adequate risk assessment has been undertaken and the risk mitigating measures in place are sufficiently robust to cater for these practices. Some AIs may assign a virtual card number that is different from that on the plastic card to enable the cardholder to purchase goods and services on the internet. The credit limit of the virtual card is usually very low.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 billing cycle to the next. Credit card purchases normally become payable after a free credit period (see para. 1.4.2 below) during which no interest or finance charge is imposed. Interest is charged on the unpaid balance after the payment is due. Cardholders may pay the entire amount due and save on the interest that would otherwise be charged. Alternatively, they have the option of paying any amount, as long as it is higher than the minimum amount due, and carrying forward the balance.
1.2.3 A credit card scheme typically involves the following
parties:

• Cardholders - persons who are authorized to use
  credit cards for the payment of goods and services;
• Card issuers - institutions which issue credit cards;
• Merchants - firms which agree to accept credit
  cards for payment of goods and services;
• Merchant acquirers - institutions which enter into
  agreements with merchants to process their credit card transactions; and
• Credit card associations - organisations that
  license card issuers to issue credit cards under their trademark, e.g. Visa and MasterCard, and provide settlement services for their members (i.e. card issuers and merchant acquirers).
  1.2.4 The relationships between these various parties are
  illustrated in the following diagram:
  Billing to cardholder
  Reimbursement
  Presentment of sales
  Repayment
  Clearing & settlement
  Clearing & settlement
  Cardholder Merchant
  Card
  Issuer
  Merchant
  Acquirer
  Credit Card
  Association
  Purchase made by credit card
  Goods or services

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
1.2.5 Credit card schemes normally operate at an international
level, meaning that cardholders belonging to card issuers in one country can make purchases at the place of business of merchants signed up by merchant acquirers in another country.
1.2.6 Credit cards include charge cards (also called “travel and
entertainment” cards), which are proprietary brands (e.g. Diners Club) that are not affiliated with any credit card association or any of the other brands, and the same organisation acts as the card issuer and the merchant acquirer.
1.2.7 Charge cards have similar features as credit cards, except
that they do not normally have pre-set spending limits. Another difference is that the balance on a charge card account is payable in full when the statement is received and cannot be rolled over from one billing cycle to the next. In spite of this, revolving credit is available on some plans to enable cardholders to leave a pre-set balance unpaid.
1.2.8 The focus of this module is on the operations, risks and
controls associated with credit card schemes of which AIs (or their subsidiaries or affiliated companies under their control) are the card issuer or the merchant acquirer. As such, relevant requirements of this module also apply to charge card schemes operated by AIs directly or through their subsidiaries / affiliates.
1.3 Types of credit cards
1.3.1 Credit cards can be broadly categorised into two types:
general purpose cards and private label cards. The former are issued under the trademark of credit card associations and accepted by many merchants while the latter are only accepted by specific retailers (e.g. a department store).
1.3.2 Most of the card issuing AIs in Hong Kong offer general
purpose credit cards. These cards are normally categorised by AIs as platinum, gold or classic to differentiate the services offered on each card and the income eligibility criteria. AIs may, at the request of a cardholder, issue a supplementary card to another individual who is usually an immediate family member of the cardholder.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
1.3.3 It is quite common for AIs to partner with business
corporations or non-profit making organisations (e.g. charitable or professional bodies) to issue co-branded cards or affinity cards.
1.3.4 AIs may also issue corporate credit cards to the
employees of their corporate customers. Generally the employees use these cards for travel and entertainment expenses incurred in the course of their work.
1.3.5 The types of credit cards mentioned above are not
exhaustive. AIs may, from time to time, introduce new credit card products to satisfy customer needs and cater for changes in market conditions.
1.4 Sources of income for credit cards
1.4.1 Credit card income is generated from different types of
fees and charges. While such fees and charges may vary among card issuers or merchant acquirers, they generally include the following:
Card issuers

• Annual fee – this is payable at the start of the
  membership year. However, it is not uncommon for card issuers to waive the annual fee as an incentive to increase cardholders’ loyalty;
• Interest charge on outstanding balance – this
  constitutes the bulk of the earnings from credit cards. The methodology of interest calculation differs among AIs. As an example, the card issuer may charge the cardholder interest on the balance carried forward from the payment due date. The period of time between the transaction date and the payment due date (around three weeks from the billing date) for credit card purchases is interest free, provided that the billed amount is repaid on or before the due date. Otherwise, interest on the unpaid balance will be charged from the transaction date. The cardholder is liable to pay a minimum amount due, which is set at a percentage of the billed amount.
• Fees and charges on cash advances – cardholders
  are allowed to withdraw cash from designated ATMs or over the counter of the card issuer or its affiliated

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 companies, using the credit card. A handling fee is imposed when the cash is withdrawn. Interest is also charged once the cash advance facility is utilised.

• Foreign exchange differential – most of the credit
  cards can be used overseas. When cardholders spend in foreign currencies and settle the dues in the local currency, card issuers profit from the differential between the bid and ask prices of the foreign currencies.
• Interchange fee – when card issuers reimburse
  merchant acquirers on credit card transactions, an interchange fee is charged to cover various costs relating to transaction processing and authorization, fraud and fraud prevention, funding for the interest free period, and the payment guarantee.
• Other fees and charges – card issuers may also
  impose on cardholders other fees and finance charges for paying late or for exceeding the credit limit. Merchant acquirers
• Fees and charges on merchants – merchant
  acquirers may levy on merchants processing, servicing or setup fees (e.g. for e-commerce merchants). The amount and types of fees charged vary among merchant acquirers, and can be negotiated with the merchants in the light of their business relationships. It is common for a discount rate to be imposed on the value of credit card transactions presented by merchants.
  1.5 Areas covered in the Code of Banking Practice
  1.5.1 The Code of Banking Practice (“the Code”), which was
  issued jointly by the Hong Kong Association of Banks and the DTC Association, sets out the minimum standards that AIs are expected to observe when dealing with their personal customers. Reference should be made to Chapters 1, 3 and 5 of the Code which covers the following areas that are pertinent to credit card business:

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• the issue of cards;
• the disclosure of terms and conditions (including fees
  and charges and annualised percentage rates);
• the right of set-off;
• the collection, use and holding of customer
  information (including personal referees);
• the security of cards / personal identification numbers
  (“PINs”);
• transaction records;
• unauthorized transactions / lost cards / liability for
  loss;
• handling customer complaints (see also IC-4
  “Complaint Handling Procedures”); and
• the use of debt collection agencies.
  1.5.2 AIs should ensure that all relevant provisions of the Code
  are complied with in their conduct of credit card business so as to promote good banking practices, avoid customer disputes and foster business relationships.
  1.6 Application to other unsecured consumer finance
  1.6.1 Other unsecured consumer finance refers to short or
  medium term lending extended to individuals to finance their personal expenditure (i.e. not for business or home purchase) on an unsecured basis. Such lending includes personal loans, tax loans, and overdrafts.
  1.6.2 Although credit card business has its own distinct features,
  it shares some common characteristics (e.g. in relation to credit and legal risks) with other types of unsecured consumer finance. Hence, in managing such credit products, AIs should, where applicable, have regard to the general lending and risk management principles set out in sections 3 to 6 below.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
2. Major risks in credit card business
2.1 Credit risk
2.1.1 Credit risk poses a significant risk to AIs involved in credit
card business. A card issuing AI has an exposure to a cardholder when the AI reimburses a merchant acquirer3 for a transaction on behalf of the cardholder or when the cardholder obtains cash advances from his credit card account. Such an exposure will remain if the cardholder does not repay the entire amount of the outstanding balance by the due date. As credit card lending is unsecured, the source of repayment depends primarily upon the cardholder’s creditworthiness and repayment capacity.
2.1.2 It is not uncommon for customers to hold multiple credit
cards issued by the same or different AIs. Availability of sufficient information is important for AIs to assess the overall indebtedness and creditworthiness of their credit card applicants. In this regard, the establishment of a credit reference agency (see IC-6 “The Sharing and Use of Consumer Credit Data through a Credit Reference Agency” for more details) in Hong Kong to provide consumer credit reference service has enhanced AIs’ ability to make more informed credit decisions (see also paras. 3.1.2 and 4.3.6 below).
2.1.3 Credit risk may be increased considerably if AIs adopt
aggressive strategies for expanding their credit card business due to competitive pressures, without managing the associated risks properly. These may include:

• relaxing the underwriting standards for approving
  credit card applications, including those solicited under “pre-approved” programmes;
• adopting a relaxed attitude in accepting alternative
  income proof for assessing the creditworthiness of applicants;

This may be a local or an overseas (in the case of overseas spending) financial institution.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• offering multiple credit cards to existing cardholders
  or an excessive increase in their credit card limits without adequate assessment of their overall repayment capacity; and
• delaying collection actions (e.g. tolerating limit
  excesses) on customers with repayment problem.
  Such practices could mask portfolio quality, increase the risk profile of cardholders quickly and result in rapid and significant portfolio deterioration, especially when economic conditions worsen.
  2.1.4 As merchant acquirers, AIs incur credit risk when
  merchants fail to reimburse them for chargebacks4 .
  2.2 Operational risk
  2.2.1 Credit card operations are highly automated and involve
  large volumes of customer and transactional data. These characteristics reflect the need for strong operational and security controls.
  2.2.2 Both card issuing and merchant acquiring AIs are exposed
  to operational risk from various sources, including data processing and security issues, outsourcing arrangements and fraudulent transactions. Data processing and security issues
  2.2.3 The highly automated processing environment for credit
  cards is susceptible to data processing and security risks. It is therefore important for AIs to put in place relevant policies and procedures to control these risks. In particular, they should focus on having adequate controls and procedures to protect data integrity and security of customer information (including data retention and confidentiality) as well as appropriate back-up and disaster recovery plans and regular testing of such arrangements to guard against system failure and unexpected disruptions. Relevant guidance is contained in TM-G-1 “General Principles for Technology Risk Management” and TM-G-2 “Business Continuity Planning”.

Chargebacks are reversed transactions, usually caused by customer disputes such as the return of faulty goods by cardholders and non-delivery of goods and services by merchants, processing errors or fraud.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 Moreover, AIs should regularly review their operational capacity to ensure that it is adequate to cope with any targeted growth in business volume. Outsourcing arrangements
2.2.4 As the use of third party service providers5
to handle all or
part of the credit card processing functions has become
increasingly common, AIs should be fully aware of the risks of improper management of outsourced activities. If the systems and controls of the service providers turn out to be defective, this could lead to a decline in operational or servicing standards for the outsourced functions or even the leakage and misuse of credit card data processed or stored in their systems.
2.2.5 It is essential for AIs to follow the general guidance given in
SA-2 “Outsourcing”. Apart from consulting the HKMA on the outsourcing arrangements, AIs should be satisfied with the control environment of the service providers concerned, including the security controls over the integrity and confidentiality of customer information maintained in the outsourced systems, and ensure that they comply with the security standards and requirements of the credit card associations. This should be ascertained by AIs through regular review and evaluation that the relevant controls are up to the standard required. AIs should also retain ultimate control over the outsourced data6 . Fraudulent transactions
2.2.6 Described here are some common sources of fraudulent
transactions. As this is a complex and ever-changing area, AIs need to be aware of the evolving typologies of fraud and monitor such developments on an ongoing basis.

These service providers may handle a variety of functions, including marketing agents, data processing operations for card issuers or a range of merchant services (such as billing, reporting, customer service, authorization and settlement) on behalf of merchant acquirers. As a result, a huge amount of credit card data (including customer information and transaction data) may be processed or stored in the systems of these service providers. Among other things, the outsourcing agreement with the service provider should allow for supervisory inspection of the operations and controls of the service provider as they relate to the outsourced activity.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
2.2.7 Lost and stolen cards represent a major source of
fraudulent transactions, which can be difficult to detect. Therefore, timely reporting of loss by cardholders is crucial for minimising potential losses on these transactions. Other types of fraud, such as counterfeit cards and internet fraud, are of growing concern.
2.2.8 With enhanced technology, counterfeit cards can produce
a very plausible imitation of a real card, and it is easy for a professional counterfeiter to copy the magnetic stripe information from one card on to another. Apart from duplicate card production, skimming is another means of counterfeiting credit cards. Skimming takes place during the course of a genuine transaction and involves copying the magnetic stripe details from a genuine payment card and transferring them to another card without the original cardholder’s knowledge.
2.2.9 Along with rapid technological developments and the
increasing use of credit cards as a medium of payment for online purchases or fund transfers, fraudulent transactions via the internet are on the rise. Cardholders using internet banking services may be exposed to the risks of “phishing” 7 and “pharming” 8 where they disclose confidential information regarding their accounts unknowingly to fraudsters through the internet. The difficulty of detecting such fraud lies in the fact that the transactions are all electronic and do not involve any face￾to-face contact with the parties concerned. In other words, it is hard to know whether the counterparty, or the website, is genuine.

Phishing attacks use both social engineering and technical subterfurge to steal consumers’ personal identity data and financial account credentials. Social-engineering schemes use “spoofed” e-mails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such as credit card numbers, account usernames and passwords etc. Hijacking brand names of banks, retailers and credit card companies, phishers often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials directly, often using Trojan Keylogger spyware. Pharming crimeware misdirects users to fraudulent sites or proxy servers, typically through DNS hijacking or poisoning.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
2.2.10 Other types of fraudulent transactions may arise from the
interception of cards in the mail, deceptive card applications, staff fraud, or forged mail orders9 .
2.2.11 In view of the significance of fraud control to credit card
operations, AIs should institute appropriate risk management measures to prevent and detect fraud (see subsection 5.4 for more details).
2.3 Liquidity risk
2.3.1 Both card issuing and merchant acquiring AIs are exposed
to liquidity risk, particularly so for AIs whose credit card operations constitute a major part of their business. Card issuing AIs are obliged to settle payments with merchant acquirers for transactions on behalf of their cardholders within a short period of time, regardless of when payments are received from cardholders (which might be spread across several months). Merchant acquiring AIs may settle payments for credit card transactions with merchants before receiving payment from card issuers in respect of those transactions.
2.3.2 Liquidity risk also arises for merchant acquiring AIs where
chargebacks or refunds to cardholders reach a level that cannot be covered by the merchants’ sales volume.
2.3.3 AIs should ensure that there is sufficient liquidity to meet
their obligations arising from credit card transactions by establishing adequate liquidity management systems and controls (see LM-1 “Liquidity Risk Management” for general guidance).
2.4 Legal and reputation risks
2.4.1 AIs are exposed to legal and reputation risks arising from
non-compliance with laws, rules or regulations or breaches in the terms and conditions of the agreements with cardholders, merchants and credit card associations.
2.4.2 AIs should be wary of a whole host of events which, if
incurred, can induce adverse publicity and legal action from disgruntled parties. Examples include:

Much less checking can be done on mail orders, as they normally require less information, such as a card number and expiry date.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• adoption of improper practices that lead to unfair
  treatment of credit card customers;
• misconduct of debt collection agencies used by AIs;
• issue of credit cards indiscriminately to students (i.e.
  those without stable income or independent financial means);
• perpetration of staff fraud resulting in unauthorized
  transactions or misuse of credit card information; and
• theft of credit cards and customer information due to
  lax internal security controls or inadequate control over the security standards of third party service providers to which all or part of the credit card operations have been outsourced. All such incidents run the risk of damaging AIs’ reputation and leading to potential claims for losses and compensation.
  2.4.3 An AI’s reputation can also be seriously affected by any
  adverse publicity on its merchants or partners of affinity or co-branded programmes.
  2.4.4 AIs should not preclude the possibility that credit cards
  may be misused for conducting money laundering or terrorist financing activities, especially when the use of credit cards for payments or remittances through the internet (which may be exposed to a higher risk of abuse10) becomes more common. AIs should watch out for any potential abuse of credit cards for such purposes.

10 As an example, the provision of worldwide internet remittance services by some remittance companies through debiting remitters’ credit cards may pose a high money laundering and terrorist financing risk. In conjunction with some credit card associations these service providers can effect fund transfers to beneficiaries worldwide by debiting the remitters’ credit card accounts and issuing ATM cards to the designated beneficiaries for fund withdrawals. To apply for such services, remitters simply open an account with the service provider through the internet by providing information on their credit cards and the beneficiaries. These remittance transactions are susceptible to money laundering and terrorist financing because:
(i) the remittance company provides non-face-to-face services and does not conduct any customer due diligence on the remitter or the designated beneficiary; (ii) the ATM cards are easily transferable, thus allowing for greater anonymity than the traditional use of supplementary credit cards; and

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
3. Board and senior management oversight
3.1 Business strategies
3.1.1 Senior management is expected to develop and review
the business strategies of an AI’s credit card business in accordance with the overall business objectives and risk tolerances approved by the Board. These strategies should reflect realistic goals based on reasonable data and assumptions.
3.1.2 With the greater sharing of consumer credit data in Hong
Kong, AIs are given access to more information to facilitate credit decision making not only in the credit application process but also during ongoing credit reviews. This gives rise to the opportunity for card issuing AIs to consider the feasibility of adopting tiered interest rates or risk-based pricing according to the creditworthiness of individual cardholders in their portfolios, although whether such pricing strategies will be adopted is ultimately a matter for AIs to decide based on their own circumstances.
3.1.3 Some AIs may, for strategic reasons, have a tendency to
target the sub-prime market in their credit card solicitation programmes in order to earn more income (e.g. through charging higher interest rates and fees under risk-based pricing) from those customers with a weakened credit history (e.g. habitually late payments) and a greater appetite for credit than other ordinary customers11 . Sub￾prime credits can be profitable, provided that the interest charged by AIs is sufficient to cover higher loan loss rates and overhead costs related to underwriting, servicing, and collecting the credit.

(iii) it is likely that most of these transactions will not be regulated (i.e. no competent authorities will be aware of them when the remittances take place in their jurisdictions). 11 The sub-prime programmes mentioned in para. 3.1.3 above refer to those that purposefully employ tailored marketing, underwriting and risk selection policies and criteria to solicit customers whose credit quality is generally weaker than other average customers (e.g. they may have overdue records exceeding 90 days and hence exhibit higher probabilities of default). Some may eventually go into bankruptcy or require a charge-off. As a result, the pricing and terms offered to sub-prime borrowers often differ substantially from those offered to prime borrowers, and separate and distinctly different underwriting standards are adopted.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
3.1.4 AIs should recognise that there are unique and significant
risks inherent in sub-prime credit card lending. Those wishing to engage in such activity will have to determine if these risks are acceptable and controllable, given the organisation’s financial condition, portfolio size, level of capital support and staff expertise.
3.1.5 AIs may also consider promoting other types of unsecured
lending products, such as personal loans, revolving credits and overdrafts, so that customers have more choices of the form of borrowing that best suit their needs.
3.1.6 AIs planning to expand their credit card business in
overseas markets (e.g. through the issue of credit cards by their overseas branches or subsidiaries) should have a good understanding of the markets they intend to operate in, including the operating and competitive environment, the legal framework and judicial systems, and the risk profile and behavioural characteristics of their targeted customers.
3.1.7 To facilitate the formulation and review of business
strategies, AIs should develop a framework for assessing regularly the profitability and return on their credit card portfolios. 12 Where appropriate, AIs should adjust their business strategy based on the results of such analysis.
3.2 Risk management controls
3.2.1 The Board and senior management are expected to
ensure that an AI has established a comprehensive risk management process for identifying, monitoring, measuring and controlling the risks associated with its credit card business (see IC-1 “General Risk Management Controls” for guidance).
3.2.2 Although the organisational structure of credit card
operations may vary among AIs, there should be clearly defined accountability and responsibility at every level and sufficient segregation of duties (see also IC-1 “General risk management controls”) in the following functions:

12 For example, such analysis considers all associated costs (including origination costs, administrative or servicing expenses, charge-offs and capital) and reviews performance against clearly set benchmarks such as target return, delinquency and charge-off levels.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• marketing and account solicitation;
• application approval;
• risk management;
• fraud control; and
• delinquency management.
  3.2.3 AIs should establish policies and procedures for their
  credit card operations that are commensurate with the scale of such business. The policies and procedures should be documented in writing and approved by senior management or any committee with delegated authority.
  3.2.4 The policies and procedures for credit card operations
  should cover the following major areas:
• Application approval – these should describe clearly
  the underwriting criteria for approving new cardholders and merchants, the mechanism for review of the criteria, the frequency of such review, the documentation requirements, the policy relating to setting of credit limits for cardholders and the authority and parameters for approving exceptions or overrides;
• Credit risk management – these should set out the
  procedures for management of cardholders’ credit limits (such as the criteria for card upgrade, card renewal and increase in credit limit) and ongoing assessment of merchants’ financial and operational condition. The role and functions of a credit risk management unit and the tools for managing credit risk should be clearly described, including how the asset quality of a credit card portfolio is evaluated regularly, how merchant chargebacks are monitored and the types of corrective actions to be taken where concerns exist with particular cardholders or merchants;
• Operational risk management – these should cover
  the procedures and controls in respect of physical security controls on credit cards, controls over authorization of credit card transactions, integrity of transaction data and timely processing of transactions, controls over customer data retention

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 and confidentiality, information technology controls, back-up and disaster recovery plans, managing outsourcing risk, and measures to prevent and detect fraud; and

• Delinquency management – these should cover the
  classification of delinquent accounts, provisioning, charge-off, restructuring and collection actions.
  3.2.5 Senior management should review regular reports which
  detail management information on AIs’ credit card operations, including the number of new cardholders and merchants, account attrition, portfolio composition, sales volume, credit quality, over-limits and overrides, and chargebacks and frauds.
  3.2.6 Regular audits performed on credit card operations should
  generally cover:
• compliance with internal policies and procedures
  (such as credit underwriting and review, authorization, documentation, delinquency monitoring and collection procedures, fraud control, segregation of duties and access controls) and relevant regulatory rules and guidelines; and
• use of scorecards and credit card related outsourcing
  activities, if applicable.
  Any weaknesses and irregularities identified should be reported to senior management and rectified promptly.
  3.2.7 AIs which are engaged in sub-prime credit card lending
  should have in place systems and controls that typically involve enhanced performance monitoring, intensive collection activities and other loss mitigation strategies. Sub-prime accounts should be differentiated within the credit card portfolio, and sufficient capital and resources should be available to support such activity.

4. Account solicitation and approval process
   4.1 Marketing programmes
   4.1.1 A well-documented proposal should be prepared for each
   major marketing programme. The proposal should, where applicable, include:

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• the target market segment and forecasted customer
  response rate;
• the basis of the marketing approach;
• product pricing, profit projection, expected usage and
  delinquency and loss rates;
• underwriting criteria;
• documentation requirements;
• the policy on credit limit assignment; and
• requirements for operational and system support.
  4.1.2 If the marketing proposal involves any significant relaxation
  of existing product terms (e.g. an extended payment cycle or a reduction in the minimum payment required13), there should be a detailed risk assessment and due consideration of related risk management implications. AIs are encouraged to consider the need for setting a cap on the number of cards allocated to or the amount of the exposure to be incurred under such programmes.
  4.1.3 Procedures should be in place to ensure that the
  marketing proposals are commercially sound and operationally feasible. Particularly, these procedures should be able to establish that:
• the profit projection is reasonable;
• the underwriting criteria are prudent and appropriate
  risk control measures are in place;
• the proposal complies with the relevant regulatory
  requirements and the AI’s internal policies and limits; and
• adequate system capacity is available to support
  implementation of the proposal.
  Marketing programmes that operate outside the pre-set procedures should be approved by senior management

13 AIs should guard against lowering minimum payment requirements and extending principal payment cycles to an extent that may result in negative amortisation of card receivable balances (i.e. outstanding balances continue to increase as minimum payments consistently fall short of covering all finance charges and fees assessed during a billing cycle).

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 and, where appropriate, be reviewed by the relevant departments before launching.
4.1.4 AIs should review the outcome of major marketing
initiatives to ascertain whether these initiatives have achieved their objectives and whether there are any issues or lessons that should be taken into account in the planning and implementation of future programmes.
4.1.5 AIs often use “pre-approved”, “affinity” or “co-branded
card” programmes to solicit new customers. This is acceptable as long as the offer of such programmes does not amount to liberal granting of credit cards to selected customers. In the case of “affinity” or “co-branded” programmes, AIs should ensure that they have adequate control over the approval and acceptance of such accounts.
4.1.6 Each application solicited from the above programmes
should be thoroughly assessed against prudent underwriting criteria. To facilitate credit assessment, these customers should still be required to submit application information (see para. 4.2.1 below and footnote 14) along with their income proof or, where appropriate, “income surrogates” (see paras. 4.3.2 to
4.3.4 below).
4.1.7 For marketing programmes that target existing customers,
AIs may require less information from the applicants if certain information (e.g. static personal information) is already in their possession (see also para. 4.2.2 below).
4.2 Application information
4.2.1 AIs should collect sufficient information, either through
application forms 14 or other means (e.g. the credit reference agency15 ), for the purpose of assessing the creditworthiness and financial position of credit card applicants. Such information generally include:

• Personal particulars - e.g. name (including former or
  other name(s)), date and place of birth, Hong Kong

14 These include application forms accessed or distributed through the internet. 15 AIs are encouraged to make full use of the credit reference information of individual applicants available from the credit reference agency in their credit assessment process.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 identity card or passport number, nationality, marital status, educational background, residential address (and permanent address if different), residence type (mortgaged, owned or rented) and monthly rent or mortgage instalment amount;

• Occupation details - e.g. name of present employer,
  office address, nature of business, present position, years of service with the present employer and monthly or annual income; and
• Credit references - e.g. number of credit cards held,
  credit card limits granted, and information on other credit commitments or facilities (e.g. personal loan or overdraft).
  4.2.2 In the case of applicants who are existing customers of
  AIs, there is scope for reducing the information required, such as the static personal information (i.e. name, date and place of birth, Hong Kong identity card or passport number) that is available in their database. Nevertheless, AIs should consider the need for updating some other non￾static information (e.g. occupation or income particulars) that may have changed.
  4.2.3 AIs should make known to the applicant what types of
  documents (see para. 4.3.2 below) should be submitted in his application. AIs should not easily dispense with income proof requirements. In addition, there should be procedures in place to draw the applicant’s attention to the major terms and conditions of the cardholder agreement. (see para. 2.3 of “Review of the Code of Banking Practice” issued by the HKMA in November 2001).16
  4.2.4 AIs should obtain relevant information (e.g. through the
  credit reference agency) to ascertain whether:
• the applicant has owned any credit card that was
  cancelled due to default payment;
• the applicant has any overdue payment exceeding, for
  example, 30 days, in respect of his indebtedness;

16 If an application is accepted by phone, AIs should request the applicant to submit the required documents for verification.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• there is any bankruptcy order made against the
  applicant; and
• the applicant is in the process of petitioning for
  bankruptcy.
  Such information should be taken into account in making the credit decision.
  4.2.5 To protect AIs’ interests, applicants should be required to
  make a declaration on the application form to certify the truth and completeness of the information submitted. AIs may also wish to alert applicants that if they make a false statement in the application and subsequently default, they may commit an offence under section 71 of the Crimes Ordinance.
  4.2.6 Application forms (particularly the cardholder’s declaration
  and the major terms and conditions of the cardholder agreement) should be properly reviewed by the internal compliance and legal unit or external lawyers to make sure that they comply with all relevant legal and regulatory requirements (e.g. Personal Data (Privacy) Ordinance) and do not contain any false information which may constitute misrepresentation to the applicants.
  4.3 Verification of documentation and credit checking
  4.3.1 Every application should be checked for the completeness
  of documentation and to screen out unqualified applications, e.g. under age.
  4.3.2 Valid documents for verification of the identity and
  creditworthiness of new customers17 should be obtained. Such documents include:
• identity proof (e.g. copy of Hong Kong Identity Card or
  passport);
• address proof; and
• income proof (e.g. latest income tax demand note,
  latest payroll advice, bank statements showing the past three months’ salary). If the applicant is self-

17 In the case of existing customers, AIs may wish to update changes in their non-static information.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 employed18 , unemployed, or retired, in which case income proof may not be available, appropriate alternative evidence or “income surrogates” (see paras. 4.3.3 and 4.3.4 below) should be obtained to support the application.
4.3.3 AIs may sometimes waive the requirement of income proof
and accept alternative evidence to estimate the income of the applicants. This practice, if undertaken, requires that there are robust procedures for assessing and verifying such alternative evidence. While income proof is not the only consideration for a credit card application, AIs should, where possible, obtain such information (and preferably information about expenditures such as instalment payments) to assess the applicant’s repayment ability.
4.3.4 AIs may use income surrogates (e.g. fixed deposit
receipts or main bank account statements for the last three months) to assess the financial strength of applicants who are unable to provide income proof, or to supplement income proof submitted by them. Certain income surrogates, such as the credit card statement issued by other AIs, home or car ownership (which may be subject to mortgages), credit card sales slips or subscription to mobile phone services, are however not reliable substitutes for income proof.
4.3.5 Where income surrogates are used, AIs may wish to grant
a lower credit limit to the successful applicant initially, especially if there is no available record on his credit history (see para. 4.3.6 below). A normal limit may be granted when the applicant has established a satisfactory credit history.
4.3.6 Checking of applicants against internal and external credit
records should be performed. In particular, AIs may obtain useful information from the credit reference agency on such matters as the credit exposures of the applicant, whether the applicant has lodged a petition for bankruptcy, or his past credit performance.

18 Self-employed applicants may submit the Business Registration Certificate, the latest profit tax demand note and other deposit proof instead.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
4.3.7 AIs should conduct proper customer due diligence on
applicants, including the checking of details of applicants against a database of names and particulars of terrorist suspects which consolidates the various lists issued by the United Nations and other countries (e.g. US Executive Order) for the purpose of identifying cases relating to terrorist financing (see ML-1 “Prevention of Money Laundering”19 for further details).
4.3.8 AIs should also check publicly available information or
commercially available databases to establish whether an applicant is a politically exposed person (“PEP”) 20. The decision to approve the application of a PEP should be taken at a senior management level.
4.3.9 AIs that process credit card applications through mail
should put in place sufficient safeguards to prevent the use of stolen information (e.g. theft of ID cards) for getting applications approved. The Code requires AIs to bear the losses resulting from such applications unless the cardholder has acted fraudulently or with gross negligence.
4.4 Underwriting criteria
4.4.1 Procedures should be in place to screen out applicants
with unfavourable credit attributes. This is usually achieved by requiring an applicant to meet a set of underwriting criteria before approving the application. The attributes generally cover the following areas:

• income level;
• nature of employment, particularly in respect of job
  security and income stability21;

19 This module is under development. For the time being, see Guideline 3.3 “Prevention of Money Laundering” issued on 21 December 2000 and the Supplement issued on 8 June 2004. 20 PEPs are defined as individuals being, or who have been, entrusted with prominent public functions, such as heads of state or of government, senior politicians, senior government, judicial or military officials, senior executives of public organisations and senior political party officials. The concern is that there is a possibility, especially in countries where corruption is widespread, that such PEPs may abuse their public powers for their own illicit enrichment through the receipt of bribes etc. 21 To facilitate assessment, AIs should identify occupations that carry higher credit risk.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• acceptable credit record and checking results (see
  para. 4.3.6 above);
• asset requirement (especially for high risk customers
  or customers with no stable income source);
• acceptable age range; and
• permanent residence (in other words, temporary
  addresses such as hotel address or post office box number should not be accepted by AIs). Underwriting criteria should not be relaxed imprudently because of competition or for the purpose of market penetration.
  4.4.2 Specific procedures should be established for handling
  applications from customers who do not have stable income or independent financial means. In particular, AIs should set out clearly how the repayment ability of these applicants will be assessed and how the credit limit will be set.
  4.4.3 Where a credit scoring model is used to screen
  applications, AIs should ensure that the credit scoring system (e.g. credit attributes and cut-off score 22 ) is regularly reviewed and, if necessary, updated to ensure that it remains valid despite changes in the customer profile. See Annex A for a general description of the use of scoring systems for credit risk management purposes.
  4.4.4 The HKMA recognises that issuing credit cards is a
  commercial decision for AIs. However, it is important that AIs maintain prudent underwriting standards at all times so that their credit card portfolios can withstand the effect of economic downturns when undesirable trends in consumer lending (e.g. the edging up of delinquency and charge-off ratios and the rising trend in bankruptcies) are more likely to take place.

22 A cut-off score is the minimum credit score determined by an AI’s management. Borrowers whose credit scores are not above the approved cut-off score do not meet the AI’s minimum underwriting criteria. However, management may override a borrower’s unacceptable credit score when other mitigating factors are present. Exceptions to the AI’s credit scoring system should be properly documented. AIs should consider whether they need to adjust their cut-off scores to reduce the incidence of bad debts.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
4.5 Controls over approval process
4.5.1 There should be guidelines and clear parameters for
approval and monitoring of exceptional cases (i.e. applications which are approved with deviations from AIs’ established underwriting criteria). AIs should establish limitations to control the exceptional approvals that can be granted (e.g. in terms of a ratio of the number of approved applications). There should also be ongoing tracking of the level of exceptional approvals and the performance of those accounts.
4.5.2 AIs using a credit scoring system should similarly control
the cases referred for manual review. If such cases have exceeded the prescribed level, the underlying reasons should be investigated.
4.6 Credit limit assignment
4.6.1 Credit limits should be decided on the basis of the credit
profile of individual customers and by reference to the customer’s monthly income or other relevant factors such as overall banking relationship, total asset balance or deposits held. Other considerations in assigning credit limits include the prevailing economic conditions and customers’ job stability and risk appetite. Keen competition should not be a justification for assigning higher credit limits.
4.6.2 For AIs using a credit scoring system, the factors
mentioned in para. 4.6.1 are valid considerations to be incorporated into the system.
4.6.3 There should be a maximum credit limit for each customer
to control his total unsecured credit exposures. The limit may be set as a multiple of the customer’s monthly income. For customers with multiple credit cards issued, a centralised credit limit or sub-limits for individual credit cards should be set.
4.6.4 Any increase in existing credit limits should be premised
upon the spending record and good repayment history of the cardholder. If the increase is initiated by the cardholder, AIs should ensure that the information on the cardholder is adequate for evaluating his request.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
4.6.5 Over-limit tolerances can magnify the risk of credit card
lending, especially for sub-prime accounts. Timely repayment of amounts that exceed established credit limits is therefore important.
4.6.6 The criteria for credit limit assignment or increase should
be analysed and documented before implementation.
4.7 Card issuing controls
4.7.1 AIs should have adequate controls in place over the
embossing, safe-keeping and distribution of credit cards to cardholders.
4.7.2 AIs should set up an independent unit responsible for card
embossing. Cards should only be embossed upon receipt of a proper authorization. AIs should also establish security controls (e.g. dual access control) over the embossing area and maintain a register of issued, returned, spoiled and unused blank cards. Surprise audits should be performed in order to detect any unauthorized use of blank cards.
4.7.3 AIs should issue cards and PINs separately and take
reasonable steps to satisfy themselves that these have been received by cardholders, whether they are personally collected by cardholders or delivered by mail or courier.
4.8 Approval of new merchants
4.8.1 Merchant acquiring AIs should establish a set of prudent
underwriting criteria and procedures for approving new merchants which accept payments for the purchase of their goods and services by credit cards. As a minimum, the criteria for assessing the creditworthiness and reputation of new merchants should cover the following areas:

• nature of business;
• years in business;
• size of operations (e.g. number of retail branches and
  employees);
• financial strength and reputation (particularly for high
  risk merchants);
• previous and projected sales volume;

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• daily statements from previous merchant acquirers, if
  any; and
• existing business relationship with the AI concerned.
  4.8.2 AIs should also establish criteria for identifying merchants
  that carry higher risk. Such merchants may include those involved in the provision of goods or services where orders are accepted without the cardholder being physically present, or where full or partial payment is accepted for goods and services delivered at some future dates (e.g. mail or telephone order operators, direct selling distributors or e-commerce merchants). Due to the special features of these merchants (e.g. they do not have physical retail outlets and most of their transactions are prepayment in nature), they should be subject to more stringent underwriting criteria.
  4.8.3 Based on the above criteria, AIs should conduct a
  thorough assessment of the prospective merchants. This includes negative vetting with the credit card associations such as Visa and MasterCard. On-site inspection of the business premises of retail merchants (or browsing on the websites of e-commerce merchants) can be performed where appropriate to ensure the existence of their place of business.
  4.8.4 AIs should only accept merchants whose overall financial
  position, business integrity and reputation are considered to be satisfactory. For those that fail to meet the selection criteria or whose nature of business is considered as high risk (e.g. e-commerce merchants), AIs may consider taking any one or a combination of the following actions:
• requiring them to provide additional collateral such as
  pledged deposits (e.g. equivalent to approximately one month’s sales volume) or bank guarantees;
• charging them a higher merchant discount rate to
  cover additional risk incurred;
• deferring payments or retention of an agreed
  proportion of merchant sales turnover for a specified period; or
• rejecting their applications.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
5. Account and portfolio management
5.1 Cardholder account management
5.1.1 The account management system of card issuing AIs
should be able to segment cardholders into different risk types (e.g. high, medium or low). For example, AIs may differentiate cardholders according to their account behaviour (such as credit limit utilisation, frequency of cash advance, payment of minimum balance, timeliness of repayment and delinquency record) or behavioural score (see Annex A).
5.1.2 Decisions such as increase in credit limit and card
renewal should be based on a cardholder’s updated credit risk profile and repayment history.
5.1.3 For high risk cardholders (e.g. those experiencing
repayment problems on their cards), there should be an effective mechanism to reduce the maximum credit limit granted in a timely manner, freeze the remaining available credit limit or block the cardholder’s credit card from further transactions, as appropriate. AIs should inform the cardholder of these actions as soon as practicable.
5.1.4 Locally incorporated AIs should have systems in place for
measuring aggregate exposures to individual cardholders for the purposes of complying with §§ 81, 83 and 85 of the Banking Ordinance.
5.1.5 Where AIs offer more than one credit card to a cardholder,
they should consider in totality the outstanding amount and performance of all his accounts to ensure that the total credit extended to the cardholder is not beyond his ability to repay.
5.1.6 AIs should also have sufficient management information
systems to identify, measure, manage and control the risks associated with over-limit accounts.
5.2 Merchant account management
5.2.1 Merchant acquiring AIs should establish policies and
procedures for ongoing monitoring of their merchant accounts. Regular review should be conducted to assess the operational (e.g. sales volume, service quality, chargebacks and fraud cases) and financial (e.g. account

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 performance and profitability) condition of individual merchants. Depending on the level of sales turnover, merchant visits should be conducted to assess the nature of business and sales activity.
5.2.2 AIs should have adequate systems and controls in place
for monitoring merchant sales volume. Apart from identifying those merchants who may be charged a higher discount rate because of unsatisfactory sales volume, this process can be an effective means to help identify any unusual or sudden jump in merchants’ sales volume or authorization requests, which may warrant investigations or implementation of preventive measures against any potential losses.
5.2.3 To facilitate the monitoring process, AIs should set a daily
limit with individual merchants, taking account of their business nature and previous and projected sales volume. If the merchant’s daily sales volume exceeds the daily limit, AIs may consider withholding funds to the merchant temporarily or conduct further investigation into the reason for the excess. Proper approval should be obtained before releasing the funds withheld. The limit should be reviewed regularly and adjusted to cater for seasonal factors and market conditions.
5.2.4 AIs should have systems in place to monitor trends of
merchants’ chargebacks and capacity to repay chargebacks. They should take appropriate measures (e.g. requiring additional collateral and guarantees) where concerns exist with particular merchants. AIs may consider withholding funds to merchants under the following situations:

• excessive chargebacks;
• suspected fraudulent activity pending internal
  investigation; and
• irregular sales slips sent on a collection basis.
  5.2.5 The relationship with merchants with confirmed fraudulent
  activity should be terminated immediately.
  5.2.6 AIs should ensure that merchants have exercised proper
  card acceptance and authorization procedures to avoid chargebacks and disputes.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
5.3 Portfolio quality and analysis
5.3.1 The credit risk management unit should regularly provide
sufficient information on the asset quality of the credit card portfolio for management review. This helps management identify the level of risk and initiate prompt corrective actions if necessary.
5.3.2 The credit risk management unit should regularly review
and monitor the quality of the portfolio by segmenting the portfolio (e.g. by marketing programme, demographic distribution, affinity relationships, and vintage 23 ) and evaluating both historical and forecasted trends in profitability, delinquencies and charge-off ratios of each segment.
5.3.3 Adequate management reports should be made available
to the credit risk management unit for portfolio management purposes. Regular performance tracking reports should be generated for review covering the following aspects:

• revenue and profitability;
• attrition analysis;
• credit limit utilisation (including over-limit accounts);
• delinquency analysis; and
• loan loss provisions and charge-offs.
  5.3.4 AIs’ stress-testing programme should take into account the
  impact of adverse scenarios on their credit card portfolios (see IC-5 “Stress-testing” for details).
  5.3.5 The portfolio should be analysed to identify high risk
  categories of cardholders and the AI’s exposure to them.
  5.3.6 Yardsticks signalling further deterioration of portfolio
  quality and the need for corrective actions should be established and documented.
  5.3.7 Prompt corrective actions should be considered in dealing
  with deterioration in the quality of the credit card portfolio. Such actions could include adjusting the approval scores,

23 This refers to an analysis of the account performance of homogeneous loans booked at a similar time using the same credit and pricing criteria.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 tightening the policies on initial assignment of credit limit and subsequent review of credit limit, increasing collection capacity, making early reminder calls on overdue accounts and developing restructuring programmes (see subsection
5.6 below).
5.4 Fraud control
5.4.1 Accurate and timely reporting on fraud is critical in
controlling fraud losses. AIs should therefore institute appropriate systems and controls to ensure that fraudulent activities are recognised in a timely manner (e.g. through review of fraud monitoring reports capturing out-of-pattern purchases or suspicious purchasing patterns24), and the affected accounts are appropriately blocked to prevent further transactions being conducted through these accounts. Suspected fraud cases should be investigated and properly documented.
5.4.2 AIs should maintain a dedicated fraud management unit
for the above purposes, and to take necessary actions whenever they become aware, or are notified by cardholders, of fraudulent or potentially fraudulent activity (e.g. for lost and stolen cards). Such actions include:

• preparing fraud reports, and analysing the trend and
  pattern of fraudulent activities;
• notifying relevant cardholders (where appropriate) of
  suspected fraud and blocking the relevant accounts from further transactions; and
• investigating fraud accounts, preparing fraud
  notifications to credit card associations and reporting fraud cases to relevant authorities for investigation and prosecution.
  5.4.3 In the treatment of unauthorised transactions reported by
  cardholders and in determining their liability for loss arising from such transactions, AIs should have regard to the

24 Out-of-pattern-purchase reports identify suspicious transactions that do not fit an individual cardholder’s established purchasing pattern whereas suspicious-purchasing-pattern reports identify certain types of purchases, such as electronics or jewellery, that may correlate with fraudulent activity.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 provisions set out in Clauses 28.3, 30.3 and 30.4 of the Code.
5.4.4 AIs should notify the HKMA if they are aware of any
incidents of credit card misuse or fraud affecting a substantial number of customers or involving significant sums of money.
5.4.5 AIs should review their average fraud losses to determine
if staff can identify fraudulent activities in a timely manner. Relevant employees should receive proper training on fraud control and the handling of fraud cases relating to credit cards.
5.4.6 The risk of credit card misuse may also be reduced by
establishing adequate internal controls and operating procedures in the credit card department, including:

• controls over authorization of credit card transactions,
  which could serve as a first line of defence against fraud;
• measures to prevent application fraud (e.g. through
  thorough checks on applicants, including name and address verification, and restricted access to and controls over alteration of customer information);
• procedures for issuing cards to prevent employees or
  others from intercepting them before delivery to the cardholders;
• procedures to prevent merchants from obtaining
  control of cards;
• procedures for handling returned cards, statements,
  PINs and lost and stolen cards to prevent them from fraudulent use; and
• controls over cardholder payments and account
  balances, and chargeback administration.
  5.4.7 AIs should closely monitor the card acceptance patterns
  and activities of merchants that they have signed up (in particular those categorised as high risk), including the conduct of on-site inspections where necessary. They should watch out for irregularities, which may include:
• excessive number of disputed or split charges;
• unusual and significant fluctuations in sales volume;

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• frequent excesses over daily limits on sales volume;
• repeated authorization of transactions incurred by the
  same card at one time; or
• a history of accepting transactions from credit cards
  which were later found to be stolen, lost or forged.
  5.4.8 AIs should conduct investigations and take other
  appropriate measures to deal with merchants suspected of fraudulent or irregular activities (see also paras. 5.2.4 and
  5.2.5 above).
  5.5 Delinquency management
  5.5.1 An independent collection unit should be set up for
  managing delinquent accounts and collection actions.
  5.5.2 There should be written policies on management of
  delinquent accounts covering the classification of problem accounts, provisioning and charge-off (see section 6 below), controls on rescheduled accounts and collection actions.
  5.5.3 There should be reports to support management of
  delinquent accounts. Regular tracking reports on the effectiveness of collection actions (e.g. on the recovery rate) should be reviewed by the collection unit.
  5.5.4 The actual delinquency and charge-off ratios for different
  target customer segments within the credit card portfolio and for the portfolio as a whole should be regularly monitored and compared against the projected ratios. Any significant deviations from the projected trends and performance should be analysed and explained.
  5.5.5 Guidelines and procedures should be established for the
  appointment of external debt collection agencies for debt recovery. Adequate controls should be in place to ensure that the management of such agencies is in line with the provisions of the Code.
  5.5.6 If AIs become aware of any suspicious cases of fraudulent
  bankruptcies, they should report them to the relevant authorities for investigation. These include cases where customers have obtained or attempted to obtain credit after filing of petitions for bankruptcy.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
5.5.7 AIs should review the need for increased resources to
cope with any rising trend of bankruptcies. They should also consider means to deal with potential bankruptcies (e.g. initiation of debt relief plans and debt counselling). In predicting bankruptcies, AIs should regularly evaluate the effectiveness of their scoring systems and other forms of credit analysis.
5.6 Restructuring and debt relief plans
5.6.1 It is generally in an AI’s best interests to consider
restructuring the repayment terms or work out a debt relief plan with cardholders who are unable to repay their outstanding debts in accordance with the original terms but who show the willingness and ability to repay if the terms are modified, rather than putting them into bankruptcy hastily. In fact, some of these cardholders can be nursed back to health and may be able to repay their debts if some concessions are granted (e.g. forgiving a portion of the amount owed or lowering the original interest rate). For guidance on the management of problem credits, see CR-G-10 “Problem Credit Management” and the “Hong Kong Approach to Consumer Debt Difficulties” jointly issued by the Hong Kong Association of Banks, the DTC Association, the Finance House Association and the HKSAR Licensed Money Lenders Association.
5.6.2 In designing a restructuring or debt relief plan, AIs should
aim at helping the cardholders to extinguish their outstanding debts. Such plans should, therefore, be designed to maximise recovery of principal, rather than maximising income recognition or deferring losses. For example, lowering the minimum payment requirement may not be useful in helping the cardholders to repay their debts if normal fees and finance charges are continued to be levied on the outstanding balance.
5.6.3 The repayment period of debt relief plans should generally
be within 60 months. Any exception to this time frame should be well justified and properly documented.
5.6.4 AIs should state clearly in their accounting policies whether
credit card accounts under a restructuring or debt relief plan will continue to be regarded as credit card

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 receivables or will be reclassified as other types of personal lending.
6. Provisioning and charge-off
6.1 General
6.1.1 This subsection highlights the loan classification,
provisioning and charge-off practices commonly adopted by AIs for their credit card portfolios. The HKMA does not intend to prescribe a standardised approach for these practices, as this may not suit the circumstances of every AI.
6.1.2 It is envisaged that the adoption of new Hong Kong
Accounting Standards (“HKAS”) in 2005 and the implementation of the revised capital adequacy standards in 2007 will bring about further changes in the way AIs grade the credit quality of their retail assets and estimate the potential losses on these assets. The HKMA will monitor such industry developments and consider providing more specific guidance on these issues as and when necessary.
6.2 Overdue period
6.2.1 Credit card receivables are generally monitored
collectively on a portfolio basis and classified according to the length of the overdue period.
6.2.2 The practice of determining the overdue period for credit
card receivables varies among AIs. The overdue period may be computed starting from:

• the first statement date;
• payment due date shown in the first statement; or
• the second statement date.
  However it is measured, it should be applied consistently and stated explicitly in an AI’s policy.
  6.2.3 In determining whether an account is overdue, some AIs
  may allow a grace period for delayed payments due to technical factors such as postal delay or simple oversight. The grace period normally ranges from one day to a few

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 days and if the minimum payment is settled within the grace period, the account will not be regarded as overdue.
6.3 Loan classification and provisioning
6.3.1 Every AI should ensure that its loan classification and
provisioning policies can truly reflect the asset quality of its credit card portfolio and provide adequate provisions to absorb potential losses that may arise from the portfolio.
6.3.2 As the quality of a credit card portfolio may be best
indicated by the repayment performance of individual cardholders, the HKMA considers it acceptable for AIs to use the overdue period 25 as a predominant factor in classifying their credit card receivables. The following are some commonly adopted criteria for classifying such assets:

• Special mention - accounts overdue for more than 30
  days to 90 days;
• Substandard - accounts overdue for more than 90
  days to 120 days;
• Doubtful - accounts overdue for more than 120 days
  to 180 days; and
• Loss - accounts overdue for more than 180 days.
  6.3.3 Following the adoption of HKAS 39, the existing approach
  of maintaining specific and general provisions has been replaced by that for specific and collective provisions26 . As a result, AIs will need to ensure that the approach they

25 A common practice among AIs is to compute the overdue period using the payment due date shown in the first statement. AIs applying a different basis in the computation of the overdue period should take this into account in adopting the classification criteria set out in para. 6.3.2 above. 26 For the purpose of this module, (i) “specific provisions” means an allowance for impairment loss of financial assets that are individually assessed for impairment in accordance with HKAS 39, and provisions made in accordance with HKAS 37; and (ii) “collective provisions” means an allowance for impairment loss of financial assets that are collectively assessed for impairment in accordance with HKAS 39, and provisions made in accordance with HKAS 37. In addition, AIs may, in some circumstances, be required to hold a regulatory reserve for general banking risk.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 use for arriving at these provisions for credit card receivables meets the accounting requirements.
6.3.4 AIs are encouraged to develop appropriate models (e.g.
historical experience-based loss rate models adjusted to reflect current conditions, migration analysis or various other statistical methodologies) to estimate the amount of expected losses for the credit card portfolios, which may serve the purpose of a collective impairment assessment.
6.3.5 One of the models commonly used by international banks
is the roll-rate (or net flow rate) methodology which analyses the migration of accounts from one billing cycle to the next. Roll-rate is the percentage of balances, or accounts, that move from one delinquency stage to the next. In terms of the credit card portfolio, this model is based on historical loss experience, and projects the future contractual losses (net of recoveries) that are embedded within the portfolio by taking the roll-rate for each time band, including that for “non-delinquent” accounts, and multiplying it by the net contractual loss for that time band.
6.3.6 The roll-rate model can be adjusted to:

• reflect the effects of current economic conditions that
  did not affect the period on which the historical loss experience is based and other factors such as the effectiveness of loan collection activities, recovery and write-offs; and
• remove the effects of conditions in the historical
  period that do not exist currently.
  Subject to availability, a minimum of three years (preferably five years or more) of data should be used for the measurement of historical loss rates. Factors affecting economic conditions can be, for example, GDP, interest rate, unemployment rate and bankruptcy legislation.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
6.3.7 Based on collection experience, when a portfolio’s history
reflects high losses and low recoveries, more conservative standards are appropriate and necessary. For example, AIs should fully recognise incremental losses that may be inherent in over-limit portfolio segments and restructuring plans (in particular those with little progress in reducing the principal owed).
6.4 Charge-off
6.4.1 AIs should set out clearly in their policies and procedures
the criteria (i.e. the charge-off triggers used, such as bankruptcy or the overdue period) and the method (manual or automatic) for making charge-offs. An automatic charge-off mechanism can reduce manual intervention.
6.4.2 As reflected from industry practices, most AIs perform their
charge-off exercise on a monthly basis and charge off their credit card accounts when:

• the accounts have been overdue for more than 180
  days27 ;
• a bankruptcy petition is filed against the cardholder or
  a bankruptcy order is issued;
• a portion of debt was forgiven in a settlement
  arrangement28; or
• a loss due to fraud or other reasons is discovered and
  determined.
  AIs may be required to provide justifications if their practices are less prudent than the above.
  6.4.3 AIs should keep memorandum records of charged-off
  accounts for the amounts still formally owed by cardholders. —————————

27 It is noted that some AIs adopt more stringent criteria by setting the charge-off trigger at 150 days or even 120 days overdue. 28 Borrowers with financial difficulties may negotiate settlement agreements with AIs. In a settlement arrangement, the AI forgives a portion of the debt in exchange for the borrower’s promise to repay the remaining balance either in a lump-sum payment or by amortising the balance over several months.

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 Contents Glossary Home Introduction

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06
Annex A: Scoring systems
A1. Types of scoring systems
A1.1 Scoring systems and scorecards are tools used to predict the credit behaviour and repayment risk of individual customers based on application data and data obtained from the credit reference agency through credit checking. They evaluate the credit quality of a borrower by assigning statistically developed scores to defined credit attributes. A1.2 There are generally two types of scorecards: credit scorecards and behavioural scorecards. Credit scorecards are used in new account applications to assess the creditworthiness of applicants. Behavioural scorecards assess the quality of a customer through studying his account performance and credit behaviour such as cash advance, repayment performance, expenditure pattern and credit limit utilisation over time. Behavioural scorecards are usually applied in the review process, individual account management, collection or fraud detection. A2. Development of scoring systems A2.1 A successful scoring system provides a standardised way of measuring the inherent risk of a borrower. An important measure of a scoring system is its definition of risk and the care with which explanatory variables are defined, data are collected, and the system is tested. The standardised risk measurement should be based on historical data, measure the risk of default or loss and produce consistent results across time for a wide range of borrowers. Further investigation should be made on borrowers who do not meet the scoring criteria. A2.2 There should be a proper management approval process for the rollout of new scorecards. Such a process should include selection of data samples, testing of the model and approval hierarchy for the rollout. A2.3 Scorecards should be developed by the credit risk management unit and, if necessary, in conjunction with an external vendor with relevant expertise in statistical modelling. External vendors

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06 usually build scorecards based upon specific information and parameters provided by an AI’s management29 . A2.4 To achieve better predictability of a scoring model, the development sample should preferably be selected from an AI’s database containing customers who applied for credit within a reasonably recent period of time, say, two years. A2.5 Scorecards should be validated by appropriate testing on bad rate (i.e. the percentage of approved accounts that became delinquent), and user acceptance before formal implementation. A2.6 For application scoring models, the cut-off score should reflect the underwriting standards and risk appetite of AIs. There should be proper controls on who may decide and approve the level of the cut-off score, and the circumstances under which the cut-off score may be revised. Reasons and justifications for setting or changing the cut-off scores should be properly documented. A3. Monitoring of scorecard performance A3.1 The credit risk management unit should regularly monitor the performance of the scorecards by reviewing management reports covering:

• population stability - a report comparing the current
  application population and the population on which the scoring system was developed and measuring whether there are any material changes in the score distribution over time;
• characteristic analysis - an analysis measuring changes in
  applicants’ scores on individual credit attributes over time. This process is to help identify whether there is any shift in the population (which may in turn manifest itself in a change in the population stability index). The overall predictive power of the score in distinguishing good credits from bad credits should also be reviewed;
• approval and rejection rates;
• high and low side override rates30; and

29 Data used to develop the scorecard can come from three main sources:

• an AI’s previous good accounts, bad accounts and rejected applications;
• pooled or purchased data whose features closely resemble applicants which the AI targets;
  and
• expert intelligence (i.e. the logic and evaluation processes used by successful credit
  officers).

Supervisory Policy Manual
CR-S-5 Credit Card Business V.1 – 05.01.06

• delinquency vintage analysis - an analysis of the distribution of
  delinquency ageing by the time of account inception. A3.2 Validation of scorecards should be done regularly as needed to keep them statistically sound. The predictive ability of the scorecards should also be periodically evaluated by using statistical principles and methodologies. A3.3 Proper controls for initiating the redevelopment of scorecards should be established specifying the criteria for initiating the redevelopment, and who may initiate and approve the redevelopment.

30 An override is a decision to accept or reject an applicant when the scoring system says otherwise. A high side override means that an AI rejects an application which the scoring system would approve while a low side override means that an AI approves an application which the scoring system would reject.