Code of Practice – Banking (Securitization) Code

G.N. 164 Banking Ordinance (Chapter 155) CODE OF PRACTICE The Monetary Authority, having consulted with the persons specified in section 97M(2) of the Banking Ordinance (Chapter 155) and approved and issued a code of practice pursuant to section 97M(1) of that Ordinance, hereby, as required pursuant to section 97M(3) of that Ordinance:— (a) identify the following code (with English and Chinese versions) as being that code entitled:— (i) in English—‘Code of Practice for the Purposes of Providing Guidance in Respect of the Provisions of section 15B(c) and (d) and section 15C(3) of the Banking (Capital) Rules (Chapter 155L)’; and (ii) in Chinese—「就《銀行業 (資本) 規則》(第155L章) 第15B(c) 及 (d) 條及第15C(3) 條的 條文提供指引的實務守則」； (b) specify 11 January 2019 as the date on which the Monetary Authority’s approval of the code is to take effect; and (c) specify section 15B(c) and (d) and section 15C(3) of the Banking (Capital) Rules (Chapter 155L) as the relevant provisions for which the code is approved. 4 January 2019 Monetary Authority

Banking (Securitization) Code i Code of Practice for the Purposes of Providing Guidance in Respect of the Provisions of Section 15B(c) and (d) and Section 15C(3) of the Banking (Capital) Rules (Chapter 155L) Contents Clause Page I. Preliminary..............................................................................................................1

1. Citation ............................................................................................................1
2. Interpretation....................................................................................................1 II. Guidance on provisions set out in section 15B(c) and (d) of Capital Rules...........2
3. Meaning of eligible ABCP exposure ...............................................................2 III. Guidance on provisions set out in section 15C(3) of Capital Rules.......................5
4. Authorized institution may apply for approval to use IAA to determine risk-weight of eligible ABCP exposure ...........................................................5

Banking (Securitization) Code 1 Code of Practice for the Purposes of Providing Guidance in Respect of the Provisions of Section 15B(c) and (d) and Section 15C(3) of the Banking (Capital) Rules (Chapter 155L) (Approved and issued pursuant to section 97M(1) of the Banking Ordinance (Chapter 155)) I. Preliminary

1. Citation This code of practice may be cited as the Banking (Securitization) Code.
2. Interpretation (1) In this code of practice— (a) Capital Rules (資本規則) means the Banking (Capital) Rules (Chapter 155L); and (b) IAA rating (IAA 評級), for the purpose of providing guidance on the factors that will be considered by the Monetary Authority when determining whether to grant an IAA approval to an authorized institution under section 15C(2)(a), means a credit rating generated by the institution’s internal assessment process which is the subject of the application made by the institution under section 15C(1). (2) All words and expressions used in this code of practice that are defined in the Capital Rules have the same meaning as in the Capital Rules. (3) Unless the context otherwise requires, a reference to a section, a Part or a Schedule in this code of practice means a section in, a Part of, or a Schedule to, the Capital Rules.

Banking (Securitization) Code 2 II. Guidance on provisions set out in section 15B(c) and (d) of Capital Rules 3. Meaning of eligible ABCP exposure (1) Section 15B(c) and (d) provides as follows— “For the purposes of these Rules, a securitization exposure of an authorized institution having an IAA approval (specified exposure) is an eligible ABCP exposure if all of the following criteria are met— ...... (c) the ABCP programme has in place— (i) adequate and prudent standards on the underwriting and structuring of asset purchase transactions; and (ii) adequate and prudent policies, processes and structural features for assessing, controlling and mitigating risks associated with underlying exposures and other parties involved such as sellers of the underlying exposures and servicers; (d) the sponsor of the ABCP programme has an adequate and prudent policy on selecting ECAIs to assign ECAI ratings to debt securities to be issued under the ABCP programme; .….. ”. (2) In determining if the criterion in section 15B(c)(i) is being met, an authorized institution is expected to assess whether the ABCP programme concerned has in place adequate and prudent standards on underwriting and structuring of asset purchase transactions. To qualify as “adequate and prudent”, such standards should cover, without limitation, the following— (a) asset eligibility criteria that, among other things— (i) prohibit the purchase of significantly past due or defaulted assets; (ii) limit excessive concentration to individual obligor or geographical area; and

Banking (Securitization) Code 3 (iii) limit the tenor of the assets to be purchased; (b) requirements that an outline of the structure of a purchase transaction should be developed for the purpose of considering an asset purchase and the factors discussed in such an outline should include— (i) the type of asset being purchased; (ii) the type and monetary value of exposures arising from provision of liquidity facilities and credit enhancements; (iii) the loss waterfall; and (iv) the legal and economic isolation of the transferred assets from the seller of the assets; (c) requirements that a credit analysis of the risk profile of the asset seller concerned should be performed and the analysis should cover, among other things, the following aspects of the seller— (i) past and expected future financial performance; (ii) current market position and expected future competitiveness; (iii) leverage, cash flow, interest coverage and, if applicable, debt rating; and (iv) underwriting standards, servicing capabilities and collection processes; (d) a requirement that the aggregate estimate of loss on an asset pool that the ABCP programme is considering to purchase should take into account all sources of potential risk, such as credit risk and dilution risk; and (e) a requirement that there should be an assessment of the characteristics of the asset pool concerned including credit quality (for example, weighted-average credit score), any concentrations to an individual obligor or geographical region, and granularity. (3) In determining if the criterion in section 15B(c)(ii) is being met, an authorized institution is expected to assess whether the ABCP programme concerned has in place adequate and prudent policies, processes and structural features for assessing, controlling and mitigating risks associated

Banking (Securitization) Code 4 with underlying exposures and other parties involved such as sellers of the underlying exposures and servicers. To qualify as “adequate and prudent”, such policies should require, and such processes and structural features should include, without limitation, the following— (a) a separate reserve established for dilution risk in cases where— (i) the seller-provided credit enhancement is sized based only on credit-related losses; and (ii) dilution risk is material for the pool of underlying exposures concerned; (b) a credit enhancement level that is sized taking into account relevant historical performance information (including losses, delinquencies, and in the case of underlying exposures that are receivables, the dilutions and the turnover rate of the receivables) covering a time period that is long enough to permit meaningful credit evaluation1 ; (c) collection processes that take into account the operational capability and credit quality of the servicer concerned; (d) various measures for mitigating, to the extent possible, seller/servicer risk, such as triggers based on current credit quality of the seller or servicer to prevent co-mingling of funds and lockbox arrangements to help ensure continuity of payments to the ABCP programme; and (e) where relevant, appropriate structural features for mitigating the risk of potential credit deterioration of underlying exposures, for example, wind-down triggers specific to a pool of underlying exposures. (4) In determining if the criterion in section 15B(d) is being met, an authorized institution is expected to assess whether the sponsor of the ABCP programme concerned has an adequate and prudent policy on selecting ECAIs to assign ECAI ratings to debt securities to be issued under the ABCP programme. To qualify as “adequate and prudent”, the policy should be able to ensure that the ECAIs chosen by the sponsor to rate the ABCP programme or the debt securities issued under it, as the case may be,

1 In general, the time period is expected to be not shorter than 3 years.

Banking (Securitization) Code 5 do not only include those ECAIs that generally have relatively less restrictive rating methodologies. III. Guidance on provisions set out in section 15C(3) of Capital Rules 4. Authorized institution may apply for approval to use IAA to determine risk-weight of eligible ABCP exposure (1) Section 15C(3) provides as follows— “Without limiting subsection (2)(b), the Monetary Authority must refuse to grant an approval to an authorized institution to use the IAA unless the institution satisfies the Monetary Authority that the institution, and its internal assessment process that is the subject of the application, are subject to an appropriate governance and risk management framework (framework) which ensures at all times that— (a) there is effective oversight of the internal assessment process and other related activities of the institution; (b) the rating methodologies used for assessing the institution’s securitization exposures to an ABCP programme are— (i) prudent; and (ii) appropriate to the characteristics of the ABCP programme; (c) there are adequate and prudent policies, procedures and internal controls for ensuring that— (i) the internal assessment process is risk-sensitive and robust; and (ii) requirements under these Rules, for the time being in force in respect of the use of the IAA, are complied with; and (d) there are regular and independent reviews conducted by qualified persons to assess the adequacy and validity of the internal assessment process and its outputs.”. (2) In determining if the criterion in section 15C(3)(a) is being met, the Monetary Authority will consider whether—

Banking (Securitization) Code 6 (a) the internal assessment process of the authorized institution concerned and the IAA ratings generated by the process in general meet those requirements specified in Part 6 and Schedule 2 that are equally applicable to an internal assessment process for ABCP programmes (for example, section 152 related to rating definition, criteria and process, section 155(a) related to independence of the rating process, and Schedule 2 section 1(a) related to oversight by the board of directors and senior management). (3) In determining if the criterion in section 15C(3)(b) is being met, the Monetary Authority will consider whether— (a) the internal assessment process of the authorized institution concerned generates an IAA rating for a securitization exposure to an ABCP programme (ABCP exposure) based on rating methodologies of at least one ECAI (ECAI rating methodologies); (b) only ECAI rating methodologies meeting all the following criteria can be based on for generating an IAA rating for an ABCP exposure — (i) the ECAI rating methodologies are publicly available; (ii) the ECAI rating methodologies are developed for the asset type purchased under the ABCP programme concerned; (iii) the ECAI concerned has been nominated by the institution for the purposes of Part 7 in the manner set out in section 267(1)(a); (iv) the ABCP programme, or any of the debt securities issued under it, is rated by the ECAI; (c) the internal assessment process identifies gradations of risk; (d) when rating an ABCP exposure, the internal assessment process is at least as conservative as the publicly available ECAI rating methodologies of the ECAIs that rate the ABCP programme concerned, or any of the debt securities issued under it, for the asset type purchased under the programme, in particular with regard to stress factors for determining the credit enhancement level required in order to achieve a particular external rating category; and

Banking (Securitization) Code 7 (e) in connection with paragraph (d)— (i) the institution, in cases where the ABCP programme or the debt securities issued under it, as the case may be, is rated by more than one ECAI that use different benchmarks or assumptions in their rating methodologies in respect of the same risk factor, adopts the more conservative benchmark or assumption in its internal assessment process; (ii) the institution considers, to a reasonable extent, all other relevant publicly available ECAI rating methodologies in its credit assessment of the ABCP exposure; and (iii) the institution, if it has access to non-publicly available ECAI rating methodologies, takes into consideration these methodologies in its credit assessment of the ABCP exposure to supplement the publicly available ECAI rating methodologies, particularly when the non-publicly available ECAI rating methodologies are more conservative. (4) In determining if the criterion in section 15C(3)(c) is being met, the Monetary Authority will consider whether— (a) the authorized institution concerned maintains documentation to— (i) substantiate that the ECAI rating methodologies selected by it are robust and appropriate for use in its internal assessment process for the type of ABCP programme and the type of asset purchased concerned; and (ii) explain in detail how the ECAI rating methodologies are applied in the institution’s internal assessment process to derive IAA ratings that correspond to the relevant standards in the ECAI rating methodologies; (b) there is documentation to clearly specify which IAA rating corresponds to which external rating category of an ECAI; (c) the institution— (i) monitors any changes in the ECAI rating methodologies used in its internal assessment process; and

Banking (Securitization) Code 8 (ii) reviews the IAA ratings assigned to ABCP exposures if any of those changes adversely affects the ECAI issue specific ratings assigned to the ABCP programme concerned or the debt securities issued under it; (d) the institution tracks the performance of its IAA ratings over time to evaluate the performance of the ratings and makes adjustments, as necessary, to its internal assessment process when the performance of the ABCP exposures concerned routinely diverges from the IAA ratings assigned to these exposures; (e) the IAA ratings generated from the institution’s internal assessment process are also used in its internal risk management processes, including management information system and economic capital system; and (f) the institution has policies, procedures and controls to ensure that after the IAA approval is granted to it and when the institution intends to use the IAA to risk-weight an ABCP exposure— (i) there is an adequate verification process to confirm that the exposure is an eligible ABCP exposure; and (ii) the documents and analysis supporting the confirmation are properly kept and will be available to the Monetary Authority on request. (5) In determining if the criterion in section 15C(3)(d) is being met, the Monetary Authority will consider whether— (a) there are regular reviews of the adequacy of the internal assessment process of the authorized institution concerned and regular assessments of the validity of the IAA ratings generated by the process2 ; and (b) the reviews and assessments are conducted by a party (such as internal or external auditors, or the institution’s risk management function) that is independent of— (i) the parties responsible for designing and operating the internal

2 In general, the frequency of reviews/assessments is expected to be at least annually.

Banking (Securitization) Code 9 assessment process; and (ii) the ABCP programme business line (including those parties responsible for the underlying customer relationships). Monetary Authority 4 January 2019

---