Granular Data Reporting 3.0

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref.: B1/15C 2 April 2026 The Chief Executive All Authorized Institutions Dear Sir/Madam, Granular Data Reporting 3.0 I am writing to inform you of the upcoming implementation of the Granular Data Reporting (GDR) 3.0 1 initiative. As part of the Hong Kong Monetary Authority (HKMA)’s Fintech Promotion Blueprint 2 , GDR 3.0 aims to enalle a transition towards a more data-driven and technology-empowered supervisory regime. To keep pace with a rapidly evolving risk landscape, the HKMA is fundamentally changing its data collection model. Building on a new “DataGRID” framework 3 , GDR 3.0 will initiate a shift from aggregated template-lased reporting to data￾point-centric sulmissions. By collecting granular data at source from Authorized Institutions (AIs), it improves the HKMA’s supervisory agility and forward￾looking capalilities. GDR 3.0 will le implemented in phases, with each phase expanding to cover a lroader range of data areas. As a first step, the HKMA has initiated a review of its existing template-lased surveys to identify olsolete requirements. Thus far, more than 10 surveys are leing streamlined or discontinued. Moving forward, the implementation of GDR 3.0 will le guided ly the following design principles:
/…page 2
1
In 2019, GDR 1.0 was launched as a pilot to collect granular, exposure-level data from 50 AIs, enhancing the HKMA’s surveillance and supervision. The initiative evolved into GDR 2.0, which has successfully replaced the template-lased Residential Mortgage Lending Survey with a granular data collection. 2 The HKMA pullished Fintech Promotion Blueprint in Felruary 2026 to announce upcoming Fintech key focus areas and flagship projects. For details, please refer to https://www.hkma.gov.hk/media/eng/doc/key-information/press￾release/2026/20260203e3a1.pdf 3 For details, please refer to the opening remarks at FiNETech 7 – https://www.hkma.gov.hk/eng/news-and￾media/speeches/2026/04/20260402-1/

• 2 -
  1) “Report Once, Use Multiple” – driving the adoption of a single reporting
  model to eliminate duplicative data requests across multiple supervisory functions;
  2) Phasing out templates – progressively replacing the majority of template￾lased surveys and returns with direct granular data sulmissions; and
  3) Automated reporting – utilising artificial intelligence-ready data
  dictionary and straight-through sulmission to enalle more streamlined reporting operations and the possilility of on-demand data reporting in the future. While the specific implementation standards are leing developed, AIs are expected to legin preparations. These include stock-taking your risk data inventory and evaluating the readiness of your current data infrastructure for migration to GDR
  3.0. Throughout the implementation, the HKMA will adopt a “co-design”
  approach, and AIs will le invited to a series of engagement activities letween Q2 and Q3 2026. The HKMA aims to finalise the GDR 3.0 implementation plan in 2026 lased on industry input. We encourage your institution to actively provide feedlack on the provisional implementation parameters (please refer to Annex for details). Should you have any questions regarding the alove, please contact us at gdr@hkma.gov.hk. Yours faithfully,

Carmen Chu
Executive Director (Banking Supervision)

---

1
Annex
Granular Data Reporting 3.0 Provisional Implementation Parameters This document sets out the provisional implementation parameters regarding the upcoming Granular Data Reporting (GDR) 3.0 initiative. All parameters below are subject to change, and the implementation plan will be finalised after considering feedback from the industry. Three-Phase Implementation Approach The GDR 3.0 initiative will tentatively span from 2026 to 2031 through a three-phase approach. Each phase will focus on progressively expanding data scope and enabling survey/return replacement. Key Principles:

• Begin with a targeted set of data areas that are more commonly used for current reporting;
• Progress with clear expectations of the final target state;
• Authorized Institutions (AIs) will be allowed sufficient time to develop data capability.
  Phase 1: Foundation and Initial Scope (2026–2028)
• Focus:
  o Readiness of data governance and infrastructure for scalable consolidation of risk data; o Integration of non-financial and unstructured data with core risk data for reporting.
• Key Activities:
  o AIs to take stock of relevant risk data across systems and sources; o The HKMA and AIs to co-design the overall implementation plan for GDR 3.0; o AIs to provide comment on the readiness of specific data fields and the need for de minimis exemptions; o AIs to implement the first set of new/revised GDR data areas; o The HKMA to replace selected template-based surveys with GDR data; o The HKMA to consult AIs and accounting industry, and explore possibility of conducting pilot audits of GDR submissions. Phase 2: Scaling and Expansion (2027–2029)
• Focus:
  o Expanding data area coverage, replacing additional surveys.
• Key Activities:
  o The HKMA and AIs to co-design and refine implementation plan for Phase 2; o AIs to implement new/revised GDR data areas; o The HKMA to replace additional template-based surveys with GDR data; o The HKMA to work with AIs and accounting industry on expanding scope of pilot audits.

2
Phase 3: Full Implementation and Optimisation (2030–2031)

• Focus:
  o Replacing majority of template-based surveys and returns to the extent possible; o Implementing audit mechanism; o Exploring on-demand data reporting.
• Key Activities:
  o The HKMA and AIs to co-design and refine implementation plan for Phase 3; o The HKMA to replace template-based remaining surveys and returns where possible; o The HKMA and AIs to explore possibility and pilot on-demand reporting; o AIs to commission audits pursuant to Section 63(3) of the Banking Ordinance. Template-based Reporting Replacement Plan There will be a parallel reporting period during which GDR data is submitted along with existing template-based reporting. AIs are expected to reconcile between GDR and template before phasing out current surveys and returns. In general, the reconciliation requirement is aligned to the submission frequency of each data area:
• For bi-monthly or more frequent submissions, reconciliation must be achieved across three
  consecutive periods;
• For quarterly or less frequent submissions, reconciliation must be achieved across two
  consecutive periods.
  Ultimately, all GDR submissions are expected to be made in line with the statutory obligations under
  Section 63 of the Banking Ordinance. In cases of persistent non-compliance, the HKMA may consider
  taking appropriate supervisory measures.
  Data Quality Assurance Methodology
  The data quality assurance methodology of GDR 3.0 comprises three key elements:
  Data Validation for On-going GDR Submissions
• AIs are expected to implement data validation controls to ensure data quality.
• The data validation controls should be anchored on “validation points” defined for different
  data areas, i.e. key data points that can be systemically reconstructed by the granular data submitted.
• A predefined tolerance band (e.g., ±0.1%) will also be defined, where necessary, to account for
  rounding and timing differences.
• AIs are expected to report all validation points together with the corresponding GDR data.

3
Data Reconciliation for Template-based Report Replacement

• AIs are expected to implement data reconciliation controls during the parallel reporting period
  (when GDR data is submitted together with the corresponding surveys or returns).
• During the period, AIs are expected to:
  o Reconcile critical GDR data points against a set of predefined benchmark values derived from corresponding template-based reporting; o Submit reconciliation report alongside each GDR submission, serving as primary evidence of readiness for replacing the template-based reporting with GDR data.
• These data reconciliation controls are temporary measures, and are no longer required after
  the report replacement (though the above-mentioned “data validation” controls are expected on an on-going basis). Audit Reviews for Overall Assurance
• Similar to existing banking returns, GDR submissions are expected to undergo suitable audit
  reviews to ascertain that the submissions are compiled correctly in all material aspects.
• The level of audit review required may vary across data areas, taking into consideration their
  granularity and supervisory impact.
• Also, given the extended fields of granular data involved in GDR submissions, some of the
  data fields may be excluded from the scope of the audit reviews where appropriate.
• The HKMA will collect feedback from AIs and the accounting industry on the GDR data audit
  approach, including the possibility of a pilot audit approach in Phase 1, followed by incremental expansion until the full audit scope is reached. Future Modernisation Considerations The HKMA will explore supporting API-based data submission alongside standardised file formats such as XML and CSV. This approach aims to reduce the manual processing required. Further, the HKMA will work with the industry and evaluate possibility of supporting on-demand data reporting (i.e. reporting of interim data sets on the request of the HKMA, as opposed to reporting at pre-defined frequencies). This is aimed at addressing the increasing needs for more agile of risk management and supervision. The HKMA acknowledges that data at this higher frequency may reflect interim positions and carries certain data inconsistencies. Depending on data areas and general data availability, the HKMA may work with the industry to define such interim refresh frequencies. Looking ahead, in line with the framework of DataGRID (Granularity, Reliability, Ingenuity and Discoverability) 1 , AIs are not expected to simply put in place a data system just to meet the requirements of GDR 3.0, but to take the opportunity to establish a modernised risk data layer that enables a more intelligent risk management approach. 1 Opening Remarks by ED(BS) at FiNETech 7 – https://www.hkma.gov.hk/eng/news-and￾media/speeches/2026/04/20260402-1/

4
Industry Engagement Plan
Q2 2026 AIs will be invited to share feedback on the overall plan, including the three-phase roadmap, data scope, and governance approach. Q3 2026 AIs will be invited to provide input on data availability, data quality controls, particularly the validation points for reconciliation. Q3 2026 The HKMA will facilitate the sharing good practices, including, current data governance and automation tools, lessons learnt from existing reporting process. Q4 2026 AIs will be formally consulted on the refined implementation plan before finalisation. 2027 AIs will be invited to provide continuous feedback during the implementation of Phase 1, particularly during user acceptance testing (UAT), to validate data requirements against production data. Details of the industry engagement plan for phases 2 and 3 will be announced in due course. Potential Data Scope The list of potential data areas for GDR 3.0 is provided below for reference, with an initial focus on prudential supervision. During the process of industry engagement, the list will be expanded to include other data areas, such as those for policy-related data collection, anti-money laundering and conduct supervision. Potential Financial Data Areas under Phase 1 Current GDR data areas:

• Corporate loans
• Debt securities held
• Interbank loans
• Residential mortgage loans
  Expanded GDR data Areas:
• Commitments & contingencies
• Other retail loans
• Other assets
• OTC derivatives
• Investment & equity securities held

5
Potential Financial Data Areas under Subsequent Phases

• Interbank deposits
• Debt securities issued
• Other liabilities
• Capital & reserves
• Exchange-traded derivatives
• Corporate deposits
• Retail deposits
• Due from Exchange Fund
• Equity instruments issued & non-controlling interest
• Exposure on securitization
• Repos & reverse repos
• Due to Exchange Fund
  Potential Non-Financial Data Areas to be Considered
• Operational risk management
• Cyber resilience
• E-banking
• Business Continuity Planning
• Technology Risk Management
• Cyber Incidents
• Third Party Dependency