Consultation on Revised SPM Modules CR-S-5, RR-1, and SR-1

1 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To provide guidance to AIs on the management of risks associated with credit card business Classification A non-statutory guideline issued by the MA as a guidance note Previous guidelines superseded Guideline 3.6 "Referees in Applications for Credit Cards or Loans" dated 23.01.96; Circular on “Credit Card Lending” dated 21.06.01; and “Best Practices for Credit Card Operations” (Annex to Circular on “Bankruptcy and Consumer Credit Lending” dated22.02.02) and CR-S-5 “Credit Card Business” (V.1) dated 05.01.06 Application To all AIs that engage in credit card business directly or through their subsidiaries or affiliated companies controlled by them Structure

1. Background and scope 1.1 Introduction 1.2 Basic features of credit cards 1.3 Types of credit cards 1.4 Sources of income for credit cards 1.51.3 Areas covered in the Code of Banking PracticeConsumer protection 1.61.4 Application to other unsecured consumer finance
2. Major risks in credit card business

2 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 2.1 Credit risk 2.2 Operational risk 2.3 Liquidity risk 2.4 Legal and reputation risks 3. Board and senior management oversight 3.1 Business strategies 3.2 Risk management controls 4. Account solicitation and approval process 4.1 Marketing programmes 4.2 Application information 4.3 Verification of documentation and credit checking 4.4 Underwriting criteria 4.5 Controls over approval process 4.6 Credit limit assignment 4.64.7 Personal loans granted using available credit card limit 4.74.8 Card issuing controls 4.8 Approval of new merchants 5. Account and portfolio management 5.1 Cardholder account management 5.2 Merchant account management 5.35.2 Portfolio quality and analysis 5.45.3 Fraud control 5.55.4 Delinquency management 5.65.5 Restructuring and debt relief plans 6. Provisioning and charge-off 6.1 General 6.2 Overdue period 6.3 Loan classification and provisioning 6.4 Charge-off 7. Merchant acquiring business management

3 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 7.1 Approval of new merchants 7.2 Merchant account management Annex A: Scoring systems

4 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation

1. Background and scope 1.1 Introduction 1.1.1 This module is aimsed at to provideing general guidance to AIs on the major risks associated with credit card business, and the systems of control expected of them AIs in managing such risks business. It also sets out the best practices that they should aim to achieve1 . 1.1.2 Experience has shown that the quality of AIs’ credit card portfolios mirrors the economic environment in which they operate. Very often, there is a strong correlation between an economic downturn and deterioration in the quality of such portfolios. The deterioration may become even more serious if AIs have relaxed their credit underwriting criteria and risk management standards as a result of intense competition in the market. It is therefore important for AIs to maintain prudent policies and practices for managing the risks of their credit card business which are relevant to the market environment that they operate in. 1.1.31.1.2 To facilitate a better understanding of the risks involved in the credit card business, the basic featuresgeneral information of credit cards and their associated operations the way they operate are highlighted in subsections 1.2 to 1.4 below. 1.2 Basic features of credit cards 1.2.1 The term “credit card” generally refers to a plastic card (whether physical or virtual)2 assigned to which allows a cardholder with a credit limit that can be used to purchase goods and services on credit or obtain cash advances. 1.2.2 Credit cards allow cardholders to pay for purchases made over a period of time, and to carry a balance from one billing cycle to the next. Credit card purchases normally become payable after a free credit period (see para. 1.4.2 below) during which no interest or finance charge is 1 If AIs have adopted some practices that may not fully align with those recommended in this module, they are expected to provide justifications for the approach taken and be able to demonstrate that adequate risk assessment has been undertaken and the risk mitigating measures in place are sufficiently robust to cater for these practices. 2 Some AIs may assign a virtual card number that is different from that on the plastic card to enable the cardholder to purchase goods and services on the internet. The credit limit of the virtual card is usually very low.

5 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation imposed. Interest is charged on the unpaid balance after the payment is due. Cardholders may pay the entire amount due and save on the interest that would otherwise be charged. Alternatively, they have the option of paying any amount, as long as it is higher than the minimum amount due, and carrying forward the balance. 1.2.3 A credit card scheme typically involves the following parties: • Cardholders - persons who are authorized to use credit cards for the payment of goods and services; • Card issuers - institutions which issue credit cards; • Merchants - firms which agree to accept credit cards for payment of goods and services; • Merchant acquirers - institutions which enter into agreements with merchants to process their credit card transactions; and • Credit card associations - organisations that license card issuers to issue credit cards under their trademark, e.g. China UnionPay, MasterCard, Visa, etc. and MasterCard, and provide settlement services for their members (i.e. card issuers and merchant acquirers); .and • Other types of service providers - with the growth of online transactions and digital payments, there are new types of service providers such as payment gateways and payment processors providing services to facilitate the processing of card transactions. These services may include capturing, encrypting and transmitting transaction information to the merchant acquirers and systems of credit card associations, validating transactions, etc.

6 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 1.2.4 The relationships between these various parties are illustrated in the followingdiagram: 1.2.5 Credit card schemes normally operate at an international level, meaning that cardholders belonging to card issuers in one country can make purchases at the place of business of merchants signed up by merchant acquirers in another country. 1.2.6 Credit cards include charge cards (also called “travel and entertainment” cards), which are proprietary brands (e.g. Diners Club) that are not affiliated with any credit card association or any of the other brands, and the same organisation acts as the card issuer and the merchant acquirer. 1.2.7 Charge cards have similar features as credit cards, except that they do not normally have pre-set spending limits. Another difference is that the balance on a charge card account is payable in full when the statement is received and cannot be rolled over from one billing cycle to the next. In spite of this, revolving credit is available on some plans to enable cardholders to leave a pre-set balance unpaid. 1.2.81.2.5The focus of this module is on the operations, risks and controls associated with credit card schemes of which AIs Credit Card Association Cardholder Merchant Card Issuer Merchant Acquirer Purchase made by credit cards Goods or services Billing to cardholder Repayment Presentment of sales Reimbursement Clearing & settlement Clearing & settlement Payment Gateway & Payment Processor

7 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation (or their subsidiaries or affiliated companies under their control) are the card issuer or the merchant acquirer. As such, relevant requirements of this module also apply to charge card schemes3 operated by AIs directly or through their subsidiaries / affiliates. 1.3 Types of credit cards 1.3.1 Credit cards can be broadly categorised into two types: general purpose cards and private label cards. The former are issued under the trademark of credit card associations and accepted by many merchants while the latter are only accepted by specific retailers (e.g. a department store). 1.3.2 Most of the card issuing AIs in Hong Kong offer general purpose credit cards. These cards are normally categorised by AIs as platinum, gold or classic to differentiate the services offered on each card and the income eligibility criteria. AIs may, at the request of a cardholder, issue a supplementary card to another individual who is usually an immediate family member of the cardholder. 1.3.3 It is quite common for AIs to partner with business corporations or non-profit making organisations (e.g. charitable or professional bodies) to issue co-branded cards or affinity cards. 1.3.4 AIs may also issue corporate credit cards to the employees of their corporate customers. Generally, the employees use these cards for travel and entertainment expenses incurred in the course of their work. 1.3.5 The types of credit cards mentioned above are not exhaustive. AIs may, from time to time, introduce new credit card products to satisfy customer needs and cater for changes in market conditions. 1.4 Sources of income for credit cards 1.4.1 Credit card income is generated from different types of fees and 3 Charge cards have similar features as credit cards, except that they do not normally have pre￾set spending limits. Another difference is that the balance on a charge card account is payable in full when the statement is received and cannot be rolled over from one billing cycle to the next. In spite of this, revolving credit is available on some plans to enable cardholders to leave a pre￾set balance unpaid.

8 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation charges. While such fees and charges may vary among card issuers or merchant acquirers, they generally include the following: Card issuers • Annual fee – this is payable at the start of the membership year. However, it is not uncommon for card issuers to waive the annual fee as an incentive to increase cardholders’ loyalty; • Interest charge on outstanding balance – this constitutes the bulk of the earnings from credit cards. The methodology of interest calculation differs among AIs. As an example, the card issuer may charge the cardholder interest on the balance carried forward from the payment due date. The period of time between the transaction date and the payment due date (around three weeks from the billing date) for credit card purchases is interest free, provided that the billed amount is repaid on or before the due date. Otherwise, interest on the unpaid balance will be charged from the transaction date. The cardholder is liable to pay a minimum amount due, which is set at a percentage of the billed amount. • Fees and charges on cash advances – cardholders are allowed to withdraw cash from designated ATMs or over the counter of the card issuer or its affiliated companies, using the credit card. A handling fee is imposed when the cash is withdrawn. Interest is also charged once the cash advance facility is utilised. • Foreign exchange differential – most of the credit cards can be used overseas. When cardholders spend in foreign currencies and settle the dues in the local currency, card issuers profit from the differential between the bid and ask prices of the foreign currencies. • Interchange fee – when card issuers reimburse merchant acquirers on credit card transactions, an interchange fee is charged to cover various costs relating to transaction processing and authorization, fraud and fraud prevention, funding for the interest free period, and the payment guarantee. • Other fees and charges – card issuers may also impose on cardholders other fees and finance charges for paying late or for exceeding the credit limit. • Merchant acquirers

9 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation • Fees and charges on merchants – merchant acquirers may levy on merchants processing, servicing or setup fees (e.g. for e-commerce merchants). The amount and types of fees charged vary among merchant acquirers, and can be negotiated with the merchants in the light of their business relationships. It is common for a discount rate to be imposed on the value of credit card transactions presented by merchants. 1.51.3 Areas covered in the Code of BankingPracticeConsumer protection 1.5.11.3.1 The Code of Banking Practice (“the Code”) 4 , which was issued jointly by the Hong Kong Association of Banks and the DTC Association, sets out the minimum standards that with which AIs are expected to observecomply when dealing with their personal customers. Reference should be made to Chapters 1, 3 and 5 of the Code which covers the following areas that are pertinent to credit card businessAIs should ensure that all relevant provisions of the Code are complied with when conducting credit card business so as to promote good banking practices, avoid customer disputes and foster business relationships.: • the issue of cards; • the disclosure of terms and conditions (including fees and charges and annualised percentage rates); • the right of set-off; • the collection, use and holdingofcustomer information (including personal referees); • the security of cards / personal identification numbers (“ PINs” ); • transaction records; • unauthorized transactions / lost cards or authentication factors / liability for loss; • handling customer complaints (see also “Complaint Handling Procedures”); and • the use of debt collection agencies. 1.3.2 AIs should ensure that all relevant provisions of the Code are complied with in their conduct of credit card business so 4 https://www.hkma.gov.hk/media/eng/doc/code_eng.pdf

10 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation as to promote good banking practices, avoid customer disputes and foster business relationships.AIs should also follow other HKMA requirements and guidance relevant to card issuing and merchant acquiring businesses, including SPM module TM-E-1 “Risk Management of E-banking”, the circular letters on “Enhancing Consumer Protection in Respect of “Buy Now, Pay Later” Products of 2 September 2022, “Major Enhancements on Protection of Payment Card Customers” of 20 June 2023, “Consumer Protection in respect of Digital Marketing Activities” of 20 December 2023, “Payment Card Direct Debit Authorisation” of 5 November 2024, and other relevant requirements and guidance issued by the HKMA from time to time. 1.61.4 Application to other unsecured consumerfinance 1.4.1 Although credit card business has its own distinct features, it shares some common characteristics (e.g. in relation to credit and legal risks) with other types of unsecured consumer finance. Hence, in managing such credit products, AIs should, where applicable, have regard to the general lending and risk management principles set out in sections 3 to 6 below. 1.6.11.4.2 Other unsecured consumer finance refers to short or medium term lending extended to individuals to finance their personal expenditure (i.e. not for business or home purchase) on an unsecured basis. Such lending includes personal loans, tax loans, and overdrafts, and “Buy Now, Pay Later” products. 1.6.2 Although credit card business has its own distinct features, it shares some common characteristics (e.g. in relation to credit and legal risks) with other types of unsecured consumer finance. Hence, in managing such credit products, AIs should, where applicable, have regard to the general lending and risk management principles set out in sections 3 to 6 below. 2. Major risks in credit card business 2.1 Credit risk 2.1.1 Credit risk poses is an inherent significant risk to AIs involved in credit card business. A card issuing AI has

11 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation incurs an exposure to a cardholder when the AI reimburses pays athe merchant acquirer 5 for a transaction on behalf of the cardholder or when the cardholder obtains cash advances from his credit card account. Such an exposure will remain if the cardholder does not repay the entire amount of the outstanding balance by the due date. As credit card lending is unsecured, the source of repayment depends primarily upon the cardholder’ s creditworthiness and repayment capacity. 2.1.2 It is not uncommon for customers to hold multiple credit cards issued by the same or different AIs. Availability of sufficient information is important for AIs to assess the overall indebtedness and creditworthiness of their credit card applicants. In this regard, the establishment of a credit reference agencyies (see IC-6 “The Sharing and Use of Consumer Credit Data through a Credit Reference Agenciesy” for more details) in Hong Kong to provide consumer credit reference service has enhanced AIs’ ability to make more informed credit decisions (see also para. 3.1.2 and 4.3.6 below). 2.1.3 Credit risk may be increased considerably if AIs adopt aggressive strategies for expanding their credit card business due to competitive pressures, without managing the associated risks properly. These may include: • relaxing the underwriting standards for approving credit card applications, including those solicited under “ pre-approved” programmes; • adopting a relaxed attitude in accepting alternative income proof for assessing the creditworthiness of applicants; • offering multiple credit cards to existing cardholders or increasing an excessive increase in their credit card limits excessively without adequate assessment of their overall repayment capacity; and • delaying collection actions (e.g. tolerating limit excesses) on customers with repayment problem. 5 This may be a local or an overseas non-local (in the case of overseas spending outside Hong Kong) financial institution.

12 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation Such practices could lead to a rapid and significant deterioration in credit quality of the credit card portfoliomask portfolio quality , increase the risk profile of cardholders quickly and result in rapid and significant portfolio deterioration, especially when economic conditions worsen. 2.1.4 As merchant acquirers, AIs incur credit risk when merchants fail to reimburse them for chargebacks6 . 2.2 Operational risk 2.2.1 Credit card operations are highly automated and involve large volumes of customer and transactional data. These characteristics reflect the need for strong operational and security controls. 2.2.2 Both card issuing and merchant acquiring AIs are exposed to operational risk from various sources, including data processing and security issues, outsourcing arrangements and fraudulent transactions. Data processing and security issues 2.2.3 The highly automated processing environment for credit cards is susceptible to data processing and security risks. It is therefore important for AIs to put in place relevant policies and procedures to manage and control these risks, . In particular, they should focus on having adequate controls and procedures to focusing in particular on protect ensuring data integrity and security of customer information (including data retention and confidentiality). as well as appropriate AIs should also have regularly tested back-up and disaster recovery plans and regular testing of such arrangements to guard against system failure and unexpected disruptions. Relevant guidance is contained in TM-G-1 “General Principles for Technology Risk Management”, OR-2 “Operational Resilience” and TM-G-2 “Business Continuity Planning” and the circular on “Payment Card Security”. Moreover, AIs should regularly review their operational capacity to ensure that it is adequate to cope with any 6 Chargebacks are reversed transactions, usually caused by customer disputes such as the return of faulty goods by cardholders and non-delivery of goods and services by merchants, processing errors or fraud.

13 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation targeted growth in business volume. Third-party dependency managementOutsourcing arrangements 2.2.4 As the use of third-party service providers, including payment gateways and payment processors 7 , to handle all or part of the credit card processing functions has become increasingly common, AIs should be fully aware of the risks involvedof improper management of outsourced activities. If not properly managedthe systems and controls of the service providers turn out to be defective, the functions supported by third-party service providers this could lead to a decline in operational or servicing standards for the outsourced functions or even the leakage and misuse of credit card data processed or stored in their systemsby the service providers. 2.2.5 It is essential for AIs to follow the general guidance given in SA-2 “Outsourcing”, as well as OR-2 “Operational Resilience” where critical operations are concerned, when managing the third-party service providers. Apart from consulting AIs should consult the HKMA on the third-party service outsourcing arrangements and, based on supervisory expectation, AIs should be satisfied with the control environment of the service providers concerned, including the security controls over the integrity and confidentiality of customer information maintained in the outsourced systems of the service providers, and ensure that they service providers comply with the security standards and requirements of the credit card associations. This should be ascertained by AIs through should regularly review and evaluate ion that the relevant controls to ensure that they are up to the standard required. AIs should also retain ultimate control over the outsourced data accessed, processed, transmitted, or stored by service providers8 . 7 These service providers may handle a variety of functions, including marketing agents, data processing operations for card issuers or a range of merchant services (such as billing, reporting, customer service, authorization and settlement) on behalf of merchant acquirers. As a result, a huge amount of credit card data (including customer information and transaction data) may be processed or stored in the systems of these service providers. 8 Among other things, the outsourcing agreement with the service provider should allow for supervisory inspection of the operations and controls of the service provider as they relate to the outsourced activity.

14 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation Fraudulent transactions 2.2.6 This section highlights Described here are some common sources of fraudulent transactions. As this is a complex and ever-changing area, AIs need to be aware of the evolving typologies modus operandi of fraud and monitor such developments on an ongoing basis. 2.2.7 Lost cards and stolen cards information represent have been a major common source of fraudulent transactions, which can be difficult to detect. Fraudsters have a long history of using physical cards obtained by illicit means9 to directly conduct fraudulent transactions. Therefore, timely reporting of loss by cardholders is crucial for minimising potential losses on these transactions. Other types of fraud, such as counterfeit cards and internet fraud, are of growingconcern. 2.2.72.2.8 With enhanced technology, counterfeit cards can produce a very plausible true to life imitation of a real card, and it is easy for a professional counterfeiter to copy the magnetic stripe information from one card on to another. Apart from duplicate card production, skimming is another means of counterfeiting credit cards. Skimming takes place during the course of a genuine transaction and involves copying the magnetic stripe details from a genuine payment card and transferring them to another card without the original cardholder’ s knowledge. In response, credit card associations have introduced “chip cards” to reduce the risk of skimming of magnetic stripe information. 2.2.82.2.9 Along with rapid technological developments and the increasing use of credit cards as a medium of payment for online purchases or fund transfers, fraudulent transactions via the internet are on the rise. Cardholders using internet banking services may be exposed to the 9 For example, stealing, interception of cards in the mail, deceptive card applications and staff fraud, etc.

15 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation risks of “phishing”10 and “pharming”11 where they disclose confidential information regarding their accounts unknowingly to fraudsters through the internet. Fraudsters could “steal” credit card information without the physical cards leaving the possession of cardholders. Common techniques include hacking into the systems of merchants or third-party service providers, malicious websites or software with malware attached, phishing12 and pharming13, etc. Having obtained the credit card information and passwords of the original cardholders, the fraudsters may conduct online transactions without the original cardholders’ knowledge. The difficulty of detecting such frauds lies in the fact that the transactions are all electronic and do not involve any face-to-face contact with the parties concerned. In other words, it is hard to know whether the counterparty, or the website, is genuine. Recently there has also been an increase in frauds involving manipulation of victims to issue online payment orders (commonly known as authorized push payment scams). 2.2.10 Card issuing AIs should educate customers to monitor the activities of their credit card accounts often and immediately report transactions not made by themselves, regardless of the amount. This helps the customers to minimise potential losses on fraudulent transactions. 2.2.92.2.11 Other types of fraudulent transactions may arise from the interception of cards in the mail, deceptive card 10 Phishing attacks use both social engineering and technical subterfurge to steal consumers’ personal identity data and financial account credentials. Social-engineering schemes use “spoofed” e-mails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such as credit card numbers, account usernames and passwords etc. Hijacking brand names of banks, retailers and credit card companies, phishers often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials directly, often using Trojan Keylogger spyware. 11 Pharming crimeware misdirects users to fraudulent sites or proxy servers, typically through DNS hijacking or poisoning. 12 Phishing attacks use both social engineering and technical subterfuge to steal consumers’ personal identity data and financial account credentials. Social-engineering schemes use “spoofed” e-mails, usually with embedded hyperlink, to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such as credit card numbers, account usernames and passwords etc. Hijacking brand names of banks, retailers and credit card companies, phishers often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials directly, often using Trojan Keylogger spyware. 13 Pharming crimeware misdirects users to fraudulent sites or proxy servers, typically through DNS hijacking or poisoning.

16 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation applications, staff fraud, or forged mail orders14 . 2.2.102.2.12 In view of the significance of fraud control to credit card operations, AIs should institute appropriate risk management measures to prevent and detect fraud (see subsection 5.3 for more details). 2.3 Liquidity risk 2.3.1 Both card issuing and merchant acquiring AIs are exposed to liquidity risk, particularly so for AIs whose credit card operations constitute a major part of their business. Card issuing AIs are obliged to settle payments with merchant acquirers for transactions on behalf of their cardholders within a short period of time, regardless of when payments are received from cardholders (which might be spread across several months). Merchant acquiring AIs may settle payments for credit card transactions with merchants before receiving payment from card issuers in respect of those transactions. 2.3.2 Liquidity risk also arises for merchant acquiring AIs where chargebacks or refunds to cardholders reach a level that cannot be covered by the merchants’ sales volume. 2.3.3 AIs should ensure that there is sufficient liquidity to meet their obligations arising from credit card transactions by establishing adequate liquidity risk management systems and controls (see “LM-2 Sound Systems and Controls for Liquidity Risk Management” LM-1 “Liquidity Risk Management” for general guidance). 2.4 Legal and reputation risks 2.4.1 AIs are exposed to legal and reputation risks arising from non-compliance with laws, rules or regulations or breaches in the terms and conditions of the agreements with cardholders, merchants and credit card associations. 2.4.2 AIs should be wary of a whole host of events which, if incurredoccurred, can induce adverse publicity and legal action from disgruntled parties. Examples include: • adoption of improper practices that lead to unfair 14 Much less checking can be done on mail orders, as they normally require less information, such as a card number and expiry date.

17 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation treatment of credit card customers; • misconduct of debt collection agencies used by AIs; • issue of credit cards indiscriminately to students (i.e. those without stable income or independent financial means); • perpetration of staff fraud resulting in unauthorized transactions or misuse of credit card information; and • theft of credit cards and customer information due to lax internal security controls or inadequate control over the security standards of third-party service providers supporting to which all or part of the credit card operations have been outsourced.; and • failure to properly deal with customers’ complaints and disputes related to credit cards. All such incidents run the risk of damaging AIs’ reputation, and leading to potential claims for losses and compensation. 2.4.3 An AI’ s reputation can also be seriously affected by any adverse publicity on its merchants or partners of affinity or co-branded programmes. 2.4.4 AIs should not preclude the possibility that credit cards may be misused for conducting money laundering or terrorist financing activities, especially when as the use of credit cards for payments or remittances through the internet (which may be exposed to a higher risk of abuse15) is becominges more common. AIs should watch out for any potential abuse of credit cards for such purposes. 15 As an example, the provision of worldwide internet remittance services by some remittance companies through debiting remitters’ credit cards may pose a high money laundering and terrorist financing risk. In conjunction with some credit card associations these service providers can effect fund transfers to beneficiaries worldwide by debiting the remitters’ credit card accounts and issuing ATM cards to the designated beneficiaries for fund withdrawals. To apply for such services, remitters simply open an account with the service provider through the internet by providing information on their credit cards and the beneficiaries. These remittance transactions are susceptible to money laundering and terrorist financing because: (i) the remittance company provides non-face-to-face services and does not conduct any customer due diligence on the remitter or the designated beneficiary; (ii) the ATM cards are easily transferable, thus allowing for greater anonymity than the traditional use of supplementary credit cards; and (iii)it is likely that most of these transactions will not be regulated (i.e. no competent authorities will be aware of them when the remittances take place in their jurisdictions).

18 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 3. Board and senior management oversight 3.1 Business strategies 3.1.1 Senior management is expected to develop and review the business strategies of an AI’ s credit card business in accordance with the overall business objectives and risk tolerances approved by the Board. These strategies should reflect realistic goals based on reasonable data and assumptions. 3.1.2 With the greater sharing of consumer credit data in Hong Kong, AIs are given access to more information to facilitate credit decision making not only in the credit application process but also during ongoing credit reviews. This gives rise to the opportunity for card issuing AIs to consider the feasibility of adopting tiered interest rates or risk-based pricing according to the creditworthiness of individual cardholders in their portfolios, although whether such pricing strategies will be adopted is ultimately a matter for AIs to decide based on their own circumstances. 3.1.2 Some AIs which may, for intend to strategically reasons, have a tendency to target at the sub-prime market16 in their credit card solicitation programmes in order to earn more income (e.g. through charging higher interest rates and fees under risk-based pricing) from those customers with a weakened credit history (e.g. habitually late payments) and a greater appetite for credit than other ordinary customers17 . Sub- prime credits can be profitable, provided that the interest charged by AIs is sufficient to cover higher 16 The sub-prime programmes mentioned in para. 3.1.2 refer to those that purposefully employ tailored marketing, underwriting and risk selection policies and criteria to solicit customers whose credit quality is generally weaker than other average customers (e.g. they may have overdue records exceeding 90 days and hence exhibit higher probabilities of default). Some of them may eventually go into bankruptcy or require a charge-off. As a result, the pricing and terms offered to sub-prime borrowers often differ substantially from those offered to prime borrowers, and separate and distinctly different underwriting standards are adopted. 17 The sub-prime programmes mentioned in para. 3.1.3 above refer to those that purposefully employ tailored marketing, underwriting and risk selection policies and criteria to solicit customers whose credit quality is generally weaker than other average customers (e.g. they may have overdue records exceeding 90 days and hence exhibit higher probabilities of default). Some of them may eventually go into bankruptcy or require a charge-off. As a result, the pricing and terms offered to sub-prime borrowers often differ substantially from those offered to prime borrowers, and separate and distinctly different underwriting standards are adopted.

19 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation loan loss rates and overhead costs related to underwriting, servicing, and collecting the credit.should ensure that the risk involved is consistent with the risk appetite approved by the Board and they have the capital, expertise and system of controls that meet the requirements set out in paragraph 3.2.7. 3.1.3 AIs should recognise that there are unique and significant risks inherent in sub-prime credit card lending. Those wishing to engage in such activity will have to determine if these risks are acceptable and controllable, given the organisation’s financial condition, portfolio size, level of capital support and staff expertise. 3.1.4 AIs may also consider promoting other types of unsecured lending products, such as personal loans, revolving credits and overdrafts, so that customers have more choices of the form of borrowing that best suit their needs. 3.1.53.1.3AIs planning to expand their credit card business in overseas markets outside Hong Kong (e.g. through the issue of credit cards by their overseas non-local branches or subsidiaries) should have a good understanding of the markets in which they intend to operate in, including the operating and competitive environment, the legal framework and judicial systems, and the risk profile and behavioural characteristics of their targeted customers. 3.1.63.1.4To facilitate the formulation and review of business strategies, AIs should develop a framework for assessing regularly the profitability and return on their credit card portfolios. 18 Where appropriate, AIs should adjust their business strategy based on the results of such analysis. 3.2 Risk management controls 3.2.1 The Board and senior management are expected to ensure that an the AI has established a comprehensive risk management process framework for identifying, monitoring, measuring and controlling the risks associated with its credit card business (see IC-1 “General Risk Management Controls Framework” for guidance). 18 For example, such analysis considers all associated costs (including origination costs, administrative or servicing expenses, charge-offs and capital) and reviews performance against clearly set benchmarks such as target return, delinquency and charge-off levels.

20 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 3.2.2 Although the organisational structure of credit card operations may vary among AIs, there should be clearly defined accountability and responsibility at every level of the structure and sufficient segregation of duties (see also IC-1 “General rRisk Mmanagement controls Framework”) in the following functions: • marketing and account solicitation; • application approval; • risk management; • fraud control; and • delinquency management. 3.2.3 AIs should establish policies and procedures for their credit card operations that are commensurate with the characteristics and scale of such business. The policies and procedures should be documented in writing and approved by senior management or any committee with delegated authority. 3.2.4 The policies and procedures for credit card operations should cover the following major areas: • Application approval – these should describe clearly the underwriting criteria for approving new cardholders and merchants, the mechanism for review of the criteria, the frequency of such review, the documentation requirements, the policy relating to setting of credit limits for cardholders and the authority and parameters for approving exceptions or overrides; • Credit risk management – these should set out the procedures for management of cardholders’ credit limits (such as the criteria for card upgrade, card renewal and increase in credit limit) and ongoing assessment of merchants’ financial and operational condition. The role and functions of a credit risk management unit and the tools for managing credit risk should be clearly described, including how the asset quality of a credit card portfolio is evaluated regularly, how merchant chargebacks are monitored and the types of corrective actions to be taken where concerns exist with particular cardholders or merchants;

21 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation • Operational risk management – these should cover the procedures and controls in respect of physical security controls on credit cards, controls over authorization of credit card transactions, integrity of transaction data and timely processing of transactions, controls over customer data retention and confidentiality, information technology controls, back￾up and disaster recovery plans, managing outsourcing third-party risk, and measures to prevent and detect fraud; and • Delinquency management – these should cover the classification of delinquent accounts, provisioning, charge-off, restructuring and collection actions. 3.2.5 Senior management should review regular reports which detail management information on AIs’ credit card operations, including the number of new cardholders and merchants, account attrition, portfolio composition, sales volume, credit quality, over-limits, and overrides, and chargebacks and frauds. 3.2.6 Regular audits performed on credit card operations should generally cover: • compliance with internal policies and procedures (such as credit underwriting and review, authorization, documentation, delinquency monitoring, and collection procedures, fraud control, segregation of duties and access controls) and relevant regulatory rules and guidelines; and • use of scorecards and credit card activities supported by third-party service providersrelated outsourcing activities, if applicable. Any weaknesses and irregularities identified should be reported to senior management and rectified promptly. 3.2.7 AIs which are engaged in sub-prime credit card lending should have in place systems and controls that typically involve enhanced performance monitoring, intensive collection activities and other loss mitigation strategies. Sub-prime accounts should be differentiated within the credit card portfolio, and sufficient capital and resources should be available to support sub-prime credit card lendingsuch activity.

22 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 4. Account solicitation and approval process 4.1 Marketing programmes 4.1.1 A well-documented proposal should be prepared for each major marketing programme. The proposal should, where applicable, include: • the target market segment and forecasted customer response rate; • the basis of the marketing approach; • product pricing, profit projection, expected usage and delinquency and loss rates; • underwriting criteria; • documentation requirements; • the policy on credit limit assignment; and • requirements for operational and system support. 4.1.2 If the marketing proposal involves any significant relaxation of existing product terms (e.g. an extended payment cycle or a reduction in the minimum payment required19), there should be a detailed risk assessment and due consideration of related risk management implications. AIs are encouraged to consider the need for setting a cap on the number of cards allocated to or the amount of the exposure to be incurred that fall under such programmes. 4.1.3 Policies and Pprocedures should be in place to ensure that the marketing proposals are commercially sound and operationally feasible, and . Particularly, these procedures should be able to establish that: • the profit projection is reasonable; • the underwriting criteria are prudent and appropriate risk control measures are in place; • the proposal complies with the relevant regulatory requirements and the AI’ s internal policies and limits; and 19 AIs should guard against lowering minimum payment requirements and extending principal payment cycles to an extent that may result in negative amortisation of card receivable balances (i.e. outstanding balances continue to increase as minimum payments consistently fall short of covering all finance charges and fees assessed during a billing cycle).

23 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation • adequate system capacity is available to support implementation of the proposals. Marketing programmes that operate outside the pre-set policies and procedures should be approved by senior management and, where appropriate, be reviewed by the relevant departments before launching. 4.1.4 AIs should review the outcome of major marketing initiatives to ascertain whether these initiatives have achieved their objectives and whether there are any issues or lessons that should be taken into account in the planning and implementation of future programmes, particularly from the risk management perspective. 4.1.5 When soliciting new customers by AIs often use “pre￾approved”, “affinity” or “co-branded card” programmes, to solicit new customers. This is acceptable as long as the offer of such AIs should ensure that these programmes does not amount to liberal granting of the credit cards to selected customers, and that the information requirement (see section 4.2 and 4.3 below) and prudential underwriting criteria will be followed. In the case of “affinity” or “co-branded” programmes, AIs should ensure that they have adequate control over the approval and acceptance of the applications under the programmessuch accounts. 4.1.6 Each application solicited from the above programmes should be thoroughly assessed against prudent underwriting criteria. To facilitate credit assessment, these customers should still be required to submit application information (see para. 4.2.1 below and footnote 14) along with their income proof or, where appropriate, “income surrogates” (see paras. 4.3.2 to 4.3.4 below). 4.1.7 For marketing programmes that target existing customers, AIs may require less information from the applicants if certain information (e.g. static personal information) is already in their possession (see also para. 4.2.2 below). 4.2 Application information 4.2.1 AIs should collect sufficient information, either through application forms20 or other means (e.g. the a credit reference 20 These include application forms accessed or distributed through the internet.

24 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation agency21), for the purposes of customer due diligence22 as well as assessing the creditworthiness and financial position of credit card applicants. Such information generally includes: • Personal particulars - e.g. name (including former or other name(s)), date and place of birth, unique identification number (e.g. Hong Kong identity card or passport number) and document type, nationality and, marital status, educational background, residential address information 23 (and permanent address if different), residence type (mortgaged, owned or rented) and monthly rent or mortgage instalment amount; • Occupation details - e.g. name of present employer, office address, nature of business, present position, years of service with the present employer and monthly or annual income; and • Credit references - e.g. number of credit cards held, credit card limits granted, and information on other credit commitments or facilities (e.g. personal loan or overdraft); and • Financial references - e.g. residence type (mortgaged, owned or rented) and monthly rent or mortgage instalment amount. 4.2.2 An AI may collect extra information not listed above if this is considered essential for assessing a credit card application and consistent with the Personal Data (Privacy) Ordinance (Cap. 486). 4.2.3 In the case of For applicants who are existing customers of AIs, there is scope for reducing the information required, such as the static personal information (i.e. name, date and place of birth, Hong Kong identity card or passport number) that is available in their database. Nevertheless, AIs should consider the need for updating some other non-static information (e.g. occupation or income particulars) that may have changed. 21 AIs are encouraged to make full use of the credit reference information of individual applicants available from the a credit reference agency in their credit assessment process. 22 See AML-2 “Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (for Authorized Institutions)” for guidance on customer due diligence. 23 See paragraph 4.3.5 of AML-2 “Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (for Authorized Institutions)” for guidance in this respect.

25 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 4.2.4 AIs should make known to the an applicant what types of the documents (see para. 4.3.2 below) should required to be submitted in his application24 . AIs should not easily dispense with income proof requirements. In addition, efforts there should be made procedures in place to draw the applicant’s attention to the major terms and conditions of the cardholder agreement (see section 30.2 of the Codepara. 2.3 of “Review of the Code of Banking Practice” issued by the HKMA in November 2001). 25 4.2.5 AIs should obtain relevant information (e.g. through the a credit reference agency) to ascertain whether: • the applicant has owned any credit card that was cancelled due to default payment; • the applicant has any overdue payment exceeding, for example, 30 days, in respect of his indebtedness; • there is any bankruptcy order made against the applicant; and • the applicant is in the process of petitioning for bankruptcy petition. Such information should be taken into account in making the credit decision. 4.2.6 To protect AIs’ interests, applicants should be required to make a declaration on the application form to certify the truth and completeness of the information submitted. AIs may also wish to alert applicants that if they make a false statement in the application and subsequently default, they may commit an offence under section 71 of the Crimes Ordinance (Cap. 200). 4.2.7 Application forms (particularly the cardholder’s declaration and the major terms and conditions of the cardholder agreement) should be properly reviewed by the internal compliance and legal unit or external lawyers to make sure that they comply with all relevant legal and regulatory requirements (e.g. Personal Data (Privacy) 24 If an application is accepted by phone, AIs should request the applicant to submit the required documents for verification. 25 If an application is accepted by phone, AIs should request the applicant to submit the required documents for verification.

26 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation Ordinance (Cap. 486)) and do not contain any false information which may constitute misrepresentation to the applicants. 4.3 Verification of documentation and credit checking 4.3.1 Every application should be checked for the completeness of documentation and to screen out unqualified applications, e.g. under age 1826 . 4.3.2 Valid documents for verification of the identity and creditworthiness of new customers27 should be obtained. Such documents include: • identity proof (e.g. copy of Hong Kong Identity Card or passport); • address proof28; and • income proof29 (e.g. latest income tax demand note, latest payroll advice, bank statements showing the past three months’ salary). If the applicant is self￾employed30, unemployed, or retired, in which case and income proof may not beis not readily available, appropriate alternative evidence or “income surrogates” (see paras. 4.3.3 and 4.3.4 below) should be obtained to support the application. 4.3.3 AIs may sometimes waive the requirement of income proof and accept alternative evidence to estimate the income of the applicants. This practice, if undertaken, requires that there are should be supplemented by robust procedures for assessing and verifying such alternative evidence. While income proof is not the only consideration for a credit card 26 See para. 29.1(b) of the Code on opening credit card accounts with customers under age 18. 27 In the case of existing customers, AIs may wish to update changes in their non-static information. 28 While AIs are generally expected to collect address proof from borrowers for the purpose of credit risk management and fraud control, the collection of address proof may be replaced by other measures if AIs can demonstrate that the measures are equally effective in managing the relevant risks. 29 In accordance with the guidelines on “New Personal Lending Portfolio” first introduced in May 2018, AIs may carve out a portion of their unsecured personal lending portfolio, in respect of which adherence to conventional lending practices will not be required. Instead of collecting borrowers’ income proof to assess their repayment ability, AIs may adopt new credit risk management techniques and practices enabled by innovative technology, such as big data and consumer behavioral analytics, to approve and manage the related credit risks. 30 Self-employed applicants may submit the Business Registration Certificate, the latest profit tax demand note and other deposit/asset proof instead.

27 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation application, AIs should, where possible, obtain such information (and preferably information about expenditures such as instalment payments) to assess the applicant’ s repayment ability. 4.3.4 AIs may use income surrogates (e.g. fixed deposit receipts or main bank account statements for the last three months) to assess the financial strength of applicants who are unable to provide income proof, or to supplement income proof submitted by themapplicants. Certain income surrogates, such as the credit card statement issued by other AIs, home or car ownership (which may be subject to mortgages), credit card sales slips or subscription to mobile phone services, are however not reliable substitutes for income proof. 4.3.5 Where income surrogates are used, AIs may wish to grant a lower credit limit to the successful applicant initially, especially if there is no available record on his credit history (see para. 4.3.6 below). A normal limit may be granted when the applicant has established a satisfactory credit history. 4.3.6 Checking of applicants against internal and external credit records should be performed. In particular, AIs may obtain useful information from the credit reference agencyies provide useful information on such matters as the credit exposures of the applicant, whether the applicant has lodged a petition for bankruptcy petition, or his past credit performance. 4.3.7 AIs should conduct proper customer due diligence on applicants, including the checking of details of applicants against a database of names and particulars of terrorist suspects which consolidates the various lists issued by the United Nations and other countries (e.g. US Executive Order) for the purpose of identifying cases relating to terrorist financing (see ML-1 “Prevention of Money Laundering”31 for further details). 4.3.8 AIs should also check publicly available information or commercially available databases to establish whether an 31 This module is under development. For the time being, see Guideline 3.3 “Prevention of Money Laundering” issued on 21 December 2000 and the Supplement issued on 8 June 2004.

28 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation applicant is a politically exposed person (“PEP”) 32 . The decision to approve the application of a PEP should be taken at a senior managementlevel. 4.3.94.3.7 AIs that process accept credit card applications through mail, mobile application or internet should put in place sufficient safeguards to prevent the use of stolen information (e.g. theft of ID cards) for getting applications approved33 . The Code requires AIs to bear the losses resulting from such applications where the card is not received by the genuine cardholder, unless the cardholder has acted fraudulently or with grossnegligence. 4.4 Underwriting criteria 4.4.1 Procedures should be in place to screen out applicants with unfavourable credit attributes. This is usually achieved by requiring an applicant to meet a set of underwriting criteria before approving the application. The attributes generally cover the following areas: • income level; • nature of employment, particularly in respect of job security and income stability34; • acceptable credit record and credit reference agency checking results (see para. 4.3.6 above); • asset requirement (especially for high risk customers or customers without no stable income source); • acceptable age range; and • permanent residence (in other words, temporary addresses such as hotel address or post office box number should not be accepted by AIs). Underwriting criteria should not be relaxed imprudently because of competition or for the purpose of market penetration. 32 PEPs are defined as individuals being, or who have been, entrusted with prominent public functions, such as heads of state or of government, senior politicians, senior government, judicial or military officials, senior executives of public organisations and senior political party officials. The concern is that there is a possibility, especially in countries where corruption is widespread, that such PEPs may abuse their public powers for their own illicit enrichment through the receipt of bribes etc. 33 See circular "Remote on-boarding of individual customers" issued on 1 February 2019. 34 To facilitate assessment, AIs should identify occupations that carry higher credit risk.

29 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 4.4.2 Specific policies and procedures should be established for handling applications from customers who do not have stable income or independent financial means. In particular, AIs should set out clearly how the repayment ability of these applicants will be assessed and how the credit limit will be set. 4.4.3 Where a credit scoring model is used to screen applications, AIs should ensure that the credit scoring system (e.g. credit attributes and cut-off score 35 ) is regularly reviewed and, if necessary, updated to ensure that it remains valid despite changes in the customer profile. See Annex A for a general description of the use of scoring systems for credit risk management purposes. 4.4.4 The HKMA recognises that issuing credit cards is a commercial decision for AIs.Experience has shown that the quality of AIs’ credit card portfolios is cyclical, i.e. it deteriorates during economic downturns. The deterioration may become even more serious if AIs have relaxed their credit underwriting criteria and risk management standards during economic good times, possibly as a result of intense competition in the market. However, it It is therefore important that AIs maintain prudent underwriting standards at all times so that they are better prepared their credit card portfolios can to withstand the likely increase in effect of delinquency and charge off ratios during economic downturnswhen undesirable trends in consumer lending (e.g. the edging up of delinquency and charge-off ratios and the rising trend in bankruptcies) are more likely to take place. 4.5 Controls over approval process 4.5.1 AIs There should be have guidelines and clear parameters for approvingal and monitoring of exceptional cases (i.e. applications which are approved with deviations from AIs’ established underwriting criteria). AIs They should establish limitations limits to control the exceptional 35 A cut-off score is the minimum credit score determined by an AI’ s management. Borrowers whose credit scores are not above the approved cut-off score do not meet the AI’ s minimum underwriting criteria. However, management may override a borrower’ s unacceptable credit score when other mitigating factors are present. Exceptions to the AI’ s credit scoring system should be properly documented. AIs should consider whether they need to adjust their cut-off scores to reduce the incidence of bad debts.

30 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation approvals that can be granted (e.g. in terms of a ratio of the number of approved applications). There should also be and conduct ongoing tracking of the level of exceptional approvals and the performance of those accounts. 4.5.2 AIs using a credit scoring system should similarly control the exceptional cases referred for manual review. If the number of such cases have exceeded the prescribed level, the underlying reasons should be investigated. 4.6 Credit limit assignment 4.6.1 Credit limits should be decided determined based on the basis of the a customer’s risk credit profile of individual customers and by reference to the customer’ s (e.g. credit history, monthly income, job stability, overall banking relationship and financial assets held with the AI) or and other relevant factors such as overall banking relationship, total asset balance or deposits held. Other considerations in assigning credit limits include the prevailing economic conditions and the AI’s customers’ job stability and risk appetite. Keen competition should not be a justification for assigning higher credit limits. 4.6.2 For AIs using a credit scoring system, the factors mentioned in para. 4.6.1 are valid considerations to be incorporated into the system. 4.6.3 There should be a maximum credit limit for each customer to control his total unsecured credit exposures. The limit may be set as a multiple of the customer’s monthly income. For customers with multiple credit cards issued, a centralised credit limit or sub-limits for individual credit cards should be set. 4.6.4 Any increase in existing credit limits should be premised upon the spending record and good repayment history of the cardholder. If the increase is initiated by the cardholder, AIs should ensure that the information on the cardholder is adequate for evaluating his request. 4.6.5 Over-limit tolerances can magnify the risk of credit card lending, especially for sub-prime accounts. Timely repayment of amounts that exceed established credit limits is therefore important.

31 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 4.6.6 The criteria for credit limit assignment or increase should be analysed and documented before implementation. 4.7 Personal loans granted using available credit card limit 4.7.1 Some card-issuing AIs provide loans to credit cardholders using their available credit limits. These loans, commonly referred to as “loan-on-card”, usually have a fixed term and a specified repayment schedule. The loan proceeds are disbursed to cardholders’ bank accounts, and thus are not directly related to spending under credit cards. As loan-on-card bear a lot of resemblance to conventional personal loans, AIs should follow the requirements and guidance in relation to risk management of personal lending issued by the HKMA from time to time (e.g. circular letter on “Risk Management of Personal Lending Business” of 14 January 2014) when conducting loan-on￾card business. 4.6.74.7.2 Similar to other unsecured personal loans, AIs should establish binding limits on debt-servicing ratio (“DSR”) for loan-on-card and consider the cardholder’s DSR when assessing a loan-on-card application. Where a loan-on￾card to be granted to a cardholder involves an increase in his or her existing credit card limit, AIs should undertake a fresh credit assessment of the cardholder’s repayment ability36. To this end, AIs should obtain an up-to-date income proof from the cardholder unless they have access to other information which enable them to complete the credit assessment. Such information may include payroll account information, net assets information or estimation of a cardholder’s income generated by statistical models37 . 4.74.8 Card issuing controls 4.7.14.8.1 AIs should have adequate controls in place over the embossing, safe-keeping and distribution of credit cards to cardholders. 36 For the avoidance of doubt, in cases where a loan-on-card application does not involve an increase in credit card limit, the loan-on-card should still be subject to binding DSR limit(s). 37 This is subject to the condition that the income estimation models concerned have been subject to a rigorous assessment and are considered to be sound and robust.

32 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 4.7.24.8.2 AIs should set up an independent unit responsible for card embossing. Cards should only be embossed upon receipt of a proper authorization. AIs should also establish security controls (e.g. dual access control) over the embossing area and maintain a register of issued, returned, spoiled and unused blank cards. Surprise audits should be performed in order to detect any unauthorized use of blank cards. 4.7.34.8.3 AIs should issue cards and PINs separately and take reasonable steps to satisfy themselves that these have been received by cardholders, whether they are personally collected by cardholders or delivered by mail or courier. 4.8 Approval of new merchants 4.8.1 Merchant acquiring AIs should establish a set of prudent underwriting criteria and procedures for approving new merchants which accept payments for the purchase of their goods and services by credit cards. As a minimum, the criteria for assessing the creditworthiness and reputation of new merchants should cover the followingareas: • nature of business; • years in business; • size of operations (e.g. number of retail branches and employees); • financial strength and reputation (particularly for high risk merchants); • previous and projected sales volume; • daily statements from previous merchant acquirers, if any; and • existing business relationship with the AI concerned. 4.8.2 AIs should also establish criteria for identifying merchants that carry higher risk. Such merchants may include those involved in the provision of goods or services where orders are accepted without the cardholder being physically present, or where full or partial payment is accepted for goods and services delivered at some future dates (e.g. mail or telephone order operators, direct selling distributors or e￾commerce merchants). Due to the special features of these

33 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation merchants (e.g. they do not have physical retail outlets and most of their transactions are prepayment in nature), they should be subject to more stringent underwriting criteria. 4.8.3 Based on the above criteria, AIs should conduct a thorough assessment of the prospective merchants. This includes negative vetting with the credit card associations such as Visa and MasterCard. On-site inspection of the business premises of retail merchants (or browsing on the websites of e-commerce merchants) can be performed where appropriate to ensure the existence of their place of business. 4.8.4 AIs should only accept merchants whose overall financial position, business integrity and reputation are considered to be satisfactory. For those that fail to meet the selection criteria or whose nature of business is considered as high risk (e.g. e-commerce merchants), AIs may consider taking any one or a combination of the following actions: • requiring them to provide additional collateral such as pledged deposits (e.g. equivalent to approximately one month’ s sales volume) or bank guarantees; • charging them a higher merchant discount rate to cover additional risk incurred; • deferring payments or retention of an agreed proportion of merchant sales turnover for a specified period; or • rejecting their applications. 5. Account and portfolio management 5.1 Cardholder account management 5.1.1 The account management system of card issuing AIs should be able to segment cardholders into different risk types (e.g. high, medium or low). For example, AIs may differentiate cardholders according to their account behaviour (such as credit limit utilisation, frequency of cash advance, payment of minimum balance, timeliness of repayment and delinquency record) or behavioural score (see Annex A). 5.1.2 Decisions such as increase in credit limit and card renewal should be based on a cardholder’s updated credit risk profile and repayment history.

34 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 5.1.3 For high risk cardholders (e.g. those experiencing repayment problems on their cards), there should be an effective mechanism to reduce the maximum credit limit granted in a timely manner, freeze the remaining available credit limit or block the cardholder’ s’ credit card from further transactions, as appropriate. AIs should inform the cardholders of these actions as soon as practicable. 5.1.4 Locally incorporated AIs should have systems in place for measuring aggregate exposures to individual cardholders for the purposes of complying with §§ 81, 83 and 85 of the Banking OrdinanceParts 5, 7 and 8 of the Banking (Exposure Limits) Rules (Cap 155S). 5.1.5 Where AIs offer more than one credit card to a cardholder, they should consider in totality the outstanding amount and performance of all his accounts to ensure that the total credit extended to the cardholder is not beyond his ability to repay. 5.1.6 AIs should also have sufficient management information systems to identify, measure, manage and control the risks associated with over-limit accounts. 5.2 Merchant account management 5.2.1 Merchant acquiring AIs should establish policies and procedures for ongoing monitoring of their merchant accounts. Regular review should be conducted to assess the operational (e.g. sales volume, service quality, chargebacks and fraud cases) and financial (e.g. account performance and profitability) condition of individual merchants. , merchant visits should be conducted to assess the nature of business and sales activity. 5.2.2 AIs should have adequate systems of control in place for monitoring merchant sales volume. Apart from identifying those merchants who may be charged a higher discount rate because of unsatisfactory sales volume, this process can be an effective means to help identifying any unusual or sudden jump in merchants’ sales volume or authorization requests, which may warrant investigations or implementation of preventive measures against any potential losses. 5.2.3 To facilitate the monitoring process, AIs should set a daily

35 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation limit with individual merchants, taking account of their business nature and previous and projected sales volume. If the merchant’ s daily sales volume exceeds the daily limit, AIs may consider withholding funds to the merchant temporarily or conduct further investigation into the reason for the excess. Proper approval should be obtained before releasing the funds withheld. The limit should be reviewed regularly and adjusted to cater for seasonal factors and market conditions. 5.2.4 AIs should have systems in place to monitor trends of merchants’ chargebacks and capacity to repay chargebacks. They should take appropriate measures (e.g. requiring additional collateral and guarantees) where concerns exist with particular merchants. AIs may consider withholding funds to merchants under the following situations: • excessive chargebacks; • suspected fraudulent activity pending internal investigation; and • irregular sales slips sent on a collection basis. 5.2.5 The relationship with merchants with confirmed fraudulent activity should be terminated immediately. 5.2.6 AIs should ensure that merchants have exercised proper card acceptance and authorization procedures to avoid chargebacks and disputes. 5.35.2 Portfolio quality and analysis 5.3.15.2.1 The credit risk management unit should regularly provide sufficient information on the asset quality of the credit card portfolio for management review. This helps management identify the level of risk and initiate prompt corrective actions if necessary. 5.3.25.2.2 The credit risk management unit should regularly review and monitor the quality of the portfolio by segmenting the portfolio (e.g. by marketing programme, demographic distribution, affinity relationships, and vintage38 ) and evaluating both historical and forecasted 38 This refers to an analysis of the account performance of homogeneous loans booked at a similar time using the same credit and pricing criteria.

36 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation trends in profitability, delinquencies and charge-off ratios of each segment. 5.3.35.2.3 Adequate management reports should be made available to the credit risk management unit for portfolio management purposes. Regular performance tracking reports should be generated for review covering the following aspects: • revenue and profitability; • attrition analysis; • credit limit utilisation (including over-limitaccounts); • delinquency analysis; and • loan loss provisions and charge-offs. 5.3.45.2.4 AIs’ stress-testing programme should take into account the impact of adverse scenarios on their credit card portfolios (see IC-5 “Stress-testing” for details). 5.3.55.2.5 The portfolio should be analysed to identify high risk categories of cardholders and the AI’s exposure to them. 5.3.65.2.6 Yardsticks signalling further deterioration of portfolio quality and the need for corrective actions should be established and documented. 5.3.75.2.7 Prompt corrective actions should be considered in dealing with deterioration in the quality of the credit card portfolio. Such actions could include adjusting the approval scores, tightening the policies on initial assignment of credit limit and subsequent review of credit limit, increasing collection capacity, making early reminder calls on overdue accounts and developing restructuring programmes (see subsection 5.5 below). 5.45.3 Fraud control 5.3.1 AIs should closely monitor the evolving fraud techniques related to credit cards with reference to both internal and external information sources. They should enhance or adjust their fraud monitoring systems, fraud detection tools and remediation process whenever there is a need. Reference should be made to guidance issued by the HKMA from time to time, e.g. SPM module TM-E-1 “Risk Management of E-banking”, circular letters on “Major

37 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation Enhancements on Protection of Payment Card Customers” of 20 June 2023 and “Enhancement measures for online payment card transactions” of 10 October 2024. 5.4.15.3.2 Accurate and timely reporting on fraud is critical in controlling fraud losses. AIs should therefore institute appropriate systems andof control to ensure that fraudulent activities are recognised in a timely manner (e.g. through review of fraud monitoring reports capturing online transactions, out-of-pattern purchases or suspicious purchasing patterns39)., and When fraud (or suspected fraud, as appropriate) is identified, the affected accounts are should be appropriately blocked to prevent further transactions being conducted through these accounts. Suspected fraud cases should be investigated and properly documented. 5.4.25.3.3 AIs should maintain a dedicated fraud management unit for the above purposes, and to take necessary actions whenever they become aware, or are notified by cardholders, of fraudulent or potentially fraudulent activity (e.g. for lost and stolen cards). Such actions include: • preparing fraud reports, and analysing the trend and pattern of fraudulent activities; • notifying relevant cardholders (where appropriate) of suspected fraud and blocking the relevant accounts from further transactions; and • investigating fraud accounts, preparing fraud notifications to credit card associations and reporting fraud cases to relevant authorities for investigation and prosecution. 5.4.35.3.4 For guidance on In the treatment of unauthorised transactions reported by cardholders and in determining their the AI’s liability for loss arising from such transactions, the AIs should have regard to the relevant provisions set out in Clauses 28.3, 30.3 and 30.4 of the Code and guidance issued by the HKMA from time to time 39 Out-of-pattern-purchase reports identify suspicious transactions that do not fit an individual cardholder’s established purchasing pattern whereas suspicious-purchasing-pattern transaction reports identify certain types of purchases, such as electronics, or jewellery or stored value cards, that may correlate with fraudulent activity.

38 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation (e.g. circular letter on Principles for Handling of Unauthorised Payment Card Transactions of 25 April 2023). 5.4.45.3.5 AIs should notify the HKMA if they are aware of any incidents of credit card misuse or fraud affecting a substantial number of customers or involving significant sums of money. 5.4.55.3.6 AIs should review their number and amount of average fraud losses arising from fraud cases to determine if staff can identify fraudulent activities in a timely mannerfor determining any need to improve the controls against fraud. Relevant employees should receive proper training on fraud control and the handling of fraud cases relating to credit cards. 5.4.65.3.7 AIs are expected to institute The risk of credit card misuse may also be reduced by establishing adequate internal controls and operating procedures to reduce the risk of credit card misuse in the credit card department, includingsuch as: • controls over authorization of credit card transactions, which could serve as a first line of defence against fraud; • measures to prevent application fraud (e.g. through thorough checks on applicants, including name and address verification, and restricted access to and controls over alteration of customer information); • procedures for issuing cards to prevent employees or others from intercepting them before delivery to the cardholders; • procedures to prevent merchants from obtaining control of cards; • procedures for handling returned cards, statements, PINs and lost and stolen cards to prevent them from fraudulent use; and • controls over cardholder payments and account balances, and chargeback administration. 5.4.7 AIs should closely monitor the card acceptance patterns and activities of merchants that they have signed up (in

39 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation particular those categorised as high risk), including the conduct of on-site inspections where necessary. They should watch out for irregularities, which may include: • excessive number of disputed orsplit charges; • unusual and significant fluctuations in salesvolume; • frequent excesses over daily limits on sales volume; • repeated authorization of transactions incurred by the same card at one time;or • a history of accepting transactions from credit cards which were later found to be stolen, lost or forged. 5.4.8 AIs should conduct investigations and take other appropriate measures to deal with merchants suspected of fraudulent or irregular activities (see also paras. 5.2.4 and 5.2.5 above). 5.55.4 Delinquency management 5.5.15.4.1 An independent collection unit should be set up for managing delinquent accounts and collection actions. 5.5.25.4.2 There AIs should be have written policies on the management of delinquent accounts covering the classification of problem accounts, provisioning and charge-off (see section 6 below), controls on rescheduled accounts and collection actions. 5.5.35.4.3 There should be reports to support management of delinquent accounts. Regular tracking reports on the effectiveness of collection actions (e.g. on the recovery rate) should be reviewed by the collection unit. 5.5.45.4.4 The actual delinquency and charge-off ratios for different target customer segments within the credit card portfolio and for the portfolio as a whole should be regularly monitored and compared against the projected ratios. Any significant deviations from the projected trends and performance should be analysed and explained. 5.5.55.4.5 Guidelines and procedures should be established for the appointment of external debt collection agencies for debt recovery. Adequate controls should be in place to ensure that the management of such agencies is in line with the provisions of the Code.

40 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 5.5.65.4.6 If AIs become aware of Aany suspicious cases of fraudulent bankruptcies (e.g., customers have obtained or attempted to obtain credit after filing bankruptcy petitions) they should be reported them to the relevant authorities for investigation. These include cases where customers have obtained or attempted to obtain credit after filing of petitions for bankruptcy. 5.5.75.4.7 AIs should review the need for increased resources to cope with any rising trend of bankruptcies of debtors in the credit card portfolios. They should also consider means to deal with potential bankruptcies (e.g. initiation of debt relief plans and debt counselling). In predicting bankruptcies, AIs should regularly evaluate the effectiveness of their scoring systems and other forms of credit analysis. 5.65.5 Restructuring and debt reliefplans 5.6.15.5.1 It is generally in an AI’s best interests to consider restructuring the repayment terms or work out a debt relief plan with cardholders who are unable to repay their outstanding debts in accordance with the original terms but who show the willingness and ability to repay if the terms are modified, rather than putting them into bankruptcy hastily. In fact, some of these cardholders can be nursed back to health and may still be able to repay their debts if some concessions are granted (e.g. forgiving a portion of the amount owed or lowering the original interest rate). For guidance on the management of problem credits, see CR-G-10 “Problem Credit Management” and the “Hong Kong Approach to Consumer Debt Difficulties” as set out under section 8 of IC-6 “The Sharing and Use of Consumer Credit Data through Credit Reference Agencies” jointly issued by the Hong Kong Association of Banks, the DTC Association, the Finance House Association and the HKSAR Licensed Money Lenders Association. In particular, when AIs are aware that a customer has incurred a level of indebtedness that may be unmanageable and the customer might have genuine difficulty in repaying the debt, AIs should consider such cases sympathetically and discuss with the customer concerned to work out a solution that is mutually beneficial for both the customer

41 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation and the AI concerned. In doing so, the customer should be made aware of the possibility of solving the problem by an Interbank Debt Relief Plan (IDRP). All card issuing AIs are expected to join the framework of IDRPs under the “Hong Kong Approach to Consumer Debt Difficulties”. 5.6.25.5.2 In designing a restructuring or debt relief plan, AIs should aim at helping the cardholders to extinguish their outstanding debts. Such plans should, therefore, be designed to maximise recovery of principal, rather than maximising income recognition or deferring losses. For example, lowering the minimum payment requirement may not be useful in helping the cardholders to repay their debts if normal fees and finance charges are continued to be levied on the outstanding balance. 5.6.35.5.3 The repayment period of debt relief plans should generally be within 60120 months. Any exception to this time frame should be well justified and properly documented. 5.6.45.5.4 AIs should state clearly in their accounting policies whether credit card accounts under a restructuring or debt relief plan will continue to be regarded as credit card receivables or will be reclassified as other types of personal lending. 6. Provisioning and charge-off 6.1 General 6.1.1 This subsection highlights the HKMA’s expectation and market practices of the loan classification, provisioning and charge-off practices commonly adopted by AIs for their credit card portfolios. The HKMA does not intend to prescribe a standardised approach for these practices, as this may not suit the circumstances of every AI. 6.1.2 It is envisaged that the adoption of new Hong Kong Accounting Standards (“HKAS”) in 2005 and the implementation of the revised capital adequacy standards in 2007 will bring about further changes in the way AIs grade the credit quality of their retail assets and estimate the potential losses on these assets. The HKMA will monitor such industry developments and consider providing more specific guidance on these issues as and when necessary.

42 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 6.2 Overdue period 6.2.1 Credit card receivables are generally monitored collectively on a portfolio basis and classified according to the length of the overdue period. 6.2.2 The practice of determining the overdue period for credit card receivables varies among AIs. The overdue period may be computed starting from: • the first statement date; • payment due date shown in the first statement; or • the second statement date. However it is measured, it should be applied consistently and stated explicitly in an AI’s policy. 6.2.3 In determining whether an account is overdue, some AIs may allow a grace period for delayed payments due to technical factors such as postal delay or simple customer oversight. The grace period normally ranges from one day to a few days and if the minimum payment is settled within the grace period, the account will not be regarded as overdue. 6.3 Loan classification and provisioning 6.3.1 Every AI should ensure that its loan classification and provisioning policies can truly reflect the asset quality of its credit card portfolio and provide adequate provisions to absorb potential losses that may arise from the portfolio, taking into account prevailing accounting standards. 6.3.2 As the quality of a credit card portfolio may be best indicated by the repayment performance of individual cardholders, the HKMA considers it acceptable for AIs to use the overdue period 40 as a predominant factor in classifying their credit card receivables. The following are some commonly adopted criteria for classifying such assets: 40 A common practice among AIs is to compute the overdue period using the payment due date shown in the first statement. AIs applying a different basis in the computation of the overdue period should take this into account in adopting the classification criteria set out in para. 6.3.2 above.

43 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation • Special mention - accounts overdue for more than 30 days to 90 days; • Substandard - accounts overdue for more than 90 days to 120 days; • Doubtful - accounts overdue for more than 120 days to 180 days; and • Loss - accounts overdue for more than 180 days. 6.3.3 The measurement of loan loss provisions should build upon robust methodologies and result in the appropriate and timely recognition of expected credit losses in accordance with the applicable financial reporting standards and accounting principles, and subject to the reporting and regulatory requirements (e.g. on provisioning) of the HKMA. AIs are expected to consider the linkages of macroeconomic factors and borrower attributes to the level of credit risk in the credit card portfolio based on reasonable and supportable information. Experienced credit judgment should be applied in the incorporation of current and forecasted conditions likely to affect the relevant credit risk drivers and therefore loss expectations.Following the adoption of HKAS 39, the existing approach of maintaining specific and general provisions has been replaced by that for specific and collective provisions41 . As a result, AIs will need to ensure that the approach they use for arriving at these provisions for credit card receivables meets the accounting requirements. 6.3.4 AIs are encouraged to develop appropriate models (e.g. historical experience-based loss rate models adjusted to reflect current conditions, migration analysis or various other statistical methodologies) to estimate the amount of expected credit losses for the credit card portfolios, which 41 For the purpose of this module, (i) “specific provisions” means an allowance for impairment loss of financial assets that are individually assessed for impairment in accordance with HKAS 39, and provisions made in accordance with HKAS 37; and (ii) “collective provisions” means an allowance for impairment loss of financial assets that are collectively assessed for impairment in accordance with HKAS 39, and provisions made in accordance with HKAS 37. In addition, AIs may, in some circumstances, be required to hold a regulatory reserve for general banking risk.

44 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation may serve the purpose of a collective impairment assessment. Such models should be adjusted as necessary to take into account the requirements in accordance with the requirements of applicable financial reporting standards and accounting principles (e.g. incorporation of forward-looking information). 6.3.5 One of the models commonly used by international banks is the roll-rate (or net flow rate) methodology which analyses the migration of accounts from one billing cycle to the next. Roll-rate is the percentage of balances, or accounts, that move from one delinquency stage to the next. In terms of the credit card portfolio, this model is based on historical loss experience, and projects the future contractual losses (net of recoveries) that are embedded within the portfolio by taking the roll-rate for each time band, including that for “non-delinquent” accounts, and multiplying it by the net contractual loss for that time band. 6.3.6 The roll-rate model can be adjusted to: • reflect the effects of current economic conditions that did not affect the period on which the historical loss experience is based and other factors such as the effectiveness of loan collection activities, recovery and write-offs; and • remove the effects of conditions in the historical period that do not existcurrently. Subject to availability, a minimum of three years (preferably five years or more) of data should be used for the measurement of historical loss rates. Factors affecting economic conditions can be, for example, GDP, interest rate, unemployment rate and bankruptcy legislation. 6.3.7 Based on collection experience, when a portfolio’ s history reflects high losses and low recoveries, more conservative standards are appropriate and necessary. For example, AIs should fully recognise incremental losses that may be inherent in over-limit portfolio segments and restructuring plans (in particular those with little progress in reducing the principal owed). 6.4 Charge-off 6.4.1 AIs should set out clearly in their policies and procedures

45 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation the criteria (i.e. the charge-off triggers used, such as bankruptcy or the overdue period) and the method (manual or automatic) for making charge-offs. An automatic charge-off mechanism can reduce manual intervention. 6.4.2 As reflected from industry practices, most AIs perform their charge-off exercise on a monthly basis and charge off their credit card accounts when: • the accounts have been overdue for more than 180 days42; • a bankruptcy petition is filed against the cardholder or a bankruptcy order isissued; • a portion of debt was forgiven in a settlement arrangement43; or • a loss due to fraud or other reasons is discovered and determined. AIs may be required to provide justifications if their practices are less prudent than the above. 6.4.3 AIs should keep memorandum records of charged-off accounts for the amounts still formally owed by cardholders. 7. Merchant acquiring business management 7.1 Approval of new merchants 7.1.1 Merchant acquiring AIs should establish a set of prudent underwriting criteria and procedures for approving new merchants which accept payments for the purchase of their goods and services by credit cards. As a minimum, the criteria for assessing the creditworthiness and reputation of new merchants should cover the following: • nature of business; • years in business; 42 It is noted that some AIs adopt more stringent criteria by setting the charge-off trigger at 150 days or even 120 days overdue. 43 Borrowers with financial difficulties may negotiate settlement agreements with AIs. In a settlement arrangement, the AI forgives a portion of the debt in exchange for the borrower’ s promise to repay the remaining balance either in a lump-sum payment or by amortising the balance over several months.

46 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation • size of operations (e.g. number of retail branches and employees); • financial strength and reputation (particularly for high risk merchants); • previous and projected sales volume; • daily statements from previous merchant acquirers, if any; and • existing business relationship with the AI concerned. 7.1.2 AIs should also establish criteria for identifying merchants that carry higher risk. Such merchants may include those involved in the provision of goods or services where orders are accepted without the cardholders being physically present, or where full or partial payment is accepted for goods and services delivered at some future dates (e.g. mail or telephone order operators, direct selling distributors or e￾commerce merchants). Due to the special features of these merchants (e.g. they do not have physical retail outlets and most of their transactions are prepayment in nature), they should be subject to more stringent underwriting criteria. 7.1.3 Based on the above criteria, AIs should conduct a thorough assessment of the prospective merchants. This includes negative vetting with the credit card associations. On-site inspection of the business premises of retail merchants (or browsing on the websites of e-commerce merchants) should be performed where appropriate to ensure the existence of their place of business. 7.1.4 AIs should only accept merchants whose overall financial position, business integrity and reputation are satisfactory. For those that fail to meet the selection criteria or whose nature of business is high risk (e.g. e-commerce merchants), AIs may consider taking any one or a combination of the following actions: • requiring them to provide additional collateral such as pledged deposits (e.g. equivalent to approximately one month’ s sales volume) or bank guarantees; • charging them a higher merchant discount rate to cover additional risk incurred; • deferring payments or retention of an agreed proportion of merchant sales turnover for a specified

47 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation period; and • rejecting their applications. 7.2 Merchant account management 7.2.1 Merchant acquiring AIs should establish policies and procedures for ongoing monitoring of their merchant accounts. Regular review should be conducted to assess the operational (e.g. sales volume, service quality, chargebacks and fraud cases) and financial (e.g. account performance and profitability) condition of individual merchants. 7.2.2 AIs should have adequate systems of control in place for monitoring merchant sales volume. Apart from identifying those merchants who may be charged a higher discount rate because of unsatisfactory sales volume, this process can be an effective means to help identifying any unusual or sudden jump in merchants’ sales volume or authorization requests, which may warrant investigations (including merchant visits) or implementation of preventive measures against any potential losses. 7.2.3 To facilitate the monitoring process, AIs should set a daily limit with individual merchants, taking account of their business nature and previous and projected sales volume. If the merchant’ s daily sales volume exceeds the daily limit, AIs may consider withholding funds to the merchant temporarily or conduct further investigation into the reason for the excess. Proper approval should be obtained before releasing the funds withheld. The limit should be reviewed regularly and adjusted to cater for seasonal factors and market conditions. 7.2.4 AIs should ensure that merchants have exercised proper card acceptance and authorization procedures to avoid chargebacks and disputes. AIs should closely monitor the card acceptance patterns and activities of merchants that they have signed up (in particular those categorised as high risk), including through the conduct of on-site inspections where necessary. They should watch out for irregularities, which may include: • excessive number of disputed orsplit charges;

48 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation • unusual and significant fluctuations in salesvolume; • frequent excesses over daily limits on sales volume; • repeated authorization of transactions incurred by the same card at one time;or • a history of accepting transactions from credit cards which were later found to be stolen, lost or forged. 7.2.5 AIs should conduct investigations and take other appropriate measures to deal with merchants suspected of fraudulent or irregular activities (see also paras. 7.2.6, 7.2.8 and 7.2.10). 7.2.6 AIs should have systems in place to monitor trends of merchants’ chargebacks and capacity to repay chargebacks. 7.2.7 Moreover, AIs should institute procedures to prevent merchants from obtaining control of cards. 7.2.8 AIs should take appropriate measures (e.g. requiring additional collateral and guarantees) where concerns exist with particular merchants. AIs may consider withholding funds to merchants under the following situations: • excessive chargebacks; • suspected fraudulent activity pending internal investigation; and • irregular sales slips sent on a collection basis. 7.2.9 If merchant acquiring AIs decide to set withholding arrangements and deposit requirements with merchants, the AIs should consider the reasonableness of the arrangements in accordance with sound credit risk management policies and practices, in particular in respect of those merchants which are small and medium sized enterprises. 7.2.10 The relationship with merchants with confirmed fraudulent activity should be terminated immediately. In the event of suspension or closure of business of merchants, AIs should suspend or cease collecting card payments for the merchants, particularly those involving prepayment for goods/services, as soon as practicable to help contain further card payment from customers for the purpose of customer protection.

49 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation 7.2.11 AIs are encouraged to promote the use of mobile Point￾of-Sale (POS) terminals or other similar devices which allows cardholders to effect payment securely by tapping/swiping their cards in person by their merchants. Reference should be made to the guidance issued by the HKMA from time to time, e.g. circular letter “Promotion of Mobile Point-of-Sale (POS) Terminals” of 15 November 2024. Contents Glossary Home Introduction

50 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation Annex A: Scoring systems A1. Types of scoring systems A1.1 Scoring systems and scorecards are tools used to predict the credit behaviour and repayment risk of individual customers based on application data and data obtained from the a credit reference agency through credit checking. They evaluate the credit quality of a borrower by assigning statistically developed scores to defined credit attributes. A1.2 There are generally two types of scorecards: credit scorecards and behavioural scorecards. Credit scorecards are used in new account applications to assess the creditworthiness of applicants. Behavioural scorecards assess the quality of a customer through studying his account performance and credit behaviour such as cash advance, repayment performance, expenditure pattern and credit limit utilisation over time. Behavioural scorecards are usually applied in the review process, individual account management, collection or fraud detection. A2. Development of scoring systems A2.1 A successful scoring system provides a standardised way of measuring the inherent risk of a borrower. An important measure of a scoring system is its definition of risk and the care with which explanatory variables are defined, data are collected, and the system is tested. The standardised risk measurement should be based on historical data, measure the risk of default or loss and produce consistent results across time for a wide range of borrowers. Further investigation should be made on borrowers who do not meet the scoring criteria. A2.2 There should be a proper management approval process for the rollout of new scorecards. Such a process should include selection of data samples, testing of the model and approval hierarchy for the rollout. A2.3 Scorecards should be developed by the credit risk management unit and, if necessary, in conjunction with an external vendor with relevant expertise in statistical modelling. External vendors usually build scorecards based upon specific information and parameters provided by an AI’ s management44 . 44 Data used to develop the scorecard can come from three main sources:

51 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation A2.4 To achieve better predictability of a scoring model, the development sample should preferably be selected from an AI’s database containing customers who applied for credit within a reasonably recent period of time, say, two years. A2.5 Scorecards should be validated by appropriate testing on bad rate (i.e. the percentage of approved accounts that became delinquent), and user acceptance before formal implementation. A2.6 For application scoring models, the cut-off score should reflect the underwriting standards and risk appetite of AIs. There should be proper controls on who may decide and approve the level of the cut-off score, and the circumstances under which the cut-off score may be revised. Reasons and justifications for setting or changing the cut-off scores should be properly documented. A3. Monitoring of scorecard performance A3.1 The credit risk management unit should regularly monitor the performance of the scorecards by reviewing management reports covering: • population stability - a report comparing the current application population and the population on which the scoring system was developed and measuring whether there are any material changes in the score distribution over time; • characteristic analysis - an analysis measuring changes in applicants’ scores on individual credit attributes over time. This process is to help identify whether there is any shift in the population (which may in turn manifest itself in a change in the population stability index). The overall predictive power of the score in distinguishing good credits from bad credits should also be reviewed; • approval and rejection rates; • high and low side override rates45; and • delinquency vintage analysis - an analysis of the distribution of • an AI’ s previous good accounts, bad accounts and rejected applications; • pooled or purchased data whose features closely resemble applicants which the AI targets; and • expert intelligence (i.e. the logic and evaluation processes used by successful credit officers). 45 An override is a decision to accept or reject an applicant when the scoring system says otherwise. A high side override means that an AI rejects an application which the scoring system would approve while a low side override means that an AI approves an application which the scoring system would reject.

52 Supervisory Policy Manual CR-S-5 Credit Card Business V.21 – 05.01.06 Consultation delinquency ageing by the time of account inception. A3.2 Validation of scorecards should be done regularly as needed to keep them statistically sound. The predictive ability of the scorecards should also be periodically evaluated by using statistical principles and methodologies. A3.3 Proper controls for initiating the redevelopment of scorecards should be established specifying the criteria for initiating the redevelopment, and who may initiate and approve the redevelopment.