Granular Data Reporting 3.0 Provisional Implementation Parameters

1 Annex Granular Data Reporting 3.0 Provisional Implementation Parameters This document sets out the provisional implementation parameters regarding the upcoming Granular Data Reporting (GDR) 3.0 initiative. All parameters below are subject to change, and the implementation plan will be finalised after considering feedback from the industry. Three-Phase Implementation Approach The GDR 3.0 initiative will tentatively span from 2026 to 2031 through a three-phase approach. Each phase will focus on progressively expanding data scope and enabling survey/return replacement. Key Principles: • Begin with a targeted set of data areas that are more commonly used for current reporting; • Progress with clear expectations of the final target state; • Authorized Institutions (AIs) will be allowed sufficient time to develop data capability. Phase 1: Foundation and Initial Scope (2026–2028) • Focus: o Readiness of data governance and infrastructure for scalable consolidation of risk data; o Integration of non-financial and unstructured data with core risk data for reporting. • Key Activities: o AIs to take stock of relevant risk data across systems and sources; o The HKMA and AIs to co-design the overall implementation plan for GDR 3.0; o AIs to provide comment on the readiness of specific data fields and the need for de minimis exemptions; o AIs to implement the first set of new/revised GDR data areas; o The HKMA to replace selected template-based surveys with GDR data; o The HKMA to consult AIs and accounting industry, and explore possibility of conducting pilot audits of GDR submissions. Phase 2: Scaling and Expansion (2027–2029) • Focus: o Expanding data area coverage, replacing additional surveys. • Key Activities: o The HKMA and AIs to co-design and refine implementation plan for Phase 2; o AIs to implement new/revised GDR data areas; o The HKMA to replace additional template-based surveys with GDR data; o The HKMA to work with AIs and accounting industry on expanding scope of pilot audits.

2 Phase 3: Full Implementation and Optimisation (2030–2031) • Focus: o Replacing majority of template-based surveys and returns to the extent possible; o Implementing audit mechanism; o Exploring on-demand data reporting. • Key Activities: o The HKMA and AIs to co-design and refine implementation plan for Phase 3; o The HKMA to replace template-based remaining surveys and returns where possible; o The HKMA and AIs to explore possibility and pilot on-demand reporting; o AIs to commission audits pursuant to Section 63(3) of the Banking Ordinance. Template-based Reporting Replacement Plan There will be a parallel reporting period during which GDR data is submitted along with existing template-based reporting. AIs are expected to reconcile between GDR and template before phasing out current surveys and returns. In general, the reconciliation requirement is aligned to the submission frequency of each data area: • For bi-monthly or more frequent submissions, reconciliation must be achieved across three consecutive periods; • For quarterly or less frequent submissions, reconciliation must be achieved across two consecutive periods. Ultimately, all GDR submissions are expected to be made in line with the statutory obligations under Section 63 of the Banking Ordinance. In cases of persistent non-compliance, the HKMA may consider taking appropriate supervisory measures. Data Quality Assurance Methodology The data quality assurance methodology of GDR 3.0 comprises three key elements: Data Validation for On-going GDR Submissions • AIs are expected to implement data validation controls to ensure data quality. • The data validation controls should be anchored on “validation points” defined for different data areas, i.e. key data points that can be systemically reconstructed by the granular data submitted. • A predefined tolerance band (e.g., ±0.1%) will also be defined, where necessary, to account for rounding and timing differences. • AIs are expected to report all validation points together with the corresponding GDR data.

3 Data Reconciliation for Template-based Report Replacement • AIs are expected to implement data reconciliation controls during the parallel reporting period (when GDR data is submitted together with the corresponding surveys or returns). • During the period, AIs are expected to: o Reconcile critical GDR data points against a set of predefined benchmark values derived from corresponding template-based reporting; o Submit reconciliation report alongside each GDR submission, serving as primary evidence of readiness for replacing the template-based reporting with GDR data. • These data reconciliation controls are temporary measures, and are no longer required after the report replacement (though the above-mentioned “data validation” controls are expected on an on-going basis). Audit Reviews for Overall Assurance • Similar to existing banking returns, GDR submissions are expected to undergo suitable audit reviews to ascertain that the submissions are compiled correctly in all material aspects. • The level of audit review required may vary across data areas, taking into consideration their granularity and supervisory impact. • Also, given the extended fields of granular data involved in GDR submissions, some of the data fields may be excluded from the scope of the audit reviews where appropriate. • The HKMA will collect feedback from AIs and the accounting industry on the GDR data audit approach, including the possibility of a pilot audit approach in Phase 1, followed by incremental expansion until the full audit scope is reached. Future Modernisation Considerations The HKMA will explore supporting API-based data submission alongside standardised file formats such as XML and CSV. This approach aims to reduce the manual processing required. Further, the HKMA will work with the industry and evaluate possibility of supporting on-demand data reporting (i.e. reporting of interim data sets on the request of the HKMA, as opposed to reporting at pre-defined frequencies). This is aimed at addressing the increasing needs for more agile of risk management and supervision. The HKMA acknowledges that data at this higher frequency may reflect interim positions and carries certain data inconsistencies. Depending on data areas and general data availability, the HKMA may work with the industry to define such interim refresh frequencies. Looking ahead, in line with the framework of DataGRID (Granularity, Reliability, Ingenuity and Discoverability) 1 , AIs are not expected to simply put in place a data system just to meet the requirements of GDR 3.0, but to take the opportunity to establish a modernised risk data layer that enables a more intelligent risk management approach. 1 Opening Remarks by ED(BS) at FiNETech 7 – https://www.hkma.gov.hk/eng/news-and￾media/speeches/2026/04/20260402-1/

4 Industry Engagement Plan Q2 2026 AIs will be invited to share feedback on the overall plan, including the three-phase roadmap, data scope, and governance approach. Q3 2026 AIs will be invited to provide input on data availability, data quality controls, particularly the validation points for reconciliation. Q3 2026 The HKMA will facilitate the sharing good practices, including, current data governance and automation tools, lessons learnt from existing reporting process. Q4 2026 AIs will be formally consulted on the refined implementation plan before finalisation. 2027 AIs will be invited to provide continuous feedback during the implementation of Phase 1, particularly during user acceptance testing (UAT), to validate data requirements against production data. Details of the industry engagement plan for phases 2 and 3 will be announced in due course. Potential Data Scope The list of potential data areas for GDR 3.0 is provided below for reference, with an initial focus on prudential supervision. During the process of industry engagement, the list will be expanded to include other data areas, such as those for policy-related data collection, anti-money laundering and conduct supervision. Potential Financial Data Areas under Phase 1 Current GDR data areas: • Corporate loans • Debt securities held • Interbank loans • Residential mortgage loans Expanded GDR data Areas: • Commitments & contingencies • Other retail loans • Other assets • OTC derivatives • Investment & equity securities held

5 Potential Financial Data Areas under Subsequent Phases • Interbank deposits • Debt securities issued • Other liabilities • Capital & reserves • Exchange-traded derivatives • Corporate deposits • Retail deposits • Due from Exchange Fund • Equity instruments issued & non-controlling interest • Exposure on securitization • Repos & reverse repos • Due to Exchange Fund Potential Non-Financial Data Areas to be Considered • Operational risk management • Cyber resilience • E-banking • Business Continuity Planning • Technology Risk Management • Cyber Incidents • Third Party Dependency