Banking (Capital) (Operational Risk) Code

G.N. 7290 Banking Ordinance (Chapter 155) Code of Practice The Monetary Authority, pursuant to section 97M(1) of the Banking Ordinance (Chapter 155), approves and issues a code of practice after consultation with the persons specified in section 97M(2) of that Ordinance. The Monetary Authority hereby, as required pursuant to section 97M(3) of that Ordinance:— (a) identifies the following code (with English and Chinese versions) as being that code entitled:— (i) in English— ‘Code of Practice for the Purposes of Providing Guidance in Respect of the Provisions of Section 323 and Section 336 of the Banking (Capital) Rules (Chapter 155L)’; and (ii) in Chinese—「就《銀行業(資本)規則》(第155L章)第323條及第336條的條文提供指 引的實務守則」; (b) specifies 1 January 2025 as the date on which the Monetary Authority’s approval of the code is to take effect; and (c) specifies section 323 and section 336 of the Banking (Capital) Rules (Chapter 155L) as the relevant provisions for which the code is approved. 2 December 2024 Eddie W. M. YUE Monetary Authority

Code of Practice for the Purposes of Providing Guidance in Respect of the Provisions of Section 323 and Section 336 of the Banking (Capital) Rules (Chapter 155L)

Banking (Capital) (Operational Risk) Code i Code of Practice for the Purposes of Providing Guidance in Respect of the Provisions of Section 323 and Section 336 of the Banking (Capital) Rules (Chapter 155L) Table of Contents I. Preliminary .............................................................................................................1

1. Citation ............................................................................................................1
2. Interpretation....................................................................................................1 II. Guidance.................................................................................................................1
3. Guidance on provisions set out in section 323(2) of Capital Rules in respect of calculation of BI..........................................................................................1
4. Guidance on provisions set out in section 323(1) and 323(3) of Capital Rules in respect of “high quality operational loss data”............................................6
5. Guidance on provisions set out in section 323(1) and 323(4) of Capital Rules in respect of “operational loss event” ............................................................14
6. Guidance on provisions set out in section 336(1)(a) and 336(2) of Capital Rules in respect of threshold for excluding loss data from LC calculation...14
7. Guidance on provisions set out in section 336(1)(c) and 336(3) of Capital Rules in respect of excluding losses of operational loss event from calculation of LC ...........................................................................................15

Banking (Capital) (Operational Risk) Code 1 Code of Practice for the Purposes of Providing Guidance in Respect of the Provisions of Section 323 and Section 336 of the Banking (Capital) Rules (Chapter 155L) (Approved and issued by the Monetary Authority pursuant to section 97M(1) of the Banking Ordinance (Chapter 155)) I. Preliminary

1. Citation This code of practice may be cited as the Banking (Capital) (Operational Risk) Code.
2. Interpretation (1) In this code of practice,  Capital Rules (資本規則) means the Banking (Capital) Rules (Chapter 155L);  Specified Amount means the amount specified under paragraph 6(3). (2) All words and expressions used in this code of practice that are defined in the Capital Rules have the same meaning as in the Capital Rules. (3) Unless the context otherwise requires, a reference to a section in this code of practice means a section in the Capital Rules. II. Guidance
3. Guidance on provisions set out in section 323(2) of Capital Rules in respect of calculation of BI (1) Section 323(2) provides as follows: “For the purpose of calculating the BI of an authorized institution, the Monetary Authority may, having regard to Chapter OPE10 of the current Basel Framework, specify the following types of income statement or balance sheet items— (a) dividend income; (b) fee and commission expenses; (c) fee and commission income;

Banking (Capital) (Operational Risk) Code 2 (d) gains minus losses arising from assets and liabilities booked in the banking book; (e) gains minus losses arising from assets and liabilities booked in the trading book; (f) interest earning assets; (g) interest expenses; (h) interest income; (i) other operating expenses; (j) other operating income.” (2) Having had regard to Chapter OPE10 of the current Basel Framework, the Monetary Authority now specifies the types of income statement and balance sheet items in Table A. Table A Specification of income statement and balance sheet items Item Income statement or balance sheet items Description Typical sub-items (a) Dividend income Dividend income from investments in stocks and collective investment schemes not consolidated in the authorized institution’s financial statements, including dividend income from non-consolidated subsidiaries, associates and joint ventures (b) Fee and commission expenses Expenses paid for receiving advice and services (including outsourcing fees paid by the authorized institution for the supply of financial services, but not outsourcing fees paid for the supply of non-financial services such as logistics, IT, and human resources) Fees and commission expenses from:  Clearing and settlement  Custody  Servicing of securitizations  Loan commitments and guarantees received  Foreign transactions (e.g. foreign exchange, remittance) (c) Fee and commission Income received from providing Fee and commission income from:

Banking (Capital) (Operational Risk) Code 3 Item Income statement or balance sheet items Description Typical sub-items income advice and services (including income received by the authorized institution for providing outsourcing of financial services)  Securities (issuance, origination, reception, transmission, execution of orders on behalf of customers)  Clearing and settlement  Asset management  Custody  Fiduciary transaction  Payment services  Structured finance  Servicing of securitizations  Loan commitments and guarantees given  Foreign transactions (e.g. foreign exchange, remittance) (d) Gains minus losses arising from assets and liabilities booked in the banking book The following items that are booked in the banking book:  Gains minus losses on financial assets and liabilities measured at fair value through the profit and loss account  Realised gains minus losses on financial assets and liabilities not measured at fair value through the profit and loss accounts (e.g. loans and advances, assets available for sale, assets held to maturity, financial liabilities measured at amortised cost)  Gains minus losses from hedge accounting  Gains minus losses from exchange differences (e) Gains minus losses arising from assets and The following items that are booked in the trading book:  Gains minus losses on trading assets and

Banking (Capital) (Operational Risk) Code 4 Item Income statement or balance sheet items Description Typical sub-items liabilities booked in the trading book trading liabilities (e.g. derivatives, debt securities, equity securities, loans and advances, short positions, other assets and liabilities)  Gains minus losses from hedge accounting  Gains minus losses from exchange differences (f) Interest earning assets Interest bearing assets and leased assets  Total gross outstanding loans, advances, interest bearing securities (including government bonds and zero coupon bonds (which provide for imputed interest)) and leased assets, including those on non-accrual status  Interest rate derivative assets (which affect the institution’s interest income under applicable accounting standard) with a positive fair value (captured at fair value) (g) Interest expenses Interest expenses from all financial liabilities and other interest expenses (including interest expenses from finance and operating leases, depreciation and impairment of, and  Interest expenses from deposits, debt securities issued, finance leases and operating leases  Interest expenses from hedge accounting derivatives  Other interest

Banking (Capital) (Operational Risk) Code 5 Item Income statement or balance sheet items Description Typical sub-items losses from, operating lease assets) expenses  Losses from leased assets  Depreciation and impairment of operating lease assets (h) Interest income Interest income from all financial assets and other interest income (including interest income from finance and operating leases and profits from leased assets)  Interest income from loans and advances, assets available for sale, assets held to maturity, trading assets, finance leases and operating leases  Interest income from hedge accounting derivatives  Other interest income  Profits from leased assets (i) Other operating expenses Expenses and losses from ordinary banking operations not included in but of similar nature to any of the other items (under the column of “Income statement or balance sheet items”) in this table, and from operational loss events, excluding expenses from operating leases  Losses from non￾current assets and disposal groups classified as held for sale not qualifying as discontinued operations (based on IFRS 5.37 or HKFRS 5)  Losses incurred as a consequence of operational loss events (e.g. fines, penalties, settlements, replacement cost of damaged assets), which have not been provisioned/reserved

Banking (Capital) (Operational Risk) Code 6 Item Income statement or balance sheet items Description Typical sub-items for in previous years  Expenses related to establishing provisions/reserves for operational loss events (j) Other operating income Income from ordinary banking operations not included in but of similar nature to any of the other items (under the column of “Income statement or balance sheet items”) in this table, excluding income from operating leases  Rental income from investment properties  Gains from non￾current assets and disposal groups classified as held for sale not qualifying as discontinued operations (based on IFRS 5.37 or HKFRS 5) 4. Guidance on provisions set out in section 323(1) and 323(3) of Capital Rules in respect of “high quality operational loss data” (1) Section 323(1) provides as follows: “In this Part— high quality operational loss data (高質業務操作虧損數據) means data that meets the standards specified by the Monetary Authority under subsection (3); …” (2) Section 323(3) provides as follows: “For the purposes of this Part, the Monetary Authority may, having regard to the minimum standards for the use of loss data under the standardized approach set out in Chapter OPE25 of the current Basel Framework, specify standards in relation to the identification, collection, treatment, validation, review, scope and content of data on operational loss.”

Banking (Capital) (Operational Risk) Code 7 (3) Having had regard to the minimum standards for the use of loss data under the standardized approach set out in Chapter OPE25 of the current Basel Framework, the Monetary Authority now specifies the standards for high quality operational loss data in relation to the identification, collection, treatment, validation, review, scope and content of data as follows: An authorized institution should: (a) have documented policies, procedures and processes to manage operational loss data for capital calculation purposes covering: (i) end-to-end system design for identification, collection, aggregation and treatment of such data; (ii) storage, retention, archiving and as applicable deletion of such data; and (iii) back-up of such data, and such procedures and processes should be subject to:  validation by internal or external auditors or other capable parties before the operational loss data can be used for the calculation of capital charge for operational risk under Part 9 of the Capital Rules; and  regular independent reviews by internal or external auditors or other capable parties at least annually. (b) classify and document the criteria for classifying an operational loss event into one of the event-type categories specified in Table B (see also paragraph 5(3)) below in accordance with the description, categories and activity examples described in the Table. (c) ensure that its operational loss data are comprehensive and such data should capture, among others, all material activities and exposures from all appropriate systems and subsystems and geographic locations. (d) maintain operational loss data for an operational loss event if the cumulative operational losses arising from the event after deduction of recoveries over the calculation period as applicable to the authorized institution is more than or equal to the Specified Amount. (e) include the information as set out in Table C below as the operational loss data for an operational loss event referred to in

Banking (Capital) (Operational Risk) Code 8 item (d) above. (f) have processes to independently review the comprehensiveness and accuracy of the operational loss data periodically (at least annually). (g) maintain records of payments received for recovery of operational losses. If requested by the Monetary Authority, the authorized institution must produce the records to the Monetary Authority for inspection. (h) build its loss data set based on the “date of accounting” (see item 1 “reference dates” in Table C below). (i) allocate losses and related recoveries caused by a common operational loss event or by related operational loss events over time but posted to the accounts over several years to the corresponding years in line with their accounting treatment. (j) include in the calculation of the operational risk capital requirements the losses from any acquired businesses and merged entities over the period prior to the acquisition/merger that is relevant to the calculation. Table B Operational loss event-type categories (Events specified by the Monetary Authority under paragraph 5(3) are shown under the column “Event-type category”) Event-type category Definition Categories Activity examples Internal fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ Unauthorised activity  Transactions not reported (intentional)  Transaction type unauthorised (with monetary loss)  Mismarking of position (intentional) Theft and fraud  Fraud / credit fraud / worthless deposits  Theft / extortion / embezzlement /

Banking (Capital) (Operational Risk) Code 9 Event-type category Definition Categories Activity examples discrimination events, which involves at least one internal party robbery  Misappropriation of assets  Malicious destruction of assets  Forgery  Check kiting  Smuggling  Account takeover / impersonation etc  Tax non-compliance / evasion (wilful)  Bribes / kickbacks  Insider trading (not on firm’s account) External fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party Theft and fraud  Theft / robbery  Forgery  Check kiting Systems security  Hacking damage  Theft of information (with monetary loss) Employment practices and workplace safety Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events Employee relations  Compensation, benefit, termination issues  Organised labour activity Safe environment  General liability (slip and fall etc)  Employee health and safety rules events  Workers compensation Diversity and discrimination  All discrimination types Clients, Losses arising Suitability,  Fiduciary breaches /

Banking (Capital) (Operational Risk) Code 10 Event-type category Definition Categories Activity examples products and business practices from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product disclosure and fiduciary guideline violations  Suitability / disclosure issues (know-your￾customer etc)  Retail customer disclosure violations  Breach of privacy  Aggressive sales  Account churning  Misuse of confidential information  Lender liability Improper business or market practices  Antitrust  Improper trade / market practices  Market manipulation  Insider trading (on firm’s account)  Unlicensed activity  Money laundering Product flaws  Product defects (unauthorised etc)  Model errors Selection, sponsorship and exposure  Failure to investigate client per guidelines  Exceeding client exposure limits Advisory activities  Disputes over performance of advisory activities Damage to physical assets Losses arising from loss or damage to physical assets from natural disaster or Disasters and other events  Natural disaster losses  Human losses from external sources (terrorism, vandalism)

Banking (Capital) (Operational Risk) Code 11 Event-type category Definition Categories Activity examples other events Business disruption and system failures Losses arising from disruption of business or system failures Systems  Hardware  Software  Telecommunications  Utility outage / disruptions Execution, delivery and process management Losses from failed transaction processing or process management, from relations with trade counterparties and vendors Transaction capture, execution and maintenance  Miscommunication  Data entry, maintenance or loading error  Missed deadline or responsibility  Model / system mis￾operation  Accounting error / entity attribution error  Other task mis￾performance  Delivery failure  Collateral management failure  Reference data maintenance Monitoring and reporting  Failed mandatory reporting obligation  Inaccurate external report (loss incurred) Customer intake and documentation  Client permissions / disclaimers missing  Legal documents missing / incomplete Customer / client account management  Unapproved access given to accounts  Incorrect client records (loss incurred)  Negligent loss or damage of client

Banking (Capital) (Operational Risk) Code 12 Event-type category Definition Categories Activity examples assets Trade counterparties  Non-client counterparty mis￾performance  Miscellaneous non￾client counterparty disputes Vendors and suppliers  Outsourcing  Vendor disputes Table C Data requirement for operational loss event Information Narratives

1. Reference dates The following dates in respect of an operational loss event: (a) the date when the event happened or first began (“date of occurrence”) where available; (b) the date when the authorized institution became aware of the event (“date of discovery”); and (c) the date (or dates) when a loss event results in a loss, reserve or provision against a loss being recognised in the authorized institution’s profit and loss (P&L) accounts or for losses related to legal events, the date when a legal reserve is established for the probable estimated loss in the P&L accounts (“date of accounting”).
2. Drivers or causes Descriptive information of the drivers or causes of a loss event, the level of detail of which should be commensurate with the size of the gross loss amount of the event.
3. Gross loss amount Gross loss amount should include in its computation: (a) direct charges, including impairments and settlements, to the authorized institution’s P&L accounts and write-downs due to an operational loss event; (b) costs incurred as a consequence of an operational loss event including external expenses with a direct link to the event (e.g. legal expenses directly related to the event and fees paid to advisors, attorneys or suppliers) and costs of repair or replacement, incurred to restore the position that was prevailing

Banking (Capital) (Operational Risk) Code 13 Information Narratives before the event; (c) provisions or reserves accounted for in the P&L accounts against a potential operational loss; (d) losses stemming from an operational loss event which are temporarily booked in transitory and/or suspense accounts and are not yet reflected in the P&L accounts (“pending losses”). Any material pending loss (i.e. that is more than or equal to the Specified Amount) should be included in the loss data set within a time period commensurate with the size and age of the pending item; and (e) negative economic impacts booked in a financial accounting period due to operational loss events impacting the cash flows or financial statements of previous financial accounting periods (“timing losses”). Any material timing losses (i.e. that is more than or equal to the Specified Amount) should be included in the loss data set when they are due to events that span more than one financial accounting period; but should exclude: (a) costs of general maintenance contracts on property, plant or equipment; (b) internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives and enhancements; and (c) insurance premiums. 4. Operational risk loss Operational risk loss is the gross loss amount net of recoveries. 5. Recoveries of gross loss amount A recovery in relation to an operational loss event means, subsequent to a loss being recognized, the occurrence of funds or inflows of economic benefits received from a third party. Recoveries should be divided into non￾insurance recoveries and insurance recoveries. Only payment received (as opposed to receivables) can be counted as recoveries. Tax effects, which refer to the benefit of deferred tax liability or reductions in corporate income tax liability due to operational losses, should also be excluded.

Banking (Capital) (Operational Risk) Code 14 5. Guidance on provisions set out in section 323(1) and 323(4) of Capital Rules in respect of “operational loss event” (1) Section 323(1) provides as follows: “In this Part— operational loss event (業務操作虧損事件) means an event specified by the Monetary Authority under subsection (4); …” (2) Section 323(4) provides as follows: “For the purposes of this Part, the Monetary Authority may, having regard to Table 2 in Chapter OPE25 of the current Basel Framework, specify events the classification of an operational loss into which forms part of the requirements that the data of an authorized institution must meet for the data to be high quality operational loss data.” (3) Having had regard to Table 2 in Chapter OPE25 of the current Basel Framework, the Monetary Authority now specifies that the events specified under section 323(4) are any events which fall within the “event-type categories” set out in Table B. 6. Guidance on provisions set out in section 336(1)(a) and 336(2) of Capital Rules in respect of threshold for excluding loss data from LC calculation (1) Section 336(1)(a) provides as follows: “For the purpose of calculating its LC, an authorized institution must exclude the losses arising from an operational loss event under any of the following situations— (a) where the cumulative losses after deduction of recoveries arising from the event over the period for which the LC is calculated is less than the threshold specified by the Monetary Authority under subsection (2);” (2) Section 336(2) provides as follows: “For the purposes of subsection (1)(a), the Monetary Authority may specify a threshold, having regard to OPE25.18 of the current Basel Framework.” (3) Having had regard to OPE25.18 of the current Basel Framework, the Monetary Authority now specifies that the threshold referred to in section 336(2) is HK$200,000.

Banking (Capital) (Operational Risk) Code 15 7. Guidance on provisions set out in section 336(1)(c) and 336(3) of Capital Rules in respect of excluding losses of operational loss event from calculation of LC (1) Section 336(1)(c) provides as follows: “For the purpose of calculating its LC, an authorized institution must exclude the losses arising from an operational loss event under any of the following situations— … (c) where the Monetary Authority has approved the institution to exclude the losses arising from the event from the calculation of its LC.” (2) Section 336(3) provides as follows: “The Monetary Authority may grant approval under subsection (1)(c) if the Monetary Authority considers it prudent to do so, having regard to the risk profile of the authorized institution.” (3) The Monetary Authority may consider it prudent to exclude the losses arising from an event from the calculation of the LC if the Monetary Authority is content that (a) the authorized institution has demonstrated to his satisfaction that the event is no longer relevant to its risk profile; and (b) the losses arising from the event have been included in the calculation of the annual operational risk losses for a period of at least 3 years. (This does not apply to an event occurring in businesses or activities divested by the institution.) (4) Despite subparagraph (3) above, the Monetary Authority may not consider a request to exclude operational losses of an event from the calculation of the LC if – (a) the cumulative losses after deduction of recoveries arising from the event over the calculation period do not exceed 5% of the arithmetic mean of annual operational risk losses of the authorized institution over the same period; or (b) the Monetary Authority has had considered other relevant factors, as appropriate. Eddie W. M. YUE Monetary Authority 2 December 2024

---