Engaging more than one Credit Reference Agency under Credit Data Smart

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref: B1/21C B4/1C B9/32C B9/60C 19 December 2024 The Chief Executive All Authorized Institutions Dear Sir/Madam, Engaging more than one Credit Reference Agency under Credit Data Smart In order to strengthen operational resilience and ensure continuity of credit business operations of banks, I am writing to set out the requirements for retail banks (including digital banks) to engage more than one credit reference agency (CRA) under Credit Data Smart (CDS) (namely the “operational resilience requirement”) following consultation with the industry. Given the critical importance of consumer credit as a banking service to the community, and the minimum standards in relation to the sharing and use of consumer credit data through CRAs as set out in the Supervisory Policy Manual (SPM) module entitled “The Sharing and Use of Consumer Credit Data through Credit Reference Agencies” (IC-6), including the use of credit referencing data and services provided by CRAs under CDS to carry out effective assessment and management of the credit risk involved, the HKMA expects all retail banks (including digital banks) to implement the operational resilience requirement, such that these banks will be able to switch over swiftly and seamlessly from one CRA to another in the event of disruption in the services of one CRA. Details of the requirement are set out in the following paragraphs. Scope of services covered The scope of services under the operational resilience requirement should be in line with the relevant requirements in SPM IC-6, and in particular, should cover such

• 2 - consumer credit referencing services that are relevant for the sharing and use of consumer credit data through CRAs by banks to manage their credit risk effectively. Such services should include, among others, provision of credit reports, facilitation of correction of consumer credit data, and other services that facilitate effective credit risk management by banks as set out in the relevant requirements in SPM IC-6. Triggers and time to recovery Banks should assess and determine when to trigger the switch-over under the operational resilience requirement. Factors to consider should include, amongst others, business needs and models of banks (e.g. timing and channels of loan approval and related business volume), and nature of disruption of services of the CRA (e.g. whether difference is to be drawn between scheduled maintenance and unexpected discontinuation of services of the CRA for a period of time). In any case, in the event of service disruption of one CRA, banks are expected to complete the switch-over to another CRA and to resume business at normal level within 24 hours upon receipt of a CRA’s notice of service disruption or other similar situations. For resumption of business at normal level, banks are not only expected to have a contract and a readily available connection with another CRA to receive credit reports or obtain services from another CRA, but are also expected to resume their entire chain of business processes with no degradation services to the individual customers and at the same time no degradation in risk management and control (for example, banks should be able to use the credit reports from another CRA based on a different score scale in their loan approval processes). Banks should conduct drills at least once every 12 months from the technical, operational and risk management standpoint to demonstrate that they have the capability to migrate swiftly and seamlessly from one CRA to another CRA when needed. In particular, banks should establish and adhere to a regular practice of validating data from more than one CRA to ensure that they are ready for swift and seamless migration from one CRA to another when needed. Implementing this practice will not only enhance data reliability, but also fortify the overall operational resilience and continuity of credit business operations of banks. Banks should have clear policy and procedures setting out the above, as well as effective controls and monitoring functions in place to ensure that they are capable of conducting the switch-over. Such policy and procedures should be subject to review of the banks’ management.

• 3 - Implementation With the parallel run exit taken place on 24 November 2024, and the importance for banks to maintain access to credit referencing services to provide consumer credit services and effectively manage their consumer credit risk, the HKMA expects all retail banks (including digital banks) to have entered into an agreement with more than one CRA by January 2025. To ensure that the operational resilience requirement is sound and operational, the HKMA expects these banks to complete the necessary testing with more than one CRA by the end of the second quarter of 2025. The full implementation of the operational resilience requirement is expected to take effect as early as practicable after the banks’ completion of the necessary testing with more than one CRA, no later than the end of the third quarter of 2025. If any banks need more time, they should approach the HKMA with very strong justifications which will be considered on a case-by-case basis. While the above requirements apply to all retail banks (including digital banks), all Authorized Institutions (AIs) and subsidiaries of AIs acting as credit providers in CDS are also encouraged to implement the operational resilience requirement based on their own business and operational needs. If there is any question on this circular, please contact Mr Gary Wong on 2878- 1416 or Ms Katrina Ng on 2878-1338. Yours faithfully, Alan Au Executive Director (Banking Conduct) Encl. cc: The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association Secretary for Financial Services and the Treasury (Attn: Mr Kelvin Lo)