Group-wide Approach to Supervision of Locally Incorporated Authorized Institutions

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To set out the group-wide approach currently adopted by the HKMA to supervising AIs incorporated in Hong Kong Classification A non-statutory guideline issued by the MA as a guidance note Previous guidelines superseded CS-1 “Group-wide Approach to Supervision of Locally Incorporated Authorized Institutions” (V.1) dated 24.11.08 Application To all locally incorporated AIs Structure

1. Introduction
2. Types of group structures
3. HKMA’s responsibilities / roles in relation to groups
4. Solo and consolidated supervision
5. Supervision of an authorized institution and its subsidiaries in a
   Type One group
   5.1 General
   5.2 Legal framework

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision
5.3 Prudential supervisory standards
5.4 Information requirements
5.5 Supervision of cross-sector financial operations
5.6 Supervision of overseas branches and subsidiaries
6. Controller group review in a Type Two group and a Type Three
group
6.1 General
6.2 Legal framework
6.3 Controller group review factors
6.4 Information requirements
7. Supervisory cooperation for the supervision of an authorized
institution which forms part of a Type Two group
Annex: Conditions generally imposed on holding companies of
an AI
—————————

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision

1. Introduction
   1.1 In line with the Core Principles for Effective Banking Supervision
   (BCP)1
   , when the HKMA supervises an AI2 , it takes account of the consolidated risks of that AI’s banking group (typically, its immediate holding company, offices, subsidiaries, affiliates and joint ventures, both domestic and foreign). When the AI’s banking group is part of a wider group, with other group companies (both financial and non-financial) ultimately headed by a common holding company, the risks that could be posed to the AI by these group companies are also considered.
   1.2 The aim of this guideline is to outline the group-wide approach
   currently adopted by the HKMA to supervising AIs where they form part of a financial or a commercial group, either as the head of the group (i.e. in the case of a financial group), or as one of the member companies of the group (i.e. in the case of a financial or a commercial group).
2. Types of group structures
   2.1 In Hong Kong, the structure of a group of which an AI forms a
   part generally falls into one or more of the following three
   categories:
    Type One is where an AI is heading a financial group with subsidiaries engaging predominantly in providing financial services, such as banking, securities and insurance.
   Section 5 explains the HKMA’s approach to supervision of
   such groups.

1 First published in 1997 and updated in October 2006 and September 2012 by the Basel Committee on Banking Supervision, the BCP provide a set of minimum standards for banking regulation. 2 Unless otherwise stated, any reference in this guideline to “AI” refers to an authorized institution that is incorporated in Hong Kong.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision AI Banking subsidiaries Non-banking financial subsidiaries Non-financial subsidiaries  Type Two is where the AI and its subsidiaries form part of an international banking group or other supervised financial group (i.e. one that is headed by a bank or a regulated holding company 3 in an overseas jurisdiction, including through one or more intermediate holding companies above the AI).

In this module, the term “regulated holding company” refers to any holding company that is supervised by a financial regulator. Parent bank / Regulated Holding Co (outside H.K.) Intermediate holding company AI Subsidiaries Other subsidiaries (e.g. sister banks to AI)

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision  Type Three is where an AI and its subsidiaries are part of a group that is headed by an unregulated holding company (such as through one or more intermediate holding companies that is / are likewise unregulated above the AI) which controls entities engaging in financial activities or a wider range of financial and non-financial activities. This covers groups whose main line(s) of business is/are non-financial in nature. Where this is the case, the MA will generally require the AI within the group to be headed immediately by a locally incorporated holding company, for the purpose of ensuring (through conditions imposed on it as a controller of the AI under §70 of the Banking Ordinance (“the Ordinance”)) that the banking (and related) activities of the holding company are subject to relevant prudential standards.
2.2 Section 6 of this guideline sets out in further detail the approach
of the HKMA to assessing the holding companies of an AI with a view to limiting the risks that are posed to the AI by the holding companies or other entities within the same group, which is relevant to both a Type Two group and a Type Three group. However, in the case of a Type Two group, the HKMA will seek to rely as far as prudentially possible on the assessment of the

4 The HKMA expects that the sole purpose of the holding company is to hold the shares of the AI (though the holding company may also conduct other business or activities for the purposes of providing support to the business or activities of the AI). Immediate holding company Unregulated holding company AI & its subsidiaries Other financial services companies Other non￾financial services companies

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision home supervisors of the parent bank / regulated holding company. Section 7 of this guideline goes on to describe the mechanism of cross-border supervisory cooperation between the HKMA and the overseas regulators responsible for the consolidated supervision of the parent bank / regulated holding company of the AI by means of which the relevant risks in a Type Two group are addressed.
3. HKMA’s responsibilities / roles in relation to groups
3.1 Regulators’ responsibilities vary widely. In some jurisdictions
there are integrated regulators with prudential supervisory responsibilities for the full range of financial activities. In other jurisdictions the regulators have responsibility for supervising diversified financial groups at a holding company level.
3.2 In Hong Kong, the HKMA is neither an integrated regulator with
responsibility for all financial services companies (so for instance, the Securities and Futures Commission (SFC) and Insurance Authority (IA) are responsible for the regulation/supervision of securities and insurance companies respectively), nor does it have a mandate to supervise financial holding companies which are not AIs themselves. The HKMA’s responsibilities are centred on AIs: to regulate banking business and the business of taking deposits; to supervise AIs so as to provide a measure of protection to depositors; and to promote the general stability and effective working of the banking system.
3.3 In order to discharge these responsibilities, however, it is
necessary for the HKMA to adopt a “group-wide approach” to supervision of AIs, so as to take account of the possible effect on an AI of all risks within the group, wherever they reside within the group.
3.4 For an AI that belongs to either a Type Two group or a Type
Three group, the HKMA is looking for assurance that its holding company(ies) and other companies within the group are a source of support to the AI, and not a source of weakness. This is why, in addition to assessing the financial strengths and weaknesses of an AI, the HKMA also has regard to the impact of conditions at

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision the holding and other group companies that could adversely affect the condition of the AI. To this end, the HKMA may need to consider a number of factors – e.g. financial strength and soundness, corporate governance, management oversight and control – at a group level. This should not, however, be taken to imply that the HKMA has any responsibility for the condition of the group as a whole, or is in any sense “supervising” the group as a whole. The HKMA’s interest in the group is only in the context of being able to take account of whether there are significant issues or weaknesses at the group level that could threaten the position of the AI. Where such issues or weaknesses exist, the AI could face losses arising from either its direct financial exposure to the rest of the group or a loss of reputation resulting from “contagion” from problems elsewhere in the group.
3.5 The HKMA’s focus will vary according to the circumstances of the
case, but the financial soundness of the group will generally be a key issue. When an AI is part of a wider group, the HKMA will look for assurance that other entities within the group do not represent a possible drain on the capital (and liquidity) resources of the AI and, moreover, that the group would be in a position to offer capital (and liquidity) support to the AI if so required.
3.6 The HKMA will also consider whether the combination of the
businesses and operations of the other entities within the group with those of the AI, or the AI’s exposures to other group companies, increases or creates new risk concentrations (for example, if other entities in the group have exposure to the same customers as the AI, or to similar risk factors).
4. Solo and consolidated supervision
4.1 The starting point for the HKMA’s supervision is an AI’s
“combined” or “solo” position (i.e. covering its Hong Kong offices and overseas branches).
4.2 In situations where an AI is the parent company of a number of
subsidiary operations (i.e. a Type One group), the solo-based supervision is supplemented by an assessment of the risk profile

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision and strength of the AI and its subsidiary operations, and imposing prudential standards on the group (referred to in the following as “consolidated supervision”). Additionally, where an AI forms
part of a wider group which is headed (including through one or
more intermediate holding companies) by a common holding company (i.e. a Type Two group or a Type Three group), the solo and consolidated supervision is further supplemented by appropriate review of the holding company and other companies of the group of which the AI forms a part (referred to in the following as “controller group review”).
4.3 It must however be emphasised once again that the HKMA’s
purpose in practising a group-wide approach to controller group review is not to supervise all the companies within any group of which an AI forms a part, but rather to supervise the AI as part of that group. The rest of this guideline sets out the supervisory framework (covering where applicable the legal framework, prudential standards, assessment factors and information requirements) based on which the HKMA practices consolidated supervision and controller group review.
5. Supervision of an authorized institution and its
subsidiaries in a Type One group5
5.1 General
5.1.1 The HKMA exercises consolidated supervision of AIs with
regulatory oversight of their downstream operations and the application of quantitative prudential limits and qualitative assessment factors on AIs at a group level. To assess the financial strength of an AI, and the risks inherent in its downstream operations, the Ordinance and the rules made by the MA under the Ordinance (e.g. the Banking (Capital) Rules (“BCR”), the Banking (Liquidity) Rules (“BLR”) and the Banking (Exposure Limits) Rules (“BELR”)) empower the MA to set prudential limits, such as on capital adequacy, leverage ratio, liquidity, large

5 This section is also applicable to an AI which is not only the parent of a Type One group but also a subsidiary of a broader Type Two or Type Three group.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision exposures, and connected lending on a consolidated basis covering such offices / branches / subsidiaries / associated entities as specified by the MA in each case. To assess the non-quantifiable risks posed to the AI by its downstream operations, qualitative factors such as the group’s organisational structure, corporate governance, quality of management, risk management systems and internal controls, will be considered.
5.2 Legal framework
Principal functions of the MA
5.2.1 It is the responsibility of the MA under §7 of the
Ordinance to, inter alia, ensure that the operations (local or overseas) of AIs are properly conducted and cooperate with other supervisory authorities (local or overseas) in order to promote the general stability and effective working of the banking system. Acquisition / establishment of branch operations, downstream subsidiaries and significant interests
5.2.2 To avoid its downstream operations posing undue risks to
an AI, the MA has the power under the Ordinance, or the BELR to require the AI to seek the prior approval of the MA before it can:
 establish any local or overseas branch or representative office (§44 and §49),  establish or acquire any local or overseas banking subsidiary (§51A and through §70) or  acquire a significant interest in any company (i.e. which amounts to 5% or more of the AI’s Tier 1 capital at the time of acquisition) (Rule 23(1) of BELR).

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision
5.2.3 In assessing applications for the above purposes, the
HKMA will take into account such factors as the following, and attach conditions at the time of approval to mitigate risks involved where necessary:
 the financial and managerial capacity of the AI for the establishment / acquisition;  the nature of activities proposed to be conducted in the branch, office or company to be established / acquired;  the impact on funding and capital adequacy of the AI;  whether the country in which the company is located complies sufficiently with international standards and codes or has any supervisory arrangements or secrecy constraints that would inhibit effective consolidated supervision by the HKMA. Power to obtain information and conduct examination
5.2.4 The MA has the power under §63 of the Ordinance to
gather information from an AI or any of its subsidiaries relevant for supervision, as well as power under §55 to conduct on-site examination on any local or overseas branch, office or subsidiary, or overseas representative office of an AI to examine its books, accounts and transactions. As set out in §63, the MA will, when requesting the information, need to satisfy himself that the information so requested is reasonably required for the exercise of his functions under the Ordinance and that the provision of such information is in the interests of the depositors or potential depositors of the AI. Please also see section 5.4 for further guidance on information requirement.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision Supervisory exchange of information
5.2.5 The MA has the power under §120 and §121 of the
Ordinance to exchange supervisory information with relevant supervisory authorities, including local authorities such as the SFC and the IA, as well as overseas supervisors having similar functions which are subject to adequate secrecy provisions in their jurisdictions. Please also see sections 5.5 and 5.6 for further guidance on supervisory coordination. Limits on large exposures
5.2.6 Under the BELR, AIs are required to comply with
specified exposure limits (e.g. in relation to large exposures, exposures to connected parties, significant investment or acquisitions, interests in land and buildings, etc.) on a consolidated basis. Consolidation under the BELR normally includes all subsidiaries of the AI that undertake financial business or incur risks regulated by the BELR, determined as appropriate by the HKMA. The HKMA will discuss with individual AIs and notify them in writing which subsidiaries will be included for consolidation. Minimum capital requirements
5.2.7 For an AI that has subsidiary operations undertaking any
“relevant financial activity” as defined in §27(3) of the BCR through subsidiary companies, the MA will generally require the AI to comply with its minimum capital requirements on a consolidated basis, in addition to a solo/solo-consolidated basis, by issuing a notice under §3C(1) of the BCR to the AI.
5.2.8 A subsidiary of an AI which is an insurance firm or
securities firm as referred to under §27(2) of the BCR is generally not consolidated because it is subject to the separate capital adequacy requirements of other financial regulators (e.g. SFC and IA). Holdings of any capital

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision investments in these subsidiaries are required to be deducted from the AI’s capital base subject to thresholds permitted in the BCR. Moreover, where an AI’s insurance or securities subsidiary fails to meet the minimum capital requirements applicable to it and fails to make appropriate remedy in time as determined by the relevant regulator, the MA may require the amount of the capital shortfall to be deducted from the institution’s CET1 capital.
5.2.9 There are other capital investments of an AI where, to
ensure that the potential risks they pose to the AI are accounted for in the AI’s capital calculation, the BCR require them to be subject to capital deduction based on a specified mechanism.6 Minimum liquidity requirements
5.2.10 Under the BLR, locally incorporated AIs having any
associated entities (as defined in §97H(4) of the Ordinance) may be required to comply with the relevant statutory liquidity ratios on a consolidated basis. In determining which associated entities of a locally incorporated AI should be consolidated for liquidity purposes, the MA will primarily have regard to (i) the respective liquidity risks that the entities pose to the AI and (ii) whether the respective activities of the entities fall within any of “relevant financial activities” as defined in Rule 11 of the BLR. For liquidity purposes, the associated entities included in a consolidated group may not necessarily be majority owned or controlled by the AI.7

6 Please refer to CA-G-1 for further details.
7 For example, an entity is regarded as an associated entity of an AI if the AI is entitled to exercise, or control the exercise of, 20% or more, but not more than 50%, of the voting power at any general meeting of the entity.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision Disclosure requirements
5.2.11 Where the AI is required by the MA to calculate its CAR
on a consolidated basis, the AI is required under §11 of the Banking (Disclosure) Rules to publish certain information on a consolidated basis relating to its state of affairs, including its profit and loss and financial resources (covering capital and liquidity resources). AIs are also required to disclose information on related party transactions, and its policy for lending to related parties and other relevant details according to Hong Kong Accounting Standard 24 Related Party Disclosures, Companies Ordinance and Listing Rules, as applicable. Possible remedial actions
5.2.12 To address contagion risks posed to an AI by its
downstream operations, the MA has the power to:
 impose restrictions on the AI’s relationship with its downstream operations (e.g. limit financial exposures to the subsidiaries concerned) under §52 of the Ordinance under certain circumstances (e.g. where the MA is of the opinion that the AI is carrying on its business in a manner detrimental to the interests of depositors or creditors);  attach conditions subsequent to approval in respect of any of these operations under §49, §51A of the Ordinance and Rule 23(1) of the BELR, or to revoke the former approval given to an AI in respect to its establishment / acquisition of downstream operations (i.e. requiring the AI to dispose of the operations concerned).
5.3 Prudential supervisory standards
5.3.1 Apart from the application of the quantitative limits on a
consolidated basis, the HKMA will have regard to the extent to which an AI is able to meet the relevant

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision qualitative prudential supervisory standards at the group level in its on-going risk-based supervisory process, including the following. Group corporate governance and risk management
5.3.2 The Board (or its delegated committee(s)) of the AI is
responsible for the following regarding the group headed by it, including entities that are majority owned or controlled by the AI:
 defining the strategy and risk appetite;  ensuring the group’s organisational and management structure is consistent with the strategy and risk profile and does not obscure effective group oversight;  establishing sound corporate governance of the group through promoting an appropriate risk management culture and implementing a remuneration system commensurate with the group’s risk profile;  ensuring the presence of a risk management framework commensurate with the risk profile and scale of the group, including internal controls, internal audits and compliance function. Comprehensive policies and procedures must be in place to measure, manage, monitor (including through stress-testing) and report all risks at a group level covering those in relation to new products and services as well as outsourcing where appropriate. Such policies and procedures should be reviewed and updated annually to take account of changing risk profiles of group entities. Any material changes to group risk management policies must be approved by the Board (or its delegated committee(s)).

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision
5.3.3 The AI should ensure that itself and its group entities are
subject to prudent corporate governance and risk management frameworks. SPM modules relevant to these in particular include:
 “Corporate Governance of Locally Incorporated Authorized Institutions” (CG-1), in particular paragraph 9.1;  “Risk Management Framework” (IC-1);  “Guideline on a Sound Remuneration System” (CG-5);  “Internal Audit Function” (IC-2);  “Stress-testing” (IC-5); and  “Outsourcing” (SA-2). Some of the above SPM modules specifically provide for relevant guidance to be applied to an AI on a group basis. For cases where an SPM module does not contain any specification on the scope of application of its guidance, the general expectation is that an AI should endeavor as far as practicable to ensure that its group entities are subject to comparable risk management principles that are commensurate with the risks and operations of the entities and the geographical and regulatory environment in which they operate. Concentration risks, intra-group exposures8 and contagion
5.3.4 The AI should have adequate internal policies and
procedures to measure, control and monitor concentration risk, connected exposures and intra-group

Intra-group exposures represent risk exposures, both on- and off-balance sheet exposures, arising from transactions between entities within a group, such as trading operations, central management of liquidity, provisions of guarantees, loans and commitments, etc.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision transactions. Relevant prudential standards are set out in detail in the SPM modules on “Large Exposures and Risk Concentrations (CR-G-8)” and “Exposures to Connected Parties (CR-G-9)”. In this connection, the AI should be able to produce respective data and information, on a solo basis, and wherever applicable, on a consolidated basis as well for the HKMA to conduct assessment of its concentration risk, connected exposures and intra-group transactions.
5.3.5 The HKMA will consider the contagion risk posed by the
related entities (whether regulated or not) to the AI, having regard to factors relevant for assessing “susceptibility to contagion” described in paragraph 6.3.4 for controller group review. Group capital and liquidity management
5.3.6 The Board of the AI is responsible for ensuring that the AI
effectively manages its capital and liquidity positions on a consolidated basis, maintaining an appropriate level of capital and liquidity commensurate with the level and extent of risks to which the AI and its subsidiaries (including those that are unregulated) are exposed from their activities. Any limitations on (or potential impediments to) intra-group transfer of capital and funds should be taken into account.
5.3.7 The AI is expected to have an internal capital adequacy
assessment process (ICAAP) that is commensurate with its size and complexity of operations to identify, measure and report the risks in the AI and its subsidiaries’ business and to assess how much capital is needed to support these risks. Relevant standards are set out in detail in the SPM module on “Supervisory Review Process (CA-G-5)”.
5.3.8 On liquidity risk management, the relevant prudential
standards are set out in detail in the SPM modules on “Regulatory Framework for Supervision of Liquidity Risk

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision (LM-1)” and “Sound Systems and Controls for Liquidity Risk Management (LM-2)”.
5.4 Information requirements
5.4.1 AIs are required to submit consolidated information as a
part of their statutory submissions or upon request.
Major information to be submitted includes:
Statutory submissions
 Banking returns on large exposures, capital adequacy and liquidity on a consolidated basis covering subsidiaries / overseas offices / associated entities specified by the MA;  Reports prepared by external auditors under §63(3) and §63(3A) certifying the accuracy of the relevant banking returns and the adequacy of the AI’s internal system for the compilation of the returns. On request  Organisation chart showing the AI and its downstream operations (in the form of branches / subsidiaries);  Group risk management structure and policies;  The audited consolidated financial statements of the AI;  The audited financial statements of other relevant group companies which are considered by the HKMA to have a material potential impact on the AI;

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision  Risk management reports at the group level (e.g. on large exposures, connected exposures, capital adequacy, liquidity risk and other major risks);  Other management information reports at group level that will assist the MA in understanding the group operations and assessing the associated risks.
5.5 Supervision of cross-sector financial operations
5.5.1 Where an AI engages not only in banking, but also in
other financial operations (i.e. in insurance and securities business) including through its subsidiaries, the HKMA has established memoranda of understanding (MoUs) of cooperative supervisory arrangements with the SFC, the IA and the Mandatory Provident Fund Schemes Authority (MPFA), working closely with them through bilateral meetings to exchange information of mutual supervisory interest in accordance with the MoUs. Setting out the respective roles and responsibilities of the regulators in respect of entities with cross-sector activities, these MoUs also aim to minimise duplication of regulatory efforts, close gaps in regulatory boundaries, promote mutual assistance and the exchange of information so that each regulator may effectively perform its respective responsibilities. Copies of these MoUs can be accessed on the HKMA’s public website.
5.6 Supervision of overseas branches and subsidiaries
5.6.1 As described earlier, the prudential supervision of the
HKMA (including the application of quantitative limits and qualitative prudential supervisory standards) as the home regulator of an AI extends to its overseas operations. For overseas operations in the form of branches and banking subsidiaries that are regulated by banking supervisors in the host jurisdictions, the HKMA will exercise consolidated supervision in close cooperation with the relevant host supervisors through periodic supervisory contacts and exchange of information.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision
6. Controller group review in a Type Two group and a Type
Three group
6.1 General
6.1.1 It is generally the MA’s policy that a person who intends
to become a majority shareholder controller9 of an AI should be a well-established bank or other supervised financial institution in good standing in the financial community and with appropriate experience. In many cases AIs in Hong Kong are subsidiaries of international banking groups, and hence the ultimate consolidated supervision of the relevant financial group (i.e. a Type Two group) vests with the home banking regulators.
6.1.2 There are also cases where an AI is part of a financial or
a diversified conglomerate and neither its ultimate parent company nor any of its intermediate holding companies is under the consolidated supervision of the MA or an overseas financial regulator (i.e. a Type Three group). In these cases, entities within the group engage not only in banking / financial activities, but also other commercial activities.
6.1.3 The MA does not have a direct legal power to supervise
any holding company of an AI (which is not an AI itself) under the Ordinance, but does have power to require its “fitness and propriety” as a controller of the AI on a continuing basis. For each such holding company, to discharge this responsibility, the HKMA will not only be interested in the holding company, but also the operations of its other group companies, to the extent that they could have a material impact on the AI. The controller group review by which the HKMA assesses the fitness and propriety of the holding company as a majority shareholder controller of the AI takes account of the effect

9 As defined in the Ordinance, a majority shareholder controller refers to a person who either alone or with associates controls over 50% of the voting rights of the AI or of another company of which the AI is a subsidiary.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision of the holding company and the operations of its other group companies on AIs. Where necessary and to the extent practicable, the HKMA may employ assessment tools similar to prudential standards expected of AIs (e.g. in terms of quantitative limits on capital adequacy, liquidity, large exposures, connected lending, etc.), taking into account factors relevant to the nature of business of the controller (particularly for one whose main business activities are non-financial in nature) in assessing the financial soundness of a controller group as a whole.
6.1.4 The following paragraphs describe in general the legal
framework and the key factors that the HKMA will take into consideration for a controller group review. In the case of a Type Two group, the HKMA will rely as far as possible on the home supervisors of the parent bank or holding company of the AI to ensure that these factors are adequately addressed, and will generally conduct its own assessment only on aspects where it has concern over the scope and approach of the home supervisors’ supervision or where the relevant information it requires is not directly available from the home supervisors. The cross-border supervisory arrangement between the HKMA and the home supervisors to this effect is described in section 7.
6.2 Legal framework
Approval of controller
6.2.1 As part of the authorization criteria, paragraphs 3 and 4 of
the Seventh Schedule to the Ordinance require that the MA must be satisfied respectively that he knows the identity of each controller of an AI and that each such controller is fit and proper to hold the position. These are reflected in the MA's powers under §70 of the Ordinance to give approval or object to any person becoming or being a controller of an AI, having regard to whether the person is "fit and proper". To ensure the fitness and propriety of a controller on an on-going basis,

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision the MA may, for the purpose of safeguarding the interests of depositors and potential depositors of the AI, specify conditions in a notice of consent under §70(6)(a) and (7), or add / revise conditions in a prior notice of consent by serving the controller concerned a new conditional notice of consent (which will revoke the prior notice of consent under §70(6A)). The MA also has the power under §70A to serve a notice of objection to any existing controller where it appears to the MA that the controller is no longer fit and proper to hold the position.
6.2.2 Where appropriate, for the purpose of supervising an AI
within a Type Three group, the MA may specify in the notice of consent to a majority shareholder controller of the AI conditions that are akin to the key prudential requirements that the AI is normally subject to. This would be the case where the controller is the immediate holding company (“IHC”) of the AI whose sole purpose is to hold shares of the AI and, where applicable, conducts ancillary business or activities to support the AI’s operations. Where the controller is either the ultimate holding company (“UHC”) or an intermediate holding company (“ITHC”) between the IHC and the UHC, for instance, within a diversified conglomerate with other significant group entities engaging in non-financial activities, the conditions imposed will mainly focus on enabling the MA to obtain relevant information assessing and containing potential risks posed to the AI by activities elsewhere in the group. Generally speaking, conditions imposed on a holding company would cover those outlined at Annex, which are underpinned by the factors that the MA will assess in undertaking a controller group review (as described under section 6.3), supported by information required to be submitted by a controller (as described under section 6.4).

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision Power to obtain information
6.2.3 To facilitate an assessment of a group to which an AI
belongs, the MA is empowered under §63(2A) of the Ordinance to require any holding company of the AI or any subsidiary of any such holding company to submit such information that the MA considers he reasonably requires for the exercise of his functions under the Ordinance and is necessary to be submitted in the interests of depositors or potential depositors of the AI concerned. Every director, chief executive, and manager of such company commits an offence if the company fails to comply with the requirements under §63(2A) without reasonable excuse. Power to control establishment of overseas banking subsidiaries
6.2.4 Where any holding company of an AI is locally
incorporated, the MA has the power under §51A(2) to also require the holding company to obtain his prior approval in establishing or acquiring any overseas banking corporation to become its subsidiary. The MA may attach conditions to the approval, where necessary, to avoid undue risks being posed in future by the fellow subsidiary to the AI. Power to take remedial actions
6.2.5 Where there are supervisory concerns in view of the
corporate structures or activities of the related entities of an AI, the MA may, depending on the level of risk posed to the AI by the structure or activities, take any of the following actions to contain the risks:
 apply to the Court of First Instance for an order requiring the controller to dispose of its shareholding in the AI (i.e. to serve a notice of objection to the controller under §70 of the Ordinance);

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision  require the controller to restructure and consolidate financial services activities in or under the AI (i.e. to attach conditions to the MA’s consent under §70 of the Ordinance);  impose restrictions on the AI’s business relationship with its related entities (i.e. to use the powers under §52 of the Ordinance);  attach conditions to his approval to mitigate the risks or revoke the former approval given under §51A of the Ordinance (i.e. requiring the holding company to dispose of the overseas subsidiary concerned).
6.3 Controller group review factors
6.3.1 To assess the suitability of a holding company as a
majority shareholder controller of an AI, the HKMA will need to have regard to the organisation and management structure and the nature of the major operations within the group headed by the controller. The following is a list of factors that the HKMA may take into consideration in its review of a controller group (there could be more than one, each at a different level within the overall group structure) to the extent necessary in each case10:

10 In determining the appropriate extent to which the standards set out under section 6.3 should apply in a controller group review, the HKMA will have regard to the suitability of the prudential supervisory standards applicable to an AI as the parent of a Type One group (as set out in section 5.3). This will take into account the nature and scale of business of the controller and the significance of the AI to the controller group. Where, for instance, the main business of a controller of an AI in a Type 3 group is non-financial in nature, the controller group review is expected to focus on understanding and assessing the financial strength of the controller, capability of the controller in providing continuing support to the AI, the major operations of group, the risks inherent in the group’s business, and how the risks are managed and may affect the AI.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision Group structure
6.3.2 The legal, managerial, and operational structures of the
group, which should be sufficiently transparent for the HKMA to ascertain:
 the major subsidiaries or affiliates, principal place of business, and location of the “mind and management” of the major business lines of the group;  the way in which the group is managed and controlled at a high level, and where relevant, the ways cross-border operations are managed;  the major lines of accountability within the group;  the key corporate, financial, and other linkages between the AI and other group members;  the level to which the corporate structure of the group (i.e. the group of related entities including the AI and its parent or parents) may affect the supervision and regulation of the AI (i.e. “supervisability”). In addition, the HKMA will have regard to the extent to which the parents and affiliates of the AI are supervised by the MA, other domestic regulators (i.e. SFC, MPFA, IA), or overseas regulatory authorities. Quality of group corporate governance and management oversight
6.3.3 The high-level corporate governance and risk
management of the group as a whole:
 composition of the board of directors and board-level committees (including audit committee) of the holding company;

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision  whether the board and senior management of the controller have sufficient knowledge and expertise commensurate with their involvement in overseeing and managing the group operations that are related to the AI;  oversight of significant transactions with related parties (particularly those involving the AI);  the degree of influence exercised by the controller on the conduct of the affairs of the AI and commensurate with which, the existence within the controller of the knowledge, experience, competence, soundness of judgement and diligence required for running an AI;  whether the controller and its related entities (including the board of directors and members of senior management) have been the subject of any criminal convictions or have been found to be in breach of statutory or other regulatory enactments or have a record of non-compliance with various non-statutory codes or have been reprimanded or disqualified by professional or regulatory bodies. Risk profile
6.3.4 The principal risks inherent in the group:
 major operations of the group and its overall business strategies, both domestic and cross-border;  major risk-taking entities or business units within the group;  trends and major activities that may significantly change the risk profile or impair the financial strength of the group, for example, merger and

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision acquisition, disposal of core business units or subsidiaries of the group, and new ventures or changes in the principal activities of any company within the group;  potential risks posed by other group companies (including special purpose entities, if any) to an AI within a group through adverse developments in the former. This will depend on many factors such as the extent of direct economic links between the entities, the use of common branding and marketing, and market perception. Two of the factors to which the HKMA will pay particular attention are set out below:
– Intra-group transactions – AIs belonging to a group should have policies and procedures to monitor their participation in group operations, transactions with other companies in the group and compliance with Part XV of the Ordinance (including the BELR made under this Part) and the internal intragroup exposure limit as required under the SPM module CR-G-8. Intra-group transactions of AIs are expected to be conducted on arm’s length terms. The HKMA will assess whether significant intra-group transactions involving the AI which are not effected on arm’s length terms and any significant intra-group relationship of an AI with other group companies (e.g. insourcing), if any, are justifiable. – Susceptibility to contagion – This relates to the extent to which an AI is likely to be affected through contagion arising from any adverse developments in its related companies, whether regulated or not, stemming from contractual obligations or

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision informal influence, risk management arrangements, intragroup transactions and exposures, strategic risk, reputation risk, etc. This will also depend, among other things, on the ability of the AI to raise capital and solicit liquidity support from the market without relying on the name or support of its other group companies. Overall financial strength of the group
6.3.5 The MA will need to be satisfied that the nature and
sufficiency of the controller’s financial resources are such that it would be capable of providing continuing support to the AI or would have access to financial resources to enable it to do so. Relevant factors in this regard include:
 whether the controller (other than one that is incorporated in Hong Kong) is state-owned;  profitability and liquidity of the group;  capital and leverage position;  the strategic direction of the group (including the intentions or plans for the AI) and its track record and financial capacity in undertaking the existing and planned activities. These may include major business developments, such as major acquisition and merger activity that may reduce the financial resources available to support the AI;  any other matters that may significantly impair the group-wide financial strength or the ability of the controller to provide capital or liquidity support.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision
6.3.6 In addition, the HKMA may also require the holding
company to provide the MA with a letter of comfort whereby it confirms its policy to provide capital and/or liquidity support to the AI in case of need. Risk management and internal controls
6.3.7 The group is expected to have adequate risk
management processes and internal control mechanisms at group level, having regard to its size, nature and complexity of operations. In this connection, the relevant factors may include:
 the involvement of the board and senior management at group level in risk management;  the way in which the risk management function is organised and conducted on a group-wide basis to identify, monitor, control and mitigate all material risks;  the capital management process of the group, including its policies, approach to capital allocation, capital structure and projection of group capital position taking into account planned capital raising activities to ensure group-wide capital adequacy and particularly the capital adequacy of the AI;  the liquidity management process of the group, including its policies, structure for managing liquidity risk (e.g. degree of centralisation), funding sources, and the extent of liquidity support the AI receives from, or provides to, its parent or other group companies;  the group’s internal controls mechanism, in particular the independence and competence of internal auditors.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision
6.4 Information requirements
6.4.1 The HKMA will generally expect a controller to submit
information to it on an annual basis (or more frequently as required by the HKMA), and to notify it of any developments as soon as practicable that may affect the controller’s financial position, principal activities or management, and thereby have the potential to materially affect the position of the AI. The latter may be formally required through conditions attached to the MA’s approval for it to become a majority shareholder controller of an AI under §70 of the Ordinance. Submission of information and notifications can be made by the AI or another company within the group on behalf of the controller.
6.4.2 Information to be submitted on a regular basis (such as
annually and on certain matters more frequently) may include:
 group organisation chart;
 overview of group risk management framework;  the audited consolidated financial statements and other relevant financial information of the holding company and, where applicable, any intermediate holding company which, together with its subsidiaries, engages predominantly in banking business;  the audited financial statements and other financial information of other relevant group companies which are considered by the HKMA to have material potential impact to the AI;
6.4.3 Notification is expected to be provided to the MA as soon
as practicable on matters that may give rise to any of the following:

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision  any significant impairment in the group-wide capital adequacy or the liquidity of the group;  any significant leverage position of the group that may affect its ability to obtain funding or repay debts;  any significant group-wide financial exposure and connected lending;  any charge created over the assets of the group that will bring the aggregate value of all charges on a group-wide basis to a significant level;  any significant intra-group financial exposures (particularly those involving the AI or that are not transacted at arm’s length);  any acquisition, establishment, disposal or closure of any subsidiary of significant importance in the context of the group, or any significant change in the principal activities of any company within the group;  unless otherwise agreed with the HKMA, any change in the appointment of the chief executive or the directors of the controller together with the personal particulars and background of the persons concerned.
7. Supervisory cooperation for the supervision of an
authorized institution which forms part of a Type Two group
7.1 In a Type Two group where an AI is the subsidiary operation of an
international banking group, the consolidated supervision of the HKMA is exercised only at the “intermediate level” of consolidation of the banking group up to the level of the AI. This is because the home banking regulators are expected to exercise

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision adequate consolidated supervision on the international banking group as a whole. To ensure that consolidated supervision is effectively practised at the parent bank / holding company level, the HKMA will ensure that relevant financial activities of the group are adequately supervised through supervisory contact with the relevant home banking regulators11 .
7.2 Formal arrangements for supervisory collaboration may be
established through MoUs or letters of agreement entered into between the HKMA and individual overseas regulators, which spell out the obligations of each supervisory authority regarding, inter alia:
 sharing and exchange of information in respect of banks that operate in both signatories’ jurisdictions for ongoing supervision and when there is material supervisory concern;  each signatory’s respective supervisory responsibilities in respect of these banks;  the requirement to consult with each other regarding any cross-border establishment or investment by these banks;  on-going supervisory contacts (e.g. through bilateral meetings or duty visits) to exchange views on major prudential issues or to discuss matters of common interest; and  the maintenance of the confidentiality of supervisory information received from the other signatory.
7.3 Information on the supervisory authorities with which the HKMA
has entered into MoUs or letters of cooperation is available on the HKMA’s public website.

11 In some jurisdictions such as US, Japan and Australia, the regulator has a direct legal power to supervise the holding companies of banks.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision
7.4 As part of supervisory cooperation, the HKMA participates in
supervisory colleagues organised by the consolidated regulators of financial groups. In addition, the HKMA will conduct bilateral meetings with the relevant overseas supervisory authorities on various occasions to exchange information of mutual supervisory interest, and share examination findings with these authorities for information on a periodic basis.

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision
Annex: Conditions generally imposed on holding companies of an AI
Immediate Holding Company (“IHC”) An IHC is required to observe prudential standards and other requirements "as if the IHC were a local bank". These normally cover, among others, the requirements to – (i) observe prudential limits on capital adequacy, liquidity, large exposures, intra-group exposures and charge over assets; (ii) ensure the capital adequacy of the AI; (iii) consult the MA prior to changes in its group structure or its business or activities, and to obtain the MA’s prior consent, where appropriate, for carrying on any business or activity; (iv) establish and maintain effective systems and controls for managing risks (including risks that may be posed by the UHC group to it and the AI); (v) ensure fitness and propriety of its chief executive and directors and exercise effective corporate governance; and (vi) submit relevant financial and other information (e.g. banking returns, audited accounts, notifications on matters of concerns, etc.) as needed. Ultimate Holding Company (“UHC”) A UHC is required to - (i) ensure and support capital adequacy of the AI; (ii) limit intragroup exposures of the IHC group to other entities of the UHC group; (iii) submit independent review report on a periodic basis on:
 its financial conditions in terms of capital adequacy, leverage position, liquidity position and intra-group exposures;

Supervisory Policy Manual
CS-1 Group-wide Approach to Supervision  the ability of the UHC group companies (i.e. other than those within the IHC group) to provide timely capital and/or liquidity support to the IHC and the AI in case of need; and  the risks inherent within the UHC group’s business and affairs that may have a bearing on the soundness of the IHC and the AI and how these risks are managed and controlled. (iv) ensure that the representation of it and its related parties in aggregate on the board of directors of the IHC and that of the AI does not exceed a specified limit; and (v) submit relevant financial and other information (e.g. audited accounts, notifications on matters of concerns, etc.) Intermediate Holding Company (“ITHC”) An ITHC is required to observe similar requirements that are imposed on UHC, except that it is normally not required to submit an independent review report to the MA. ————————— Contents Glossary Home Introduction