HKMA Supervisory Policy Manual MR-2: CVA Risk Capital Charge

Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 1 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To set out the minimum standards which the HKMA expects AIs to adopt for the calculation of their CVA risk capital charges. This module is designed not just to provide details in addition to the Banking (Capital) Rules but to integrally cover all the related requirements. Classification A statutory guideline issued by the MA under the Banking Ordinance (the Ordinance), section 7(3). Previous guidelines superseded MR-2 “CVA Risk Capital Charge” (V.1) dated 15.03.2024 Application To all locally incorporated AIs Structure

1. Introduction 1.1 Terminology 1.2 Background 1.3 Scope of application 1.4 Approaches to calculation of CVA risk capital charge 1.5 Implementation
2. BA-CVA 2.1 General 2.2 Reduced BA-CVA

Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 2 2.3 Full BA-CVA 3. SA-CVA 3.1 General criteria 3.2 Regulatory CVA calculations 3.3 Components of SA-CVA 3.4 SA-CVA: risk factors and sensitivity definitions 3.5 SA-CVA: delta risk weights and correlations 3.6 SA-CVA: vega risk weights and correlations 4. Cryptoasset exposures 4.1 General 4.2 CVA risk for Group 1 cryptoassets 4.3 CVA risk for Group 2 cryptoassets Annex A: Abbreviations —————————

3 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025

1. Introduction 1.1 Terminology 1.1.1 Unless otherwise specified, the terms used in this module have the same meaning as those used in the Banking (Capital) Rules (“the Rules”). 1.2 Background 1.2.1 In July 2020, the Basel Committee on Banking Supervision (“BCBS”) issued its Targeted revisions to the credit valuation adjustment risk framework. 1 The revised CVA risk framework aims at aligning its design with the new market risk framework and taking into account exposure variability driven by daily changes of market risk factors in determining the CVA risk. It follows up on an original version published in December 20172 and includes a set of amendments to address issues that have been identified through input from a wide spectrum of stakeholders. 1.2.2 The HKMA implemented the new CVA risk capital framework closely aligned with the standards issued by the BCBS. 3 They are set out in Part 8A of the Rules and, with additional technical details, in this module. 1.2.3 This module is based on the Rules and intends to provide all the requirements for implementing the new CVA risk capital framework in Hong Kong. It covers the reduced basic CVA approach, the full basic CVA approach and the standardised CVA approach. 1.2.4 In case of any discrepancy between this module and the Rules, the Rules will prevail. 1 http://www.bis.org/bcbs/publ/d507.htm 2 http://www.bis.org/bcbs/publ/d424.htm 3 Unless otherwise specified, the FAQs incorporated in the Basel Framework prior to 1 January 2025 are applicable to the CVA risk capital framework in Hong Kong, with the key ones being incorporated into this module. For FAQs published by the BCBS after 1 January 2025, we will notify AIs of the effective implementation date of such FAQs, and the key ones will be incorporated into this module in due course.

4 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 1.3 Scope of application 1.3.1 In this module, CVA stands for regulatory credit valuation adjustment 4 specified at a counterparty level which excludes the effect of the AI’s own default. CVA reflects the adjustment of default risk-free prices of derivatives and securities financing transactions (“SFTs”) due to a potential default of an AI’s counterparty. 1.3.2 CVA risk is defined as the risk of losses arising from changing CVA values in response to changes in counterparty credit spreads and market risk factors that drive prices of the covered transactions. 1.3.3 All AIs should calculate the CVA risk capital charge for covered transactions in both the banking book and the trading book 5 . Covered transactions include:  all derivative contracts except transactions directly with: – a qualifying central counterparty 6 (“qualifying CCP”); or – a clearing member of a qualifying CCP for which the risk-weighted amount of the default risk exposure incurred by the AI is calculated in accordance with section 226ZA(3) or (4) of the Rules where the AI concerned is a client of the clearing member and the clearing member acts as a financial intermediary between the AI and the CCP, – a qualifying CCP for which the risk-weighted amount of the default risk exposure incurred by the AI is calculated in accordance with section 226ZB(2) or (3) of the Rules where the AI concerned is a client of a clearing member of the CCP and the performance of the AI is guaranteed by the clearing member; or 4 Regulatory CVA may differ from CVA used for accounting purposes. For example, the effect of the AI’s own default is considered in the accounting CVA but not in the regulatory CVA. 5 See subsection 2.1 of MR-1 “Market Risk Capital Charge” for the scope of the trading book. 6 Unless otherwise specified, “qualifying CCP” has the same meaning as specified in section 2 of the Rules.

5 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 – a higher level client in a multi-level client structure associated with a qualifying CCP for which the risk-weighted amount of the default risk exposure incurred by the AI within the structure to the higher level client is calculated in accordance with section 226ZBA(5) of the Rules; and  SFTs that are fair-valued by the AI for accounting purposes, where the HKMA determines that an AI’s CVA risk arising from SFTs is material. In case the AI deems the CVA risk arising from SFTs is immaterial, the AI can justify its assessment to the HKMA by providing relevant supporting documentation. 1.3.4 An AI should calculate the CVA risk capital charge for its CVA portfolio on a standalone basis. The CVA portfolio should include all covered transactions and eligible CVA hedges. 1.3.5 Eligibility criteria for CVA hedges are specified in paragraph 2.3.1 for the basic CVA approach (“BA-CVA”) and in paragraph 3.1.6 for the standardised CVA approach (“SA-CVA”). 1.3.6 An AI may enter into an external CVA hedge with an external counterparty. All external CVA hedges, i.e. both eligible and ineligible external hedges, that are covered transactions should be included in the CVA risk capital charge calculation. 1.3.7 If an external CVA hedge is eligible, it should be removed from the market risk capital charge calculation. Otherwise, ineligible external CVA hedges are treated as trading book instruments and are included in the market risk capital charge calculation. 1.3.8 An AI may also enter into an internal CVA hedge between the CVA portfolio and the trading book. Such an internal hedge consists of two exactly offsetting positions: a CVA portfolio side and a trading desk side. 1.3.9 If an internal CVA hedge is eligible, the CVA portfolio side should be included in the CVA risk capital charge calculation, while the trading desk side should be

6 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 included in the market risk capital charge calculation. Otherwise, for ineligible internal CVA hedges, both positions should be included in the market risk capital charge calculation where the positions cancel each other. 1.3.10 An internal CVA hedge involving an instrument that is subject to curvature risk, the default risk charge or the residual risk add-on under the market risk capital framework (see section 3 of MR-1 “Market Risk Capital Charge”) is eligible only if the trading book additionally enters into an external hedge with an external counterparty that exactly offsets the trading desk’s position with the CVA portfolio. 1.4 Approaches for calculation of CVA risk capital charge 1.4.1 For the purpose of determining the risk-weighted amount for CVA risk, all locally incorporated AIs will be required to calculate the CVA risk capital charge in accordance with the new CVA risk standards. AIs, except for those mentioned in paragraph 1.4.2, may choose to calculate the CVA risk capital charge under the BA-CVA or, subject to approval, the SA-CVA. 1.4.2 An AI whose aggregate notional amount of non-centrally cleared derivatives is less than or equal to HKD 1tn, instead of using the BA-CVA or the SA-CVA, may choose to set its CVA risk capital charge as 100% of the AI’s capital charge for counterparty credit risk. 7 However, the HKMA may remove this option if it is determined that the CVA risk resulting from the AI’s covered positions materially contributes to the AI’s overall risk. 1.4.3 An AI that has obtained the HKMA approval for the use of the SA-CVA may carve out any netting set from the use of the SA-CVA and calculate the CVA risk capital charge for such carved-out netting sets by using the BA￾CVA. When applying the carve-out, a legal netting set may also be split into two synthetic netting sets, i.e. one containing the carved-out transactions which is subject 7 Under this alternative treatment, CVA hedges are not recognised.

7 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 to the BA-CVA and the other one subject to the SA-CVA if at least one of the following two conditions is met.  The split is consistent with the treatment of the legal netting set used by the AI for calculating the accounting CVA (e.g. where certain transactions are not processed by the front office / accounting exposure model).  The HKMA approval to use the SA-CVA is limited and does not cover all transactions within a legal netting set. 1.4.4 AIs that use the BA-CVA or the SA-CVA may cap the maturity adjustment factor at 1 for all netting sets contributing to the CVA risk capital charge when they calculate the counterparty credit risk capital charge under the Internal Ratings Based (IRB) Approach. 1.5 Implementation 1.5.1 Version 2 of this module takes effect on the same date as the commencement date of the Banking (Capital) (Amendment) Rules 2025 (i.e. 1 January 2026). 2. BA-CVA 2.1 General 2.1.1 An AI using the BA-CVA may, at its discretion, choose to implement either the reduced version (“reduced BA￾CVA”) or the full version of the BA-CVA (“full BA-CVA”). 8 Independent of which version the AI chooses, it should calculate and report the CVA risk capital charges to the HKMA on a monthly basis. 2.1.2 The full BA-CVA recognises the counterparty spread hedges and is intended for AIs that hedge their CVA risk. 2.1.3 The reduced BA-CVA eliminates the element of hedging recognition from the full BA-CVA and is intended for AIs 8 AIs using the full BA-CVA must also calculate the reduced BA-CVA capital charge as the reduced BA￾CVA is also part of the full BA-CVA capital calculations which limits hedging recognition.

8 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 that do not hedge their CVA risk or prefer a simpler approach. 2.2 Reduced BA-CVA 2.2.1 The CVA risk capital charge under the reduced BA-CVA (𝐵𝐴_𝐶𝑉𝐴𝑟𝑒𝑑𝑢𝑐𝑒𝑑 ) is calculated based on the following formula. 9 The first term under the square root aggregates the systematic components of CVA risk, and the second one aggregates the idiosyncratic components of CVA risk. 𝐵𝐴_𝐶𝑉𝐴𝑟𝑒𝑑𝑢𝑐𝑒𝑑 = 𝐷𝑆 ∙ √(𝜌 ∙ ∑𝑆𝐶𝑉𝐴𝑐 𝑐 ) 2

• (1 − 𝜌

2. ∙ ∑𝑆𝐶𝑉𝐴𝑐 2 𝑐 where  SCVAc is the standalone CVA risk capital charge for counterparty c, i.e. the CVA risk capital charge that counterparty c would receive on a standalone basis and is calculated as set out in paragraph 2.2.2;  DS is the discount scalar which is equal to 0.65; and  𝜌 is the supervisory correlation parameter which is equal to 0.5. Its square, i.e. 𝜌 2 = 0.25, represents the correlation between credit spreads of any two counterparties. Its effect is to recognise the fact that the CVA risk an AI is exposed to is smaller than the sum of the CVA risk for each counterparty, given that the credit spreads of counterparties are typically not perfectly correlated. 2.2.2 The standalone CVA risk capital charge for counterparty c is calculated based on the following formula (where the summation is across all netting sets with the counterparty). 9 The second term √(𝜌 ∙ ∑𝑐 𝑆𝐶𝑉𝐴𝑐 ) 2 + (1 − 𝜌
3. ∙ ∑ 𝑆𝐶𝑉𝐴𝑐 2 𝑐 in the formula represents 𝐾𝑟𝑒𝑑𝑢𝑐𝑒𝑑 defined in MAR50.14 of the BCBS consolidated framework.

9 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 𝑆𝐶𝑉𝐴𝑐 = 1 𝛼 ∙ 𝑅𝑊𝑐 ∙ ∑𝑀𝑁 𝑁 ∙ 𝐸𝐴𝐷𝑁 ∙ 𝐷𝐹𝑁 where  RWc is the risk weight for counterparty c that reflects the volatility of its credit spread and is set out in paragraph 2.2.3;  MN is the effective maturity for the netting set N. For AIs with the HKMA approval for the use of the internal models (counterparty credit risk) approach (“IMM(CCR) approach”), MN is calculated in accordance with section 168(1)(ba) of the Rules, with the exception that the five-year cap in section 168(2) of the Rules is not applied. Otherwise, MN is calculated in accordance with other subsections of section 168 of the Rules, with the exception that the five-year cap in section 168(2) of the Rules is not applied;  EADN is the exposure at default (“EAD”) of the netting set N which is calculated in the same way under the counterparty credit risk capital requirements;  DFN is the supervisory discount factor, which is equal to 1 for AIs with an HKMA approval for the use of the IMM(CCR) approach and 1−𝑒 −0.05∙𝑀𝑁 0.05∙𝑀𝑁 otherwise; and  α is the multiplier used to convert effective expected positive exposure (“EEPE”) to EAD in both the standardised approach for measuring CCR exposures (“SA-CCR approach”) and the IMM(CCR) approach, which is equal to 1.4. 2.2.3 The risk weights (RWc), which are based on the sector and credit quality of the counterparty, are set out in the following table. To assign a risk exposure to a credit quality based on the ECAI issuer ratings:  where there are two ECAI issuer ratings that map into different risk weights, the higher risk weight should be applied;

10 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025  where there are three or more ECAI issuer ratings, the two ratings that correspond to the lowest risk weights should be referred to. If these give rise to the same risk weight, that risk weight should be applied. If different, the higher of the two risk weights should be applied; and  where there is no ECAI issuer rating, AIs that use the IRB approach to calculate their credit risk may, subject to an HKMA approval, map the internal rating to a corresponding external rating. Otherwise, the risk weights for unrated counterparties should be applied. Credit quality Sector of counterparty Investment grade10 Non-investment grade or unrated Sovereigns including central banks and multilateral development banks 0.5% 2.0% Local government, government-backed non-financials, education and public administration 1.0% 4.0% Financials including government-backed financials 5.0% 12.0% Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 3.0% 7.0% Consumer goods and services, transportation and storage, administrative and support service activities 3.0% 8.5% Technology and telecommunications 2.0% 5.5% Health care, utilities, professional and technical activities 1.5% 5.0% Other sector 5.0% 12.0% 2.3 Full BA-CVA 2.3.1 The full BA-CVA recognises the effect of counterparty credit spread hedges. Only transactions used for the purpose of mitigating the counterparty credit spread component of CVA risk, and managed as such, can be 10 Unless otherwise specified, “investment grade” has the same meaning as specified in section 281 of the Rules.

11 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 eligible CVA hedges. An eligible CVA hedge should also fulfil the conditions below.  The hedging instrument is either a single-name credit default swap (“CDS”), a single-name contingent CDS or an index CDS.  In the case of single-name credit instruments, it must reference (i) the counterparty directly; (ii) an entity legally related to the counterparty where legally related refers to cases where the reference name and the counterparty are either a parent and its subsidiary or two subsidiaries of a common parent; or (iii) an entity that belongs to the same sector and region as the counterparty. 2.3.2 The CVA risk capital charge under the full BA-CVA (𝐵𝐴_𝐶𝑉𝐴𝑓𝑢𝑙𝑙) is calculated as follows: 𝐵𝐴_𝐶𝑉𝐴𝑓𝑢𝑙𝑙 = 𝛽 ∙ 𝐵𝐴_𝐶𝑉𝐴𝑟𝑒𝑑𝑢𝑐𝑒𝑑 + (1 − 𝛽) ∙ 𝐵𝐴_𝐶𝑉𝐴ℎ𝑒𝑑𝑔𝑒𝑑 where  𝐵𝐴_𝐶𝑉𝐴𝑟𝑒𝑑𝑢𝑐𝑒𝑑 is the CVA risk capital charge under the reduced BA-CVA as set out in paragraph 2.2.1;  𝐵𝐴_𝐶𝑉𝐴ℎ𝑒𝑑𝑔𝑒𝑑 is the CVA risk capital charge that recognises eligible hedges and is calculated as set out in paragraph 2.3.3; and  𝛽 is a supervisory parameter that provides a floor to limit the impact of eligible hedges on the overall CVA risk capital charge under the BA-CVA which is equal to 0.25. 2.3.3 The CVA risk capital charge that recognises eligible hedges ( 𝐵𝐴_𝐶𝑉𝐴ℎ𝑒𝑑𝑔𝑒𝑑 ) is calculated based on the following formula.11 It comprises three main terms under the square root: (i) the first term aggregates the systematic components of CVA risk arising from the AI’s counterparties, the single-name hedges and the index hedges; (ii) the second term aggregates the idiosyncratic components of CVA risk arising from the AI’s 11 The second term √(𝜌 ∙ ∑ (𝑆𝐶𝑉𝐴𝑐 − 𝑆𝑁𝐻𝑐 𝑐 ) − 𝐼𝐻) 2 + (1 − 𝜌 2) ∙ ∑ (𝑆𝐶𝑉𝐴𝑐 − 𝑆𝑁𝐻𝑐 ) 𝑐 2 + ∑𝑐 𝐻𝑀𝐴𝑐 in the formula represents 𝐾ℎ𝑒𝑑𝑔𝑒𝑑 defined in MAR50.21 of the BCBS consolidated framework.

12 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 counterparties and the single-name hedges; and (iii) the third term aggregates the components of indirect hedges that are not aligned with counterparties’ credit spreads. 𝐵𝐴_𝐶𝑉𝐴ℎ𝑒𝑑𝑔𝑒𝑑 = 𝐷𝑆 ∙ √(𝜌 ∙∑(𝑆𝐶𝑉𝐴𝑐 − 𝑆𝑁𝐻𝑐 ) − 𝐼𝐻 𝑐 ) 2

• (1 − 𝜌

2. ∙∑(𝑆𝐶𝑉𝐴𝑐 − 𝑆𝑁𝐻𝑐 ) 2 + ∑𝐻𝑀𝐴𝑐 where  SCVAc is the standalone CVA risk capital charge for counterparty c as set out in paragraph 2.2.2;  DS is the discount scalar which is equal to 0.65;  𝜌 is the supervisory correlation parameter which is equal to 0.5;  SNHc is a quantity that gives recognition to the reduction in CVA risk of the counterparty c arising from an AI’s use of single-name hedges of credit spread risk as set out in paragraph 2.3.4;  IH is a quantity that gives recognition to the reduction in CVA risk across all counterparties arising from the AI’s use of index hedges as set out in paragraph 2.3.5; and  HMAc is a quantity that characterises the hedging misalignment, which limits the extent to which indirect hedges can reduce the CVA risk capital charge given that they will not fully offset movements in a counterparty’s credit spread. The calculation is set out in paragraph 2.3.6. 2.3.4 The quantity SNHc is calculated based on the following formula (where the summation is across all single name hedges h that an AI has taken out to hedge the CVA risk of counterparty c). 𝑆𝑁𝐻𝑐 = ∑𝑟ℎ𝑐 ∙ 𝑅𝑊ℎ ∙ 𝑀ℎ 𝑆𝑁 ∙ 𝐵ℎ 𝑆𝑁 ∙ 𝐷𝐹ℎ 𝑆𝑁 ℎ∈𝑐 where  𝑟ℎ𝑐 is the supervisory prescribed correlation between the credit spread of counterparty c and the

13 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 credit spread of a single-name hedge h of counterparty c. The value of 𝑟ℎ𝑐 is set at: – 100% if the hedge h directly references the counterparty c; – 80% if the hedge h has legal relation with counterparty c; or – 50% if the hedge h shares the same sector and region with counterparty c;  𝑀ℎ 𝑆𝑁 is the remaining maturity of single-name hedge h, expressed in years;  𝐵ℎ 𝑆𝑁 is the notional amount of the single-name hedge h. For single-name contingent CDS, the notional is determined by the current market value of the reference portfolio or instrument;  𝐷𝐹ℎ 𝑆𝑁 is the supervisory discount factor calculated as 1−𝑒 −0.05∙𝑀ℎ 𝑆𝑁 0.05∙𝑀ℎ 𝑆𝑁 ; and  𝑅𝑊ℎ is the supervisory risk weight of single-name hedge h that reflects the volatility of the credit spread of the reference name of the hedging instrument. These risk weights are based on a combination of the sector and the credit quality of the reference name of the hedging instrument as prescribed in paragraph 2.2.3. 2.3.5 The quantity IH is calculated as follows (where the summation is across all index hedges i that an AI has taken out to hedge CVA risk): 𝐼𝐻 = ∑𝑅𝑊𝑖 ∙ 𝑖 𝑀𝑖 𝑖𝑛𝑑 ∙ 𝐵𝑖 𝑖𝑛𝑑 ∙ 𝐷𝐹𝑖 𝑖𝑛𝑑 where  𝑀𝑖 𝑖𝑛𝑑 is the remaining maturity of index hedge i, expressed in years;  𝐵𝑖 𝑖𝑛𝑑 is the notional amount of the index hedge i;  𝐷𝐹𝑖 𝑖𝑛𝑑 is the supervisory discount factor calculated

14 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 as 1−𝑒 −0.05∙𝑀𝑖 𝑖𝑛𝑑 0.05∙𝑀𝑖 𝑖𝑛𝑑 ; and  RWi is the supervisory risk weight of the index hedge i. RWi is taken from the table in paragraph 2.2.3 based on the sector and the credit quality of the index constituents and adjusted as follows: – for an index where all index constituents belong to the same sector and are of the same credit quality, the relevant value in the table in paragraph 2.2.3 is multiplied by 0.7 to account for diversification of idiosyncratic risk within the index; or – for an index spanning multiple sectors or with a mixture of investment grade constituents and other grade constituents, the name-weighted average of the risk weights from the table in paragraph 2.2.3 should be calculated and then multiplied by 0.7. 2.3.6 The quantity HMAC is calculated as follows (where the summation is across all single name hedges h that have been taken out to hedge the CVA risk of counterparty c): 𝐻𝑀𝐴𝑐 = ∑(1 − 𝑟ℎ𝑐 2 ) ∙ (𝑅𝑊ℎ ∙ 𝑀ℎ 𝑆𝑁 ∙ 𝐵ℎ 𝑆𝑁 ∙ 𝐷𝐹ℎ 𝑆𝑁) 2 ℎ∈𝑐 where 𝑟ℎ𝑐 , 𝑅𝑊ℎ , 𝑀ℎ 𝑆𝑁 , 𝐵ℎ 𝑆𝑁 and 𝐷𝐹ℎ 𝑆𝑁 have the same definitions as set out in paragraph 2.3.4. 3. SA-CVA 3.1 General criteria 3.1.1 The use of the SA-CVA requires an explicit approval from the HKMA. An AI should calculate and report the CVA risk capital charges under the SA-CVA to the HKMA on a monthly basis. 3.1.2 An AI should also be able to determine its regulatory capital charges according to the SA-CVA at any time at the demand of the HKMA.

15 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 3.1.3 The SA-CVA is an adaptation of the standardised (market risk) approach (see section 3 of MR-1 “Market Risk Capital Charge”), with the following major differences:  The SA-CVA features a reduced granularity of market risk factors.  The SA-CVA does not include default risk and curvature risk. 3.1.4 The SA-CVA uses as inputs the sensitivities of regulatory CVA to (i) counterparty credit spreads and (ii) market risk factors driving the fair values of covered transactions. In calculating the sensitivities, AIs should fulfil the requirements in section 4A of the Rules and CA-S-10 “Financial Instrument Fair Value Practices”. 3.1.5 An AI should meet the following criteria at the minimum to qualify for the use of the SA-CVA:  The AI should be able to model exposure and calculate, on at least a monthly basis, CVA and CVA sensitivities to the market risk factors specified in subsection 3.4.  The AI should have a CVA desk (or a similar dedicated function) responsible for risk management and hedging of CVA. 3.1.6 Only transactions used for the purpose of mitigating the CVA risk, and managed as such, can be eligible CVA hedges. An eligible CVA hedge should also fulfil the conditions below:  Transactions must not be split into several effective transactions.  The hedging instrument should hedge the variability of either the counterparty credit spread or the exposure component of the CVA risk.  Instruments that are not eligible for the Internal Models Approach under the market risk framework as set out in MR-1 “Market Risk Capital Charge” should not be considered as eligible hedges.

16 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 3.1.7 The aggregate capital charge calculated under the SA￾CVA can be scaled up by a multiplier mCVA. The basic level of mCVA is set at 1. However, the HKMA may require an AI to use a higher level of mCVA, taking into account the level of model risk for the calculation of the CVA sensitivities (e.g. if the level of model risk for the calculation of CVA sensitivities is too high or the dependence between the AI’s exposure to a counterparty and the counterparty’s credit quality is not appropriately taken into account in its CVA calculations). 3.2 Regulatory CVA calculations Quantitative standards 3.2.1 An AI should calculate the regulatory CVA for each counterparty with which it has at least one covered position for the purpose of the CVA risk capital charge. 3.2.2 An AI should calculate the regulatory CVA as the expectation of future losses resulting from default of the counterparty under the assumption that the AI itself is free from default risk. In expressing the regulatory CVA, non-zero losses must have a positive sign. This is reflected in paragraph 3.3.12 where 𝑊𝑆𝑘 ℎ𝑑𝑔 must be subtracted from 𝑊𝑆𝑘 𝐶𝑉𝐴 . 3.2.3 An AI should calculate the regulatory CVA based on at least the three sets of inputs below:  term structure of market-implied probability of default (“PD”);  market-consensus expected loss-given-default (“ELGD”); and  simulated paths of discounted future exposure. 3.2.4 An AI should estimate the term structure of market￾implied PD from credit spreads observed in the markets. For counterparties whose credit is not actively traded (i.e. illiquid counterparties), the AI should estimate the market-implied PD from proxy credit spreads estimated for these counterparties in accordance with paragraphs 3.2.5 to 3.2.7.

17 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 3.2.5 An AI should estimate the credit spread curves of illiquid counterparties from credit spreads observed in the markets of the counterparty’s liquid peers via an algorithm that discriminates on at least the following three variables: a measure of credit quality (e.g. rating), industry, and region. 3.2.6 In certain cases, mapping an illiquid counterparty to a single liquid reference name can be allowed. A typical example would be mapping a municipality to its home country (i.e. setting the municipality credit spread equal to the sovereign credit spread plus a premium). An AI should justify to the HKMA each case of mapping an illiquid counterparty to a single liquid reference name. 3.2.7 When no credit spreads of any of the counterparty’s peers are available due to the counterparty’s specific type (e.g. project finance or funds), an AI may be allowed to use a more fundamental analysis of credit risk to proxy the spread of an illiquid counterparty. However, where historical PDs are used as part of this assessment, the resulting spread cannot be based on historical PDs only – it must relate to credit markets. 3.2.8 An AI should use the same market-consensus ELGD value to calculate the risk-neutral PD from credit spreads unless the AI can demonstrate that the seniority of the exposure resulting from covered positions differs from the seniority of senior unsecured bonds. Collateral provided by the counterparty does not change the seniority of the exposure. 3.2.9 An AI should produce the simulated paths of discounted future exposure by pricing all derivative transactions with the counterparty along simulated paths of relevant market risk factors and discounting the prices back to the reporting date using risk-free interest rates along the path. 3.2.10 An AI should simulate all market risk factors material for the transactions with a counterparty as stochastic processes for an appropriate number of paths defined on an appropriate set of future time points extending to the maturity of the longest transaction.

18 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 3.2.11 An AI should take into account any significant level of dependence between exposure and the counterparty’s credit quality in the regulatory CVA calculations. 3.2.12 For margined counterparties, an AI is permitted to recognise collateral as a risk mitigant under the following conditions:  Collateral management requirements outlined in section 1(e) of Schedule 2A of the Rules are satisfied.  All documentation used in collateralised transactions should be binding on all parties and legally enforceable in all relevant jurisdictions. The AI should have conducted sufficient legal review to verify this and have a well-founded legal basis to reach this conclusion, and undertake such further review as necessary to ensure continuing enforceability. 3.2.13 For margined counterparties, an AI should capture the effects of margining collateral that is recognised as a risk mitigant along each simulated path of discounted future exposure. The AI should appropriately capture all the relevant contractual features such as the nature of the margin agreement (unilateral vs. bilateral), the frequency of margin calls, the type of collateral, thresholds, independent amounts, initial margins and minimum transfer amounts in the exposure model. To determine collateral available to the AI at a given exposure measurement time point, the AI also should assume in the exposure model that the counterparty will not post or return any collateral within a certain time period immediately prior to that time point. The assumed value of this time period, known as the margin period of risk (“MPoR”), cannot be less than a supervisory floor as set out in paragraph 3.2.14. 3.2.14 For SFTs and client cleared transactions as specified in section 226Z of the Rules, the supervisory floor for the MPoR is equal to 4+N business days, where N is the re￾margining period specified in the margin agreement (in particular, for margin agreements with daily or intra-daily exchange of margin, the minimum MPoR is 5 business

19 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 days). For all other transactions, the supervisory floor for the MPoR is equal to 9+N business days. 3.2.15 An AI should obtain the simulated paths of discounted future exposure via the exposure models used for calculating the front office or accounting CVA, with adjustments if needed, to meet the requirements imposed for regulatory CVA calculation. The model calibration process (with the exception of the MPoR) of the regulatory CVA calculation should be the same as that of the accounting CVA calculation. The market data and transaction data used for regulatory CVA calculation and accounting CVA calculation should also be the same. 3.2.16 In generating the paths of market risk factors underlying the exposure models, an AI should demonstrate to the HKMA its compliance with the following requirements:  Drifts of risk factors should be consistent with a risk￾neutral probability measure. Historical calibration of drifts is not allowed.  The volatilities and correlations of market risk factors should be calibrated to market data whenever sufficient data exist in a given market. Otherwise, historical calibration is permissible.  The distribution of modelled risk factors should account for the possible non-normality of the distribution of exposures, including the existence of leptokurtosis, where appropriate. 3.2.17 An AI should apply the same netting recognition as in its accounting CVA calculations. In particular, the AI can model the netting uncertainty. Qualitative standards 3.2.18 An AI should meet the qualitative criteria set out below on an ongoing basis. The HKMA should be satisfied that the AI has met the qualitative criteria before granting an SA-CVA approval. 3.2.19 Exposure models used for calculating regulatory CVA should be part of a CVA risk management framework that includes the identification, measurement,

20 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 management, approval and internal reporting of CVA risk. An AI should have a credible track record in using these exposure models for calculating CVA and CVA sensitivities to market risk factors. 3.2.20 Senior management should be actively involved in the risk control process and regard CVA risk control as an essential aspect of the business to which significant resources need to be devoted. 3.2.21 An AI should have a process in place for ensuring compliance with a documented set of internal policies, controls and procedures concerning the operation of the exposure system used for accounting CVA calculations. 3.2.22 An AI should have an independent control unit that is responsible for the effective initial and ongoing validation of the exposure models. This unit should be independent from business credit and trading units (including the CVA desk), be adequately staffed and report directly to senior management of the AI. 3.2.23 An AI should document the process for initial and ongoing validation of its exposure models to a level of detail that would enable a third party to understand how the models operate, their limitations, and their key assumptions; and recreate the analysis. This documentation should set out the minimum frequency with which ongoing validation will be conducted as well as other circumstances (such as a sudden change in market behaviour) under which additional validation should be conducted. In addition, the documentation should describe how the validation is conducted with respect to data flows and portfolios, what analyses are used and how representative counterparty portfolios are constructed. 3.2.24 The pricing models used to calculate exposure for a given path of market risk factors should be tested against appropriate independent benchmarks for a wide range of market states as part of the initial and ongoing model validation process. Pricing models for options should account for the non-linearity of option value with respect to market risk factors.

21 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 3.2.25 An AI should carry out an independent review of the overall CVA risk management process regularly in its internal auditing process. This review should include both the activities of the CVA desk and of the independent risk control unit. 3.2.26 An AI should define criteria on which to assess the exposure models and their inputs and have a written policy in place to describe the process to assess the performance of exposure models and remedy unacceptable performance. 3.2.27 Exposure models should capture transaction-specific information in order to aggregate exposures at the level of the netting set. An AI should verify that transactions are assigned to the appropriate netting set within the model. 3.2.28 Exposure models should reflect transaction terms and specifications in a timely, complete, and conservative fashion. The terms and specifications should reside in a secure database that is subject to formal and periodic audit. The transmission of transaction terms and specifications data to the exposure model should also be subject to internal audit, and formal reconciliation processes should be in place between the internal model and source data systems to verify on an ongoing basis that transaction terms and specifications are being reflected in the exposure system correctly or at least conservatively. 3.2.29 The current and historical market data should be acquired independently of the lines of business and be compliant with accounting. They should be fed into the exposure models in a timely and complete fashion, and maintained in a secure database subject to formal and periodic audit. An AI should also have a well-developed data integrity process to handle the data of erroneous and/or anomalous observations. In the case where an exposure model relies on proxy market data, an AI should set internal policies to identify suitable proxies and the AI should demonstrate empirically on an ongoing basis that the proxy provides a conservative representation of the underlying risk under adverse market conditions.

22 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 3.3 Components of SA-CVA 3.3.1 The SA-CVA capital charge is calculated as the sum of the capital charges for delta and vega risks calculated for the entire CVA portfolio (including eligible hedges). 3.3.2 The capital charge for delta risk is calculated as the simple sum of delta risk capital charges calculated independently for the following six risk classes:  interest rate risk;  foreign exchange (“FX”) risk;  counterparty credit spread risk;  reference credit spread risk (i.e. credit spreads that drive the CVA exposure component);  equity risk; and  commodity risk. 3.3.3 If an instrument is deemed as an eligible hedge for credit spread delta risk under paragraph 3.1.6, an AI should assign it entirely either to the counterparty credit spread or to the reference credit spread risk class. The AI should not split the instrument between the two risk classes. 3.3.4 The capital charge for vega risk is calculated as the simple sum of vega risk capital charges calculated independently for five of the six risk classes as set out in paragraph 3.3.2. There is no vega risk capital charge for counterparty credit spread risk. 3.3.5 The capital charges for delta and vega risks are calculated in the same manner using the same procedures set out in paragraphs 3.3.6 to 3.3.12. 3.3.6 For each risk class, (i) the sensitivity of the aggregate CVA, 𝑠𝑘 𝐶𝑉𝐴, and (ii) the sensitivity of the market value of all eligible hedging instruments in the CVA portfolio, 𝑠𝑘 𝐻𝑑𝑔 , to each risk factor k in the risk class are calculated. The sensitivities are defined as the ratio of the change in the (i) aggregate CVA or (ii) market value of all CVA hedges caused by a small change of the risk factor’s current value to the size of the change. Specific definitions for

23 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 each risk class are set out in subsections 3.4 to 3.6. These definitions include specific values of changes or shifts in risk factors. However, an AI may use smaller values of risk factor shifts if doing so is consistent with internal risk management calculations. 3.3.7 An AI should calculate CVA sensitivities for vega risk regardless of whether or not the portfolio includes options. When calculating those CVA sensitivities, the AI should apply the volatility shift to both types of volatilities that appear in exposure models:  volatilities used for generating risk factor paths; and  volatilities used for pricing options. 3.3.8 If a hedging instrument is an index, an AI should calculate the sensitivities to all risk factors upon which the value of the index depends. The index sensitivity to risk factor k is calculated by applying the shift of risk factor k to all index constituents that depend on this risk factor and recalculating the changed value of the index. For example, to calculate delta sensitivity of the Hang Seng Index to large12 financial companies, an AI should apply the relevant shift to equity prices of all large financial companies that are constituents of the Hang Seng Index and re-compute the index. 3.3.9 An AI may choose to introduce a set of additional risk factors that directly correspond to qualified credit and equity indices for the following risk classes:  counterparty credit spread risk;  reference credit spread risk; and  equity risk. 3.3.10 For delta risk, a credit or equity index is qualified if it satisfies liquidity and diversification conditions specified in paragraph 3.3.48 of MR-1 “Market Risk Capital Charge”; and for vega risks, any credit or equity index is qualified. 3.3.11 For a covered transaction or an eligible hedging 12 Please refer to paragraph 3.5.26 for the definition of large market capitalisation.

24 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 instrument whose underlying is a qualified index, an AI may replace its contribution to sensitivities to the index constituents with its contribution to a single sensitivity to the underlying index. For example, for a portfolio consisting only of equity derivatives referencing only qualified equity indices, the AI may not need to calculate the CVA sensitivities to non-index equity risk factors. If more than 75% of constituents of a qualified index (taking into account the weightings of the constituents) are mapped to the same sector, the entire index must be mapped to that sector and treated as a single-name sensitivity in that bucket. In all other cases, the sensitivity must be mapped to the applicable index bucket. 3.3.12 For each risk class, an AI should determine the sensitivities 𝑠𝑘 𝐶𝑉𝐴 and 𝑠𝑘 𝐻𝑑𝑔 to a set of prescribed risk factors, risk-weight those sensitivities, and aggregate the resulting net risk-weighted sensitivities separately for delta and vega risk using the following step-by-step approach. Step 1: For each risk factor k, the sensitivities 𝑠𝑘 𝐶𝑉𝐴 and 𝑠𝑘 𝐻𝑑𝑔 are determined as set out in paragraph 3.3.6. The weighted sensitivities 𝑊𝑆𝑘 𝐶𝑉𝐴 and 𝑊𝑆𝑘 𝐻𝑑𝑔 are calculated by multiplying the net sensitivities 𝑠𝑘 𝐶𝑉𝐴 and 𝑠𝑘 𝐻𝑑𝑔 , respectively, by the corresponding risk weight RWk as set out in subsections 3.5 and 3.6. Step 2: The net weighted sensitivity of the CVA portfolio 𝑊𝑆𝑘 to risk factor k is obtained by13: 𝑊𝑆𝑘 = 𝑊𝑆𝑘 𝐶𝑉𝐴 − 𝑊𝑆𝑘 𝐻𝑑𝑔 Step 3: The net weighted sensitivities should be aggregated into a capital charge Kb within each bucket b as set out in the formula below: 𝐾𝑏 = √(∑𝑊𝑆𝑘 2 + 𝑘∈𝑏 ∑ ∑ 𝜌𝑘𝑙 ∙ 𝑊𝑆𝑘 ∙ 𝑊𝑆𝑙 𝑘∈𝑏 𝑙∈𝑏,𝑙≠𝑘 )+ 𝑅 ∙ ∑(𝑊𝑆𝑘 𝐻𝑑𝑔) 2 𝑘𝜖𝑏 13 Note that the formula is set out under the convention that the CVA is positive as specified in paragraph 3.2.2.

25 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 where:  the buckets and correlation parameters 𝜌𝑘𝑙 applicable to each risk class are specified in subsections 3.5 and 3.6; and  R is the hedging disallowance parameter, set at 0.01, that prevents the possibility of recognising perfect hedging of CVA risk. Step 4: Bucket-level capital charges should then be aggregated across buckets within each risk class as set out in the formula below: 𝐾 = 𝑚𝐶𝑉𝐴 ∙ √∑𝐾𝑏 2 + ∑∑𝛾𝑏𝑐 ∙ 𝑠𝑏 ∙ 𝑠𝑐 𝑏 𝑏 𝑐≠𝑏 where:  the correlation parameters 𝛾𝑏𝑐 applicable to each risk class are specified in subsections 3.5 and 3.6;  𝑚𝐶𝑉𝐴 is the multiplier as set out in paragraph 3.1.7; and  𝑠𝑏 is the sum of the weighted sensitivities WSk for all risk factors k within bucket b, floored by –Kb and capped by Kb, and 𝑠𝑐 is defined in the same way for all risk factors k in bucket c: 𝑆𝑏 = 𝑚𝑎𝑥 {−𝐾𝑏; 𝑚𝑖𝑛 (∑𝑊𝑆𝑘;𝐾𝑏 𝑘∈𝑏 )} 𝑆𝑐 = 𝑚𝑎𝑥 {−𝐾𝑐 ; 𝑚𝑖𝑛 (∑𝑊𝑆𝑘;𝐾𝑐 𝑘∈𝑐 )} 3.4 SA-CVA: risk factor and sensitivity definitions Risk factor definitions Interest rate risk 3.4.1 For AUD, CAD, EUR, GBP, HKD, JPY, SEK and USD, the interest rate delta risk factors are the risk-free yields for a given currency, further defined along the following tenors: 1 year, 2 years, 5 years, 10 years and 30 years.

26 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 For the calculation of the sensitivities, a given tenor for all risk-free yield curves in a given currency is to be shifted by 1 basis point. 3.4.2 For currencies not specified in paragraph 3.4.1, the interest rate delta risk factors are the risk-free yields without term structure decomposition for a given currency. For the calculation of the sensitivities, all risk￾free yield curves for a given currency are to be shifted in parallel by 1 basis point. 3.4.3 The interest rate delta risk factors also include a flat curve of inflation rate for each currency. Its term structure does not represent a risk factor. 3.4.4 The interest rate vega risk factors are a simultaneous relative change of all interest rate volatilities for a given currency and a simultaneous relative change of all volatilities for an inflation rate. Foreign exchange risk 3.4.5 The foreign exchange delta risk factors are the exchange rates between the currency in which an instrument is denominated and the reporting currency (i.e. HKD). For transactions that reference an exchange rate between a pair of non-reporting currencies, the foreign exchange delta risk factors are all the exchange rates between (i) HKD and (ii) both the currency in which an instrument is denominated and any other currencies referenced by the instrument.14 The exchange rate is the current market price of one unit of another currency expressed in the units of HKD. 3.4.6 The single foreign exchange vega risk factor is a simultaneous relative change of all volatilities for a given exchange rate between HKD and another currency. Counterparty credit spread risk 3.4.7 The counterparty credit spread delta risk factors are the relevant credit spreads for individual entities (counterparties and reference names for counterparty 14 For example, for an FX forward referencing EUR/JPY, the relevant risk factors for an AI to consider are the exchange rates EUR/HKD and JPY/HKD.

27 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 credit spread hedges) and qualified indices as set out in paragraphs 3.3.10 and 3.3.11, further defined along the following tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. 3.4.8 The counterparty credit risk is not subject to the vega risk capital charge. Reference credit spread risk 3.4.9 The reference credit spread delta risk factors are the relevant credit spreads without term structure decomposition for all reference names within the same bucket. For the calculation of the sensitivities, credit spreads of all tenors for all reference names in the bucket are to be shifted by 1 basis point. 3.4.10 A reference credit spread vega risk factor is a simultaneous relative change of the volatilities of credit spreads of all tenors for all reference names within the same bucket. Equity risk 3.4.11 The equity delta risk factors are the equity spot prices for all reference names within the same bucket. For the calculation of the sensitivities, equity spot prices for all reference names in the bucket are to be shifted by 1% relative to their current values. 3.4.12 An equity vega risk factor is a simultaneous relative change of the volatilities for all reference names within the same bucket. Commodity risk 3.4.13 The commodity delta risk factors are all the spot prices for all commodities within the same bucket. For the calculation of the sensitivities, spot prices for all commodities in the bucket are to be shifted by 1% relative to their current values. 3.4.14 A commodity vega risk factor is a simultaneous relative change of the volatilities for all commodities within the same bucket.

28 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 Sensitivity definitions 3.4.15 An AI should use the prescribed formulations as set in paragraphs 3.4.19 to 3.4.21 to calculate the sensitivities for each risk class, respectively. It may make use of alternative formulations to calculate sensitivities in terms of HKD based on internal risk management models. 3.4.16 If an AI makes use of alternative formulations of sensitivities, it should demonstrate to the satisfaction of the HKMA that the alternative formulations adopted are conceptually sound and yield results very close to the prescribed formulations under paragraphs 3.4.19 to 3.4.21. The assessment of the alternative formulations should also be included in the model validation process.15 3.4.17 An AI should calculate sensitivities for each risk class in terms of HKD. 3.4.18 For each risk factor defined in paragraphs 3.4.1 to 3.4.14, sensitivities are calculated as the change in the aggregate CVA of the instrument (or market value of the CVA hedge) as a result of applying a specified shift to each risk factor, assuming all the other relevant risk factors are held at the current level. Delta risk sensitivities 3.4.19 An AI should calculate the delta risk sensitivities of (i) interest rate, (ii) counterparty credit spread, (iii) reference credit spread in accordance with the following formula: 𝑠𝑘 = 𝐶𝑉𝐴(𝑅𝐹𝑘 + 0.0001) − 𝐶𝑉𝐴(𝑅𝐹𝑘 ) 0.0001 where:  𝑠𝑘 is the delta sensitivity of risk factor k;  𝑅𝐹𝑘 is the risk factor k; and 15 An AI may use adjoint algorithmic differentiation (AAD) and similar computational techniques to calculate CVA sensitivities under the SA-CVA if doing so is consistent with its internal risk management calculations and the relevant validation standards described in subsection 3.2 and this subsection.

29 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025  CVA(RFk) is the aggregate CVA (or the market value of the CVA hedges) as a function of the risk factor RFk. 3.4.20 An AI should calculate the delta risk sensitivities of (i) equity, (ii) commodity and (iii) foreign exchange risk factors in accordance with the following formula: 𝑠𝑘 = 𝐶𝑉𝐴(1.01𝑅𝐹𝑘 ) − 𝐶𝑉𝐴(𝑅𝐹𝑘 ) 0.01 Vega risk sensitivities 3.4.21 An AI should calculate the vega risk sensitivities of (i) interest rate, (ii) foreign exchange, (iii) reference credit spread, (iv) equity and (v) commodity risk factors in accordance with the following formula: 𝑣𝑘 = 𝐶𝑉𝐴(1.01𝑅𝐹𝑘 ) − 𝐶𝑉𝐴(𝑅𝐹𝑘 ) 0.01 where 𝑣𝑘 is the vega sensitivity of risk factor k. 3.5 SA-CVA: delta risk weights and correlations 3.5.1 An AI should calculate the risk-weighted sensitivities in accordance with the prescribed risk weights and correlations in this section. Interest rate risk 3.5.2 Each bucket represents an individual currency exposure to the interest rate risk. 3.5.3 For currencies specified in paragraph 3.4.1, the risk weights are set as follows: Risk factor 1 year 2 years 5 years 10 years 30 years Inflation Risk weight 1.11% 0.93% 0.74% 0.74% 0.74% 1.11% 3.5.4 For currencies not specified in paragraph 3.4.1, a risk weight of 1.58% is set for all the risk factors, including the inflation rate. 3.5.5 For aggregating the weighted sensitivities within a bucket which is a specified currency in paragraph 3.4.1, the correlation parameters kl are set in the following

30 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 table. Interest rate risk correlations (kl) within the same bucket for specified currencies 1 year 2 years 5 years 10 years 30 years Inflation 1 year 100% 91% 72% 55% 31% 40% 2 years 100% 87% 72% 45% 40% 5 years 100% 91% 68% 40% 10 years 100% 83% 40% 30 years 100% 40% Inflation 100% 3.5.6 For aggregating the weighted sensitivities within a bucket which is not a specified currency in paragraph 3.4.1, the correlation parameter kl between the risk-free yield curve and the inflation rate is set at 40%. 3.5.7 The parameter γbc of 50% should be used for aggregating across different buckets (i.e. different currencies). Foreign exchange risk 3.5.8 A foreign exchange risk bucket is set for each exchange rate between HKD and the currency in which an instrument is denominated. 3.5.9 A risk weight of 11% applies to risk sensitivities of all the currency pairs except USD/HKD. 3.5.10 The risk weight of USD/HKD is set at 1.3% on the rationale that this risk weight captures the fluctuation of USD/HKD within the Convertibility Undertaking range (i.e. 7.75 to 7.85) under the Linked Exchange Rate System. 3.5.11 A uniform correlation parameter γbc that applies to the aggregation of delta foreign exchange risk positions is set at 60%. Counterparty credit spread risk 3.5.12 The risk weights for buckets 1 to 8 are set out in the following table. The same risk weight should be applied to all tenors for a given bucket, sector and credit quality.

31 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 An AI should also follow the guidance provided in paragraph 2.2.3 in cases where there is more than one ECAI issuer rating or when there is no ECAI issuer rating. Bucket number Sector Credit quality Risk weight 1 Sovereigns including central banks, multilateral development banks Investment grade16 0.5% Non-investment grade or unrated 2.0% Local government, government￾backed non-financials, education, public administration Investment grade 1.0% Non-investment grade or unrated 4.0% 2 Financials including government-backed financials Investment grade 5.0% Non-investment grade or unrated 12.0% 3 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying Investment grade 3.0% Non-investment grade or unrated 7.0% 4 Consumer goods and services, transportation and storage, administrative and support service activities Investment grade 3.0% Non-investment grade or unrated 8.5% 5 Technology and telecommunications Investment grade 2.0% Non-investment grade or unrated 5.5% 6 Health care, utilities, professional and technical activities Investment grade 1.5% Non-investment grade or unrated 5.0% 7 Other sector Investment grade 5.0% Non-investment grade or unrated 12.0% 8 Qualified indices (non-sector specific) Investment grade 1.5% Non-investment grade or unrated 5.0% 3.5.13 To assign a counterparty or reference name to a sector, an AI should rely on a classification that is commonly used in the market for grouping the counterparty or reference name by industry sector. The AI should assign each counterparty or reference name to one and only 16 Unless otherwise specified, “investment grade” has the same meaning as specified in section 281 of the Rules.

32 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 one of the sector buckets in paragraph 3.5.12. Counterparties or reference names that an AI cannot assign to a sector in this fashion should be assigned to the other sector bucket (i.e. bucket 7). 3.5.14 An AI may opt for the treatment of qualified indices as set out in paragraphs 3.3.10 and 3.3.11. If more than 75% of constituents of a qualified index (taking into account the weightings of the constituents) are mapped to the same sector, an AI should map the entire index to that sector and treat it as a single-name sensitivity in that bucket. In other cases, the AI should map the sensitivity to the applicable index bucket (i.e. bucket 8). 3.5.15 An AI should apply the look-through approach to assign each index constituent of (i) a qualified index if the AI does not opt for the treatment as set out in paragraphs 3.3.10 and 3.3.11 and (ii) a non-qualified index to buckets 1 to 7. 3.5.16 For buckets 1 to 7, for aggregating delta counterparty credit spread risk capital charges within a bucket, the correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket is set as follows: 𝜌𝑘𝑙 = 𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) ⋅ 𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) ⋅ 𝜌𝑘𝑙 (𝑞𝑢𝑎𝑙𝑖𝑡𝑦) where:  𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) is equal to 100% if the two names of sensitivities k and l are identical, 90% if the two names are distinct but legally related, and 50% otherwise;  𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) is equal to 100% if the two tenors of the sensitivities k and l are identical, and 90% otherwise; and  𝜌𝑘𝑙 (𝑞𝑢𝑎𝑙𝑖𝑡𝑦) is equal to 100% if the credit quality category of the sensitivities k and l are identical (i.e. both k and l are investment grade or both of them are non-investment grade or unrated), and 80% otherwise. 3.5.17 For bucket 8, for aggregating delta counterparty credit

33 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 spread risk capital charges within a bucket, the correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket is set as follows: 𝜌𝑘𝑙 = 𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) ⋅ 𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) ⋅ 𝜌𝑘𝑙 (𝑞𝑢𝑎𝑙𝑖𝑡𝑦) where:  𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) is equal to 100% if the two indices of sensitivities k and l are identical and of the same series, 90% if the two indices are identical but of distinct series and 80% otherwise;  𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) is equal to 100% if the two tenors of the sensitivities k and l are identical, and to 90% otherwise; and  𝜌𝑘𝑙 (𝑞𝑢𝑎𝑙𝑖𝑡𝑦) is equal to 100% if the credit quality category of the sensitivities k and l are identical (i.e. both k and l are investment grade or both of them are non-investment grade or unrated), and 80% otherwise. 3.5.18 The correlation parameters γbc that apply to the aggregation of delta counterparty credit spread risk capital charges across buckets are set out in the table below.

34 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 Cross-bucket correlations for counterparty credit spread risk (γbc) Bucket 1 2 3 4 5 6 7 8 1 100% 10% 20% 25% 20% 15% 0% 45% 2 100% 5% 15% 20% 5% 0% 45% 3 100% 20% 25% 5% 0% 45% 4 100% 25% 5% 0% 45% 5 100% 5% 0% 45% 6 100% 0% 45% 7 100% 0% 8 100% Reference Credit Spread Risk 3.5.19 The risk weights for buckets 1 to 17 are set out in the following table. An AI should also follow the guidance provided in paragraph 2.2.3 in cases where there is more than one ECAI issuer rating or when there is no ECAI issuer rating.

35 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 Bucket number Credit quality Sector Risk weight 1 Investment grade Sovereigns including central banks, multilateral development banks 0.5% 2 Local government, government-backed non￾financials, education, public administration 1.0% 3 Financials including government-backed financials 5.0% 4 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 3.0% 5 Consumer goods and services, transportation and storage, administrative and support service activities 3.0% 6 Technology and telecommunications 2.0% 7 Health care, utilities, professional and technical activities 1.5% 8 Non-investment grade or unrated Sovereigns including central banks, multilateral development banks 2.0% 9 Local government, government-backed non￾financials, education, public administration 4.0% 10 Financials including government-backed financials 12.0% 11 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 7.0% 12 Consumer goods and services, transportation and storage, administrative and support service activities 8.5% 13 Technology and telecommunications 5.5% 14 Health care, utilities, professional and technical activities 5.0% 15 Other sector17 12.0% 16 Investment grade Qualified indices (non-sector specific) 1.5% 17 Non-investment grade or unrated Qualified indices (non-sector specific) 5.0% 3.5.20 To assign a reference name to a sector, an AI should 17 Credit quality is not a differentiating consideration for this bucket.

36 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 rely on a classification that is commonly used in the market for grouping the reference name by industry sector. The AI should assign each reference name to one and only one of the sector buckets in paragraph 3.5.19. Reference names that an AI cannot assign to a sector in this fashion should be assigned to the other sector bucket (i.e. bucket 15). 3.5.21 An AI may opt for the treatment of qualified indices as set out in paragraphs 3.3.10 and 3.3.11. If more than 75% of constituents of a qualified index (taking into account the weightings of the constituents) are mapped to the same sector, an AI should map the entire index to that sector and treat it as a single-name sensitivity in that bucket. In all other cases, the AI should map the sensitivity to the applicable index bucket (i.e. bucket 16 or 17). 3.5.22 An AI should apply the look-through approach to assign each index constituent of (i) a qualified index if the AI does not opt for the treatment as set out in paragraphs 3.3.10 and 3.3.11 and (ii) a non-qualified index to buckets 1 to 15. 3.5.23 For aggregating delta reference credit spread risk capital charges across buckets, the delta risk correlation parameters γbc are set as follows: 𝛾𝑏𝑐 = 𝛾𝑏𝑐 (𝑟𝑎𝑡𝑖𝑛𝑔) ⋅ 𝛾𝑏𝑐 (𝑠𝑒𝑐𝑡𝑜𝑟) where:  𝛾𝑏𝑐 (𝑟𝑎𝑡𝑖𝑛𝑔) is equal to 50% where the two buckets b and c are within buckets 1 to 14 and have the different credit quality category (i.e. one belongs to the investment grade and the other bucket belongs to the non-investment grade or unrated), and 100% otherwise; and  𝛾𝑏𝑐 (𝑠𝑒𝑐𝑡𝑜𝑟) is set out in the table below:

37 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 Sector-specific component of cross-bucket correlations for reference credit spread risk 𝛾𝑏𝑐 (𝑠𝑒𝑐𝑡𝑜𝑟) Bucket 1/8 2/9 3/10 4/11 5/12 6/13 7/14 15 16 17 1/8 100% 75% 10% 20% 25% 20% 15% 0% 45% 45% 2/9 100% 5% 15% 20% 15% 10% 0% 45% 45% 3/10 100% 5% 15% 20% 5% 0% 45% 45% 4/11 100% 20% 25% 5% 0% 45% 45% 5/12 100% 25% 5% 0% 45% 45% 6/13 100% 5% 0% 45% 45% 7/14 100% 0% 45% 45% 15 100% 0% 0% 16 100% 75% 17 100% Equity risk 3.5.24 The risk weights for the sensitivities to equity spot prices for buckets 1 to 13 are set out in the following table:

38 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 Bucket number Market capitalisation Economy Sector Risk weight 1 Large Emerging market economy Consumer goods and services, transportation and storage, administrative and support service activities, healthcare, utilities 55% 2 Telecommunications, industrials 60% 3 Basic materials, energy, agriculture, manufacturing, mining and quarrying 45% 4 Financials including government￾backed financials, real estate activities, technology 55% 5 Advanced economy Consumer goods and services, transportation and storage, administrative and support service activities, healthcare, utilities 30% 6 Telecommunications, industrials 35% 7 Basic materials, energy, agriculture, manufacturing, mining and quarrying 40% 8 Financials including government￾backed financials, real estate activities, technology 50% 9 Small Emerging market economy All sectors described under bucket numbers 1, 2, 3 and 4 70% 10 Advanced economy All sectors described under bucket numbers 5, 6, 7 and 8 50% 11 Other sector18 70% 12 Large market capitalisation, advanced economy equity indices (non-sector specific) 15% 13 Other equity indices (non-sector specific) 25% 3.5.25 Market capitalisation for the purpose of subsection 3.5 refers to the sum of the market capitalisations based on the market value of the total outstanding shares issued by the same legal entity across all stock markets globally. Under no circumstances should the sum of the market 18 Market capitalisation or economy (i.e. advanced or emerging market) is not a differentiating consideration for this bucket.

39 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 capitalisations of multiple related listed entities be used to determine whether a listed entity is “large market capitalisation” or “small market capitalisation”. 3.5.26 “Large market capitalisation” is defined as a market capitalisation equal to or greater than HKD 15.6bn and small market capitalisation is defined as a market capitalisation of less than HKD 15.6bn. The determination of market capitalisation should be updated in a regular interval, at least on a monthly basis, and at the end of every month. 3.5.27 The advanced economies are the euro area, the non￾euro area western European countries (Denmark, Norway, Sweden, Switzerland and the United Kingdom), Oceania (Australia and New Zealand), Canada, Japan, Mexico, Singapore, the United States and Hong Kong.19 3.5.28 To assign a risk exposure to a sector, an AI should rely on a classification that is commonly used in the market for grouping issuers by industry sector. The AI should assign each issuer to one of the sector buckets in paragraph 3.5.24 and it should assign all issuers from the same industry to the same sector. Issuers that the AI cannot assign to a sector in this fashion should be assigned to the other sector bucket (i.e. bucket 11). For multinational multi-sector equity issuers, the allocation to a particular bucket should be done according to the most material region and sector in which the issuer operates. 3.5.29 An AI may opt for the treatment of qualified indices as set out in paragraphs 3.3.10 and 3.3.11. If more than 75% of constituents of a qualified index (taking into account the weightings of the constituents) are mapped to the same sector, an AI should map the entire index to that sector and treat it as a single-name sensitivity in that bucket. In all other cases, the AI should map the sensitivity to the applicable index bucket (i.e. bucket 12 or 13). 3.5.30 An AI should apply the look-through approach to assign each index constituent of (i) a qualified index if the AI 19 This list of advanced economies could be subject to update. AIs should build their CVA risk capital calculation systems with sufficient flexibility to account for this potential periodic update.

40 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 does not opt for the treatment as set out in paragraphs 3.3.10 and 3.3.11 and (ii) a non-qualified index to buckets 1 to 11. 3.5.31 For aggregating delta equity risk capital charges across buckets, the correlation parameter γbc is set at:  15% for all cross-bucket pairs that fall within bucket numbers 1 to 10;  75% for the cross-bucket correlation between buckets 12 and 13;  45% for the cross-bucket correlation between buckets 12 or 13 and any of the buckets 1-10; and  0% for all cross-bucket pairs that include bucket 11. Commodity risk 3.5.32 The risk weights depend on the eleven buckets, in which several commodities with common characteristics are grouped, are set out in the following table:

41 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 Bucket number Commodity bucket Examples of commodities allocated to each commodity bucket (non-exhaustive) Risk weight 1 Energy - Solid combustibles Coal, charcoal, wood pellets, uranium 30% 2 Energy - Liquid combustibles Light-sweet crude oil, heavy crude oil, WTI crude oil and Brent crude oil, etc. (i.e. various types of crude oil); Bioethanol, biodiesel, etc. (i.e. various biofuels); Propane, ethane, gasoline, methanol, butane, etc. (i.e. various petrochemicals); Jet fuel, kerosene, gasoil, fuel oil, naphtha, heating oil, diesel, etc. (i.e. various refined fuels) 35% 3 Energy - Electricity and carbon trading Spot electricity, day-ahead electricity, peak electricity and off-peak electricity (i.e. various electricity types); Certified emissions reductions, in-delivery month EU allowance, RGGI CO2 allowance, renewable energy certificates, etc. (i.e. various carbon emissions trading) 60% 4 Freight Capesize, panamex, handysize, supramax, etc. (i.e. various types of dry-bulk route); Suezmax, Aframax, very large crude carriers, etc. (i.e. various types of liquid-bulk/gas shipping route) 80% 5 Metals – non￾precious Aluminium, copper, lead, nickel, tin, zinc, etc. (various base metals); Steel billet, steel wire, steel coil, steel scrap, steel rebar, iron ore, tungsten, vanadium, titanium, tantalum, etc. (i.e. various steel raw materials); Cobalt, manganese, molybdenum, etc. (i.e. various minor metals) 40% 6 Gaseous combustibles Natural gas; liquefied natural gas 45% 7 Precious metals (including gold) Gold; silver; platinum; palladium 20% 8 Grains & oilseed Rice; corn; wheat; soybean seed; soybean oil; soybean meal; oats; palm oil; canola; barley; rapeseed seed; rapeseed oil; rapeseed meal; red bean; sorghum; coconut oil; olive oil; peanut oil; sunflower oil 35%

42 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 9 Livestock & dairy Live cattle; feeder cattle; hog; poultry; lamb; fish; shrimp; milk, whey, eggs, butter; cheese 25% 10 Softs and other agriculturals Cocoa; Arabica coffee; Robusta coffee; tea; citrus and orange juice; potatoes; sugar; cotton; wool; lumber and pulp; rubber 35% 11 Other commodity Potash, fertilizer, phosphate rocks, etc. (i.e. various industrial minerals); Rare earths; terephthalic acid; flat glass 50% 3.5.33 The correlation parameters γbc that apply to the aggregation of delta commodity risk positions across buckets are set at:  20% for all cross-bucket pairs that fall within bucket numbers 1 to 10; and  0% for all cross-bucket pairs that include bucket number 11. 3.6 SA-CVA: vega risk weights and correlations 3.6.1 The delta buckets are replicated in the vega context. 3.6.2 The respective risk weights for each risk class are set out as follows. Risk class Risk weight Interest rate 100% FX 100% Reference credit spread 100% Equity (large cap) 78% Equity (others) 100% Commodity 100% 3.6.3 For the interest rate risk class, the correlations between interest rate volatilities and the inflation rate volatilities (𝜌𝑘𝑙) are set at 40%. 3.6.4 The delta cross-bucket correlations (𝛾𝑏𝑐) are replicated in the vega context.

43 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 4. Cryptoasset exposures 4.1 General 4.1.1 This section describes how the capital requirements for CVA risk are to be applied to cryptoasset derivatives exposures as well as material and fair-valued SFTs referencing cryptoassets. 4.2 CVA risk for Group 1 cryptoassets20 Group 1a cryptoassets 4.2.1 Derivatives and SFTs on Group 1a cryptoassets will generally be subject to the same requirements to determine the CVA risk capital charge as non-tokenised traditional assets. In other words, if an AI holds a derivative or an SFT on a tokenised asset having a price close to the traditional asset and being subject to CVA risk as set out in this module, it will be reflected in the CVA risk capital charge in the same way as a derivative or SFT on the non-tokenised traditional asset. 4.2.2 AIs must assess the tokenised traditional asset itself against the rules set out in this module. Qualification for a given treatment cannot be derived from the respective traditional (non-tokenised) asset. This requirement of individual assessment includes, but is not limited to, the liquidity characteristics. Different liquidity characteristics between the traditional (non-tokenised) asset and the tokenised asset could result in a higher basis risk between the two. In case of insufficient data availability to model the impact of these different liquidity characteristics on their market values, especially of the exposure underlying CVA, the SA-CVA cannot be applied for calculating CVA risk, i.e. such tokenised assets are subject to the BA-CVA. Group 1b cryptoassets 4.2.3 Derivatives on Group 1b cryptoassets will be subject to the same requirements to determine CVA risk capital charge as non-tokenised traditional assets. 20 AIs should follow the guidance provided in CRP-1 “Classification of Cryptoassets” to classify a cryptoasset into Group 1a, Group 1b, Group 2a or Group 2b.

44 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 4.3 CVA risk for Group 2 cryptoassets Group 2a cryptoassets 4.3.1 Group 2a cryptoassets will be subject to the requirements set out in this module, except section 3, as the use of SA-CVA is not permitted for derivatives and fair-valued SFTs referencing Group 2a cryptoassets. Group 2b cryptoassets 4.3.2 Generally, the CVA risk for Group 2b cryptoassets is covered in the conservative treatment (i.e. the application of 1,250% risk weight). No additional calculation is required. 4.3.3 For any covered transactions with a Group 2b cryptoasset as the underlying asset, if the credit risk is not calculated with the 1,250% risk weight, an AI should calculate the risk-weighted amount for CVA risk using the conservative treatment (i.e. the application of 1,250% risk weight). One possible example is SFTs that are collateralised by Group 2b cryptoassets and are fair￾valued by the AI for accounting purposes. However, fair￾valued SFTs that are collateralised by cryptoassets will be subject to the CVA risk only if the HKMA determines that the CVA risk arising from such fair-valued SFTs is material.

45 Supervisory Policy Manual MR-2 CVA Risk Capital Charge V.2 – 19.12.2025 Annex A: Abbreviations AAD adjoint algorithmic differentiation BA-CVA basic CVA approach BCBS Basel Committee on Banking Supervision CDS credit default swap EAD exposure at default EEPE effective expected positive exposure ELGD expected loss-given-default full BA-CVA full version of the BA-CVA FX foreign exchange IMM(CCR) approach internal models (counterparty credit risk) approach MPoR margin period of risk PD probability of default qualifying CCP qualifying central counterparty reduced BA-CV reduced version of the BA-CVA SA-CCR approach standardised approach for measuring CCR exposures SA-CVA standardised CVA approach SFT securities financing transaction ——————— Contents Glossary Home Introduction