Cross-boundary Credit Referencing

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref: B4/1C B9/60C B9/218C 10 October 2025 The Chief Executive All Authorized Institutions Dear Sir/Madam, Cross-boundary Credit Referencing I am writing to share the progress made in the pilots of the Cross-boundary Credit Referencing (“CBCR”) initiative, and to outline guiding principles to support the industry in implementing and expanding the use of CBCR. Objectives With the rise in cross-boundary activities and greater financial integration in the Guangdong-Hong Kong-Macau Greater Bay Area (“GBA”), businesses starting and expanding operations across the boundary and individuals starting to work in or relocating to a new place will need to establish relationships with the local banks in the new place for credit and other banking and financial services. However, unavailability of credit history to banks in the new place limits the ability of these banks to carry out due diligence and evaluate the creditworthiness of the businesses and individuals, hindering cross-boundary financial activities. The CBCR initiative aims to facilitate the exchange of credit reference information between Hong Kong and the Mainland, enabling banks to make more informed and accurate assessments of customers’ creditworthiness, as well as benefiting customers by providing easier, faster and lower-cost access to credit. This provides a strong foundation for addressing the growing demand for cross-boundary financing and other financial services.

• 2 - The CBCR initiative consists of the Southbound Scheme and the Northbound Scheme. The Southbound Scheme refers to the transfer of credit reference information of businesses and individuals from the Mainland to banks in Hong Kong, which use this information to complete their internal assessments, and vice versa. This enables Mainland customers, especially those lacking sufficient credit history in Hong Kong, to provide banks in Hong Kong with established and verified credit records from the Mainland, thereby helping banks better serve the financial needs of their customers. Pilot programme and progress To support the development and implementation of the CBCR initiative, the HKMA and the People’s Bank of China (“PBoC”) signed a Memorandum of Understanding (“MoU”) in early 2024. The MoU established cooperative arrangements for pilots of two-way transfers of credit reference information across the boundary via collaboration between credit reference agencies (“CRAs”), and for ongoing development and monitoring of the CBCR initiative. In other words, a local bank requests a local CRA to obtain credit information of the bank’s customer from a CRA located in the other place (“home CRA”), and the local CRA then provides this information to the local bank to facilitate its credit assessment. The pilot programme examined the viability of various collaboration models, the related processes and procedures of different stakeholders in facilitating end-to-end data transmission, and subsequent processing and assessment by banks. The completed pilot cases so far have covered a wide variety of scenarios (including account opening and maintenance, corporate credit facilities, trade financing, mortgage loans, credit card applications, unsecured personal loans and overdrafts) and diverse data types (from traditional credit and repayment records to alternative data such as transaction data and tax filings), and have facilitated over 20 corporate and personal loans amounting to more than HK$260 million so far. The outcome of the pilot programme has confirmed the operational and technical feasibility of the tested workflows, while ensuring that data security and privacy are upheld. Following the successful pilot outcomes, the HKMA and the PBoC have agreed to proceed with the regularisation of the CBCR initiative, which is one of the key measures to promote GBA development outlined in the 2025 Policy Address.

• 3 - Recommended collaboration models Based on the experience gained from the pilot phase, the following two recommended models have been identified: (i) Direct transfer model: with customer consent, credit reference information is transferred directly across the boundary from home CRAs to local CRAs for onward transfer to local banks. In general, this model is suitable for commercial CBCR and is also the predominant model adopted for cross￾border credit data sharing globally based on overseas experiences. (ii) Indirect model enabled by data portability: customers (as the data subjects) exercise their right to data portability by collecting their own credit reference information from home CRAs and transferring it across the boundary to local CRAs for onward transfer to local banks. To impose additional control and safeguard the data integrity at the origin, this model integrates with the Shenzhen-Hong Kong cross-boundary data validation platform (“Data Validation Platform”), which utilises blockchain technology and data coding (i.e. hash values) for document verification without involving any cross-boundary transfer or storage of the original documents. This platform provides a credible means for the CRAs to validate the authenticity of the credit reference information presented by the customers. AIs are reminded to refer to the HKMA’s circular on “Cross￾boundary Data Validation Platform” dated 10 October 2025 for details of the Data Validation Platform. In general, this model is suitable for consumer CBCR involving more sensitive personal information. Guiding principles Taking this opportunity, we would like to remind authorized institutions (“AIs”) of the relevant requirements and expectations in respect of the sharing and using of commercial and consumer credit data through CRAs in Hong Kong and on the Mainland by AIs, as set out in the HKMA’s circulars of 28 June 2024, “Pilots on Cross-boundary Credit Referencing” and “Standard Contract for Cross-boundary Flow of Personal Information involving Transfer of Credit Data through Credit Reference Agencies”. In particular, AIs are reminded to, where relevant and practical, comply with the requirements of the Personal Data (Privacy) Ordinance (Cap. 486), the Code of Practice on Consumer Credit Data promulgated by the Privacy Commissioner for Personal Data, and the Supervisory Policy Manual

• 4 - (“SPM”) modules on “The Sharing and Use of Consumer Credit Data through Credit Reference Agencies” (“IC-6”), as well as “The Sharing and Use of Commercial Credit Data through a Commercial Credit Reference Agency” (“IC￾7”). It is essential for AIs to ensure that cross-boundary data transfers are conducted in a secure and adequately controlled manner, with the necessary and prescribed consent obtained from customers. To assist the industry in effectively implementing and using the CBCR as a risk management tool, and to protect the interests of all the participating parties (including corporate and individual customers), the HKMA considers it important to set out some additional guiding principles. For the avoidance of doubt, our focus in drawing up the following principles are on the Southbound Scheme. (a) Transition from pilot to scalable and market-ready solutions Building on the experience and insights gained from the pilot phase, CRAs are expected to explore how to improve and productise the pilot outcomes, while AIs are expected to continue their collaboration with the CRAs as well as expand the availability of such arrangements to customers on a broader scale. Potential areas for enhancement include, among others, optimisation and automation of the processes, streamlining of customer consent management, and adaptation of models to handle higher volumes. These enhancements can help accelerate the market adoption of the CBCR initiative, enhance customer experience, and contribute to the development of more credible, viable and innovative CBCR solutions. (b) Proactive use of the CBCR in strengthening credit risk management The HKMA considers the use of established and verified credit records obtained from the Mainland for conducting credit assessment of Mainland customers to be an essential component of AIs’ credit management systems, unless satisfactory alternative arrangements are in place. In this regard, AIs should comply with the requirements set out in the relevant credit risk management guidelines or circulars issued by the HKMA from time to time. To this end, AIs are expected to develop and implement policies and procedures to incorporate the CBCR into regular business operations, having regard to their own circumstances and needs. This includes making any necessary changes to their processes and systems, whilst ensuring that operations are safe and sound with appropriate risk management, consumer

• 5 - protection, and compliance measures in place. AIs are expected to make reasonable efforts to encourage customers to use the CBCR. AIs should also provide suitable and sufficient staff training to ensure familiarity with the operational details and aspects of the CBCR (e.g. types of reports and data involved), enabling staff to explain the CBCR to customers, address enquiries and resolve potential issues. (c) Consumer education to build public trust in the CBCR The industry is strongly encouraged to organise educational initiatives to raise customer awareness of the CBCR, e.g. the values and benefits of the CBCR, how their credit reference information will be handled and transferred, and how such information might help improve their access to funding, lower borrowing costs, and expedite loan application processes. AIs are also encouraged to include such educational messages in their customer communication. Going forward The HKMA strongly encourages AIs to actively utilise the CBCR solution to enhance customer due diligence and credit approval processes for customers with cross-boundary needs for financing and other banking and financial services. The HKMA and the relevant Mainland authorities will continue to oversee the implementation of the CBCR from the perspectives of data security and prudent risk management in accordance with the prevailing regulatory framework. The HKMA will also continue to work closely with the industry and other relevant stakeholders to explore necessary enhancements and the potential use of technology, with a view to enriching the cross-boundary credit data ecosystem and enhancing the effectiveness and efficiency of the CBCR. This will in turn support and facilitate cross-boundary financing activities, ultimately serving the real economy and promoting further development of the GBA. Should you have any questions regarding the CBCR initiative set out in this circular in general, please contact us at credit_referencing_data@hkma.gov.hk. For

• 6 - questions related to the Data Validation Platform, please contact the subject team at data_validation_platform@hkma.gov.hk. Yours faithfully, Alan Au Executive Director (Banking Conduct) cc: The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association Secretary for Financial Services and the Treasury (Attn: Mr Timothy Wong)