Implementation guidance on Banking (Capital) Rules Annex 2: Chapter IV - IRB approach

Chapter IV IRB approach (August 2026) Page 1 of 37 IV. IRB Approach

1. Application and adoption1 Application for approval to use IRB approach Q1. Suppose an AI uses the foundation IRB approach for its exposures in the IRB adoption classes of corporate—other than specialized lending, sovereign and bank. Can the institution switch to using the STC approach for its sovereign exposures? If yes, is consent from the MA required for the switch?2 A1. Under §8(4)(a), when an AI is granted approval under §8(2)(a) to use the IRB approach for one or more than one IRB adoption class to calculate its credit risk for non-securitization exposures, the institution shall not, except with the prior consent of the MA, use any approach other than the IRB approach to calculate its credit risk for non-securitization exposures within the IRB adoption class for which the approval is granted to use the IRB approach. Accordingly, the decision to switch to the STC approach must be justified. For example, it could arise from changes in group-wide regulatory reporting strategy in response to revisions of the requirements of the supervisory authority of the institution’s parent bank. The institution must also demonstrate that the decision is not motivated by regulatory capital arbitrage. These requirements also apply to the applications for switching from other IRB calculation approaches to the STC approach. Adoption of IRB approach Q2. What is the expected content of an implementation plan under §11(1)(a)? A2. The implementation plan under §11(1)(a) must specify the extent to which and the timing of when an AI intends to use the IRB approach to calculate its credit risk for non-securitization exposure.3 It is thus expected that the plan generally includes— (a) the IRB adoption class(es) which is/are the subject of the application and the respective IRB calculation approach chosen to be used (e.g. the foundation IRB approach or advanced IRB approach in case of the IRB adoption class of “sovereign exposures”); (b) the expected commencement date for using the IRB approach for each IRB adoption class subject to the application; and (c) in the case of a phased rollout within an IRB adoption class, the details of the planned rollout (see also A3 below). 1 Reference: §§8, 11, 12 and 13 of the BCR. 2 Q1 and Q18 should be read together, as they illustrate the principles adopted by the HKMA in addressing an AI’s voluntary return to less advanced approaches. These principles are in line with Basel Framework CRE30.50. 3 The implementation plan should be realistic and driven by the practicality and feasibility of moving to the more advanced approaches. It should not be motivated by a desire to adopt an approach that minimises its capital charge (re: Basel Framework CRE30.48).

Chapter IV IRB approach (August 2026) Page 2 of 37 When submitting an implementation plan, the institution should also provide comprehensive information that is useful for assessing its application. Such information is typically contained in its internal project plan, which may include, but is not limited to— (a) the organizational structure delineating the business lines, risk management and other functional units’ authorities and duties in the governance, developments and operations concerning the implementation of the IRB approach; (b) a gap analysis of the latest status of compliance with the applicable regulatory requirements; (c) a description of each rating system under the initial implementation or that is to be developed; (d) the details of the intra-group arrangement (e.g. rating system development and validation, etc.) in cases where the institution is a subsidiary of an overseas banking group and certain operations concerning the rating systems are performed by the associated entities of the banking group; and4 (e) any other information that the institution considers appropriate to be included in the plan. Q3. Is a phased rollout allowed for exposures falling within an IRB adoption class when an AI applies for using the IRB approach? A3. A phased rollout is generally not expected for exposures falling within an IRB adoption class. An AI should ensure comprehensive readiness within that IRB adoption class, including a credible track record of at least 3 years using its rating system, before the institution becomes qualified to use the relevant IRB approach. A phased rollout within an IRB adoption class may be considered only under exceptional circumstances with strong justifications, for example– (a) the formal adoption of rating systems for certain exposures within an IRB adoption class is subject to events beyond the institution’s control (e.g. decisions made by home and host supervisors concerning a rating system for certain exposures within an IRB adoption class); (b) it is impracticable to implement the IRB approach in a business unit5 of the institution that is located outside of Hong Kong and subject to specific local legal or regulatory restrictions (e.g. restrictions on the transfer of obligor data); 4 During the rollout period, an AI should be prepared to demonstrate that no capital relief arises from intra-group transactions (e.g. asset sales and cross guarantees), which are designed to reduce the banking group’s aggregate capital charge by transferring credit risk among entities using different approaches to calculate credit risk, such as the STC approach, the foundation IRB approach and the advanced IRB approach (re: Basel Framework CRE30.48). 5 Please refer to Q5 regarding exemption of exposures within a business unit under §12.

Chapter IV IRB approach (August 2026) Page 3 of 37 (c) the structure of the institution is complicated such that it is impracticable to implement the IRB approach all at once. To avoid doubt, there is no supervisory expectation that AIs commence to use the IRB approach across IRB adoption classes simultaneously. Exemption for exposures and revocation of such exemption Q4. What factors will the MA consider in determining an AI’s application for exempting a subset of exposures in an IRB adoption class or the exposures falling within a business unit from the use of the IRB approach? A4. In determining such an application, the MA will consider the following factors – (a) Practicality (re: §12(2)(a)(iii)) – whether the institution encounters genuine difficulties applying the IRB approach to the relevant exposures due to practical reasons, taking into account the nature and complexity of the exposures (e.g. lack of data). The MA will not exempt any exposures if it is clear that the institution can apply the IRB approach to such exposures without incurring significant cost or effort; and (b) Regulatory capital arbitrage (re: §12(2)(a)(iv)) – whether the exemption will materially prejudice the calculation of the institution’s regulatory capital for credit risk. Regulatory capital arbitrage must not be the main purpose of the exemption application. In relation to the foregoing, the HKMA expects that, in most cases, only exposures that are immaterial in terms of size and perceived risk profile within the IRB adoption class could justify the impracticality of including such exposures in the calculation of credit risk under the IRB approach. This could also serve to demonstrate that the exemption application is not driven by regulatory capital arbitrage. In general, the aggregate risk-weighted amount of an institution’s exposures in an IRB adoption class to which the exemption specified in the application would relate is not expected to exceed 10% of an institution’s risk-weighted amount for credit risk (i.e. an indicative size reference level of 10%). Q5. Will the MA approve an AI to exclude from the IRB calculation only some exposures within a business unit? A5. As a general rule, the MA will only exempt exposures within a business unit from the IRB calculation in their entirety. When an AI uses the IRB approach in respect of a particular business unit, the institution should apply the IRB approach to all exposures within the IRB adoption classes approved to use the IRB approach that fall within that business unit. In this connection, when an AI applies for exempting exposures within a business unit, the institution should define the boundary of the concerned business unit in the application in a manner consistent with its business and management structure. Examples of a business unit may include a subsidiary, a branch outside Hong Kong, or a division of an AI.

Chapter IV IRB approach (August 2026) Page 4 of 37 Q6. Is an exemption granted by the MA under §12 a permanent one? A6. No. When the exemption granted in respect of a subset of exposures in an IRB adoption class or the exposures falling within a business unit under §12 becomes unsubstantiated (see A4 above for the factors relevant to the determination of a §12 application), the MA may take one or more of the actions set out in §13(2), including revocation of the exemption granted. 2. Classification of exposures6 General Q7. The reported figures of annual sales, annual revenue and total assets of a company or a group of companies of which the company concerned is a member (a “group”) in its “latest annual financial statement” are required for classification and credit risk calculation under the IRB approach (see for example, §§143(3) and (3A) and 157A(3)). Must an AI use the audited financial statements to determine the value thresholds? In addition, companies often take time to prepare financial statements. What is the supervisory expectation regarding the timeliness of these financial statements? A7. Under §143(3A), the annual financial figures of a company or a group in a financial year (“financial figures”) must be ascertained through the audited financial report for the purpose of classifying large corporate exposures. This requirement also applies to identifying large regulated financial institutions as defined under §157A(3). Regarding the classification of small-and-medium sized corporate exposures and small business retail exposures, the HKMA has the same expectation as that provided in Q28 and Q29 of Chapter III “STC approach” for the classification of “small business”. Therefore, among others, an AI should ascertain the financial figures through the audited financial report to the extent feasible. Where the updated audited financial report is unavailable (e.g. sole proprietorships where statutory audit is not mandatory) or yet to be available, other reliable information for that year (e.g. the company’s internal report or transaction/payment data or those obtained through Commercial Data Interchange) may be used with any necessary adjustments (e.g. elimination of intra-group transactions). Q8. Must an AI use the $500 million threshold to classify its corporate exposures under the IRB subclass of small-and-medium sized corporates? What would be the case for the value thresholds for the classification of small business retail exposures and large corporates? A8. Under §143(3), an AI may classify an exposure to a corporate that falls within the description therein as a corporate exposure within the IRB subclass of small-and medium sized corporates. In this context, the institution may opt for a threshold that 6 Reference: §§142-146 of the BCR.

Chapter IV IRB approach (August 2026) Page 5 of 37 is consistent with its risk management practices, provided that it does not exceed $500 million. Similar flexibility is also available to the institution with respect to the $10 million threshold set out in §144(2) for classifying small business retail exposures. Regarding the $5 billion threshold for classifying an AI’s exposures as large corporates pursuant to §143(3A), the institution must adopt this specific value threshold. Additionally, under §143(4C), an AI must classify its exposures described in §143(3C) as exposures falling within the IRB subclass of financial institutions treated as corporates. This classification applies regardless of whether these exposures may also fall within the IRB subclass of small-and-medium sized corporates or large corporates. Corporate exposures – specialized lending Q9. Under which IRB subclass should an AI classify its specialized lending if the institution is able to estimate the credit risk components of such specialized lending for the purpose of using the foundation IRB approach or the advanced IRB approach? A9. An AI must classify all of its specialized lending under the five IRB subclasses of the specialized lending7 , as the case requires, regardless of whether the institution uses the supervisory slotting criteria approach, the foundation IRB approach or the advanced IRB approach to calculate the risk-weighted amount of its specialized lending. Q10. Is there any guidance on classifying exposures into each subclass of specialized lending in addition to paragraphs (a) to (e) of §143(1)? A10. The definition of “specialized lending” and the definitions of the five subclasses of specialized lending8 are set out in §139(1) and paragraphs (a) to (e) of §143(1) respectively. For further guidance, an AI should refer to (i) Q34 to Q40 in Chapter III “STC approach” and (ii) Basel Framework CRE30.8 to CRE30.16. Corporate exposures – small-and-medium sized corporates Q11. Under what circumstances may an AI be justified in substituting a corporate’s total assets for total annual sales for §143(4) concerning the classification of small-and-medium sized corporates? A11. These would be the cases where a corporate’s scale of business is not accurately reflected by its total annual sales, such as where a significant portion of sales arises 7 Namely project finance, object finance, commodities finance, income-producing real estate, and high-volatility commercial real estate 8 See the previous footnote.

Chapter IV IRB approach (August 2026) Page 6 of 37 from an exceptional, non-recurring transaction, or where substantial offshore sales have been booked through the corporate for tax planning purposes. Corporate exposures – financial institutions treated as corporates Q12. Guidance is sought on the scope of exposures to be classified under the IRB subclass of financial institutions treated as corporates. A12. Any financial institutions as defined under §139(1) that do not fall within the five IRB subclasses of bank exposures, or the three IRB subclasses of sovereign exposures should be classified under the IRB subclass of financial institutions treated as corporates. 9 Retail exposures Q13. Is there any limit on the size of an exposure qualified as a retail exposure? A13. Size limits are specified in §144(2) for the IRB subclass of small business retail exposures, and in §144(4) and (4A) for the IRB subclasses of qualifying revolving retail exposures (transactor) or qualifying revolving retail exposures (revolver). For clarity, there is no size limit for an exposure to qualify for inclusion in the other IRB subclasses for retail exposures. Q14. Suppose a retail obligor holds a credit card facility and a revolving personal overdraft facility with an AI. Should the institution aggregate the credit limits of both facilities to determine whether the total falls within the $1 million threshold for classifying them under the IRB subclass of qualifying revolving retail exposures (transactor) or qualifying revolving retail exposures (revolver)? (re: §144(4) & (4A)) A14. No. In determining whether an exposure falls within the IRB subclass of qualifying revolving retail exposures (transactor) 10 or qualifying revolving retail exposures (revolver), an AI is expected to apply the $1 million threshold mentioned above on a facility basis, rather than on an obligor basis. To avoid doubt, the threshold is intended to be applied at the facility level from the perspective of management, i.e. the exposures of multiple facilities of the same product type should be aggregated if those facilities are managed as if they were a single facility. Otherwise, it is acceptable to apply the threshold to each facility individually. An indication of facilities being managed as a single account, among others, is that they are subject to a shared limit. 9 Although such a case is not envisaged, if an exposure to a financial institution meets the criteria of specialized lending, it should be classified under one of the five specialized lending exposures. 10 Please refer to Q54 to Q57 of Chapter III “STC approach” for further guidance on identifying a transactor. The term carries the same meaning under the STC approach and the IRB approach.

Chapter IV IRB approach (August 2026) Page 7 of 37 To assess compliance with the threshold, the total exposure at the time of classification (e.g. the drawn portion of a performing credit line) could be used. In practice, the facility limit or the EAD of an exposure may also be used provided that the conditions under §144(2) and (4A) are met. Q15. How should an AI classify a loan to an individual which is not managed on a pooled or portfolio basis?11 A15. In accordance with §144(6), a loan of this nature should be treated as corporate exposures. To be eligible for classification as a retail exposure, an exposure must not be managed individually in a way comparable to corporate exposures, but rather as part of a portfolio segment or pool of exposures with similar risk characteristics for purposes of risk assessment and quantification. This requirement does not preclude retail exposures from being treated individually at some stages of the risk management process. The fact that an exposure is rated individually does not in itself preclude it from being eligible for classification as a retail exposure. Other exposures Q16. Is gold bullion held on an unallocated basis for the institution by another person which is backed by gold bullion liabilities a cash item? A16. The item is not classified as a cash item and required to be treated as an exposure to a counterparty, and risk-weighted accordingly under the IRB approach. 3. IRB calculation approaches12 Q17. Is there any expectation that an AI currently using the foundation IRB approach to calculate its credit risk for an IRB adoption class of corporate or sovereign exposures will migrate to the advanced IRB approach over time? A17. There is no such supervisory expectation. An AI should select an approach for an IRB adoption class which is appropriate for its exposures within that IRB adoption class and commensurate with the sophistication of its internal risk management functions. Q18. Can an AI using the advanced IRB approach to calculate its credit risk for corporate and sovereign exposures switch to the foundation IRB approach? Besides, can an AI apply the advanced IRB approach to certain exposures while 11 Reference: Basel Framework CRE30.22(2). 12 Reference: §147 of the BCR.

Chapter IV IRB approach (August 2026) Page 8 of 37 using the foundation IRB approach to others within the same IRB adoption class?13 A18. Except in the cases specified in §147(3A) concerning the transitional arrangements, any switching of IRB calculation approach (regardless of whether the switch involves all or some exposures within an IRB class) requires the prior consent of the MA under §147(3). Switching from the advanced IRB approach to the foundation IRB approach for exposures within an IRB adoption class will be permitted only in exceptional circumstances (e.g. where an AI’s business has been downsized to a level which does not justify the institution maintaining a highly sophisticated risk management system, or an AI’s rating system is no longer able to reliably estimate one or more than one of the credit risk components14). Q19. Can an AI choose to use the supervisory slotting criteria approach to calculate the risk-weighted amount of its specialized lending even if the institution is capable to estimate the credit risk components of such lending, as required in Part 6 of the BCR for corporate exposures? A19. No. If an AI is capable of estimating the credit risk components of its specialized lending exposures within an IRB subclass (e.g. project finance) in accordance with Part 6 of the BCR for corporate exposures, it is not eligible to apply the supervisory slotting criteria approach to such lending. (re: §143(2)) Q20. After 1 January 2025, which calculation approach should an AI use to calculate the credit risk of its equity exposures that were previously granted with the MA’s approval to use the IRB approach? A20. Under §147(3C), if an AI used the IRB approach before 1 January 2025 to calculate its credit risk for equity exposures (within the meaning of the pre-amended Part 6 of the BCR), the institution must use the STC approach on and after that date to calculate its credit risk for equity exposures. Note that under the current §139(1), the term equity exposure refers to an exposure that falls within §54A, which excludes, among others, an exposure that is a CIS exposure. 4. Default of obligor15 Q21. What is meant by “prescribed default criteria” in §149(9)? 13 Q1 and Q18 should be read together, as they illustrate the principles adopted by the HKMA in addressing an AI’s voluntary return to less advanced approaches. These principles are in line with Basel Framework CRE 30.50. 14 This may arise from the requirements from the Basel Committee on Banking Supervision (“BCBS") or the home supervisor of an AI (in case where the institution is a Hong Kong subsidiary of an overseas banking group) in estimation practices of credit risk components. 15 Reference: §149 of the BCR.

Chapter IV IRB approach (August 2026) Page 9 of 37 A21. Under §149(9), “prescribed default criteria” means the criteria specified in §149(1). That section primarily sets out that a default of the obligor in respect of an exposure of an AI has occurred if— (a) the institution considers that the obligor is unlikely to pay in full the obligor’s credit obligations to the institution (or to any member of the consolidation group of the institution) (“banking group”) without recourse by the institution to realizing any collateral held by the institution or taking any other action in respect of the exposure; or (b) subject to §149(2), (3) and (8), the obligor is past due for more than 90 days in respect of the payment of any material portion of all the obligor’s outstanding credit obligations to the banking group. Other subsections of §149 are outlined below, along with certain guidance. (1A) Presents a list of possible indications of “unlikely to pay” specified in §149(1). (2) Specifies that an AI may choose to apply the prescribed default criteria at the level of a particular exposure, rather than at the level of the obligor for retail exposures. As such, the default of a borrower on one obligation does not necessarily require an AI to treat all other obligations to the banking group as defaulted. In this connection, AIs are advised to set out, in their internal policies, the circumstances under which all their exposures to the same obligor, including the retail exposure in question, would be treated as in default, and to apply such policy consistently. (3) Clarifies the circumstances under which an overdraft provided by an AI to an obligor (being a borrower of the overdraft) should be regarded as past due. In this connection, AIs are reminded to have in place rigorous internal policies for assessing the creditworthiness of customers to whom overdrafts are offered.16 (4) & (5) Elaborate that an AI shall use the prescribed default criteria for its exposures under the IRB approach except for specific exposures where the institution is given with the MA’s consent to use another set of default criteria set by the relevant banking supervisory authority of the parent bank of an institution, which is the local subsidiary of the parent bank (“alternative criteria”). It is currently envisaged that the use of alternative criteria is only justifiable for retail exposures and exposures to public sector entities, and the past due trigger within the alternative criteria is no more than 180 days. (5A) to (5D) Concern the default of obligors in a connected group: • (5A) Requires an AI to treat its exposures to all individual obligors in a connected group as being in default if— 16 Reference: Basel Framework CRE36.75.

Chapter IV IRB approach (August 2026) Page 10 of 37 (a) a default of an obligor (“defaulting obligor”) in the connected group has occurred; and (b) the defaulting obligor has been rated substantially on the basis of the economic or financial interdependence between the members in the connected group in accordance with the institution’s policy and practices referred to in §154(d). • (5B) Provides flexibility in relation to retail exposures resembling §149(2) in the context of the default of a connected group. • (5C) & (5D) Specify the circumstances under which an AI may disregard §149(5A). (6) & (7) Set out the requirements for the keeping of records of default, the generation of estimates of credit risk components, and the use of internal or external data in relation to the definition of default. (8) & (9) §149(8) reaffirms that the practice of re-ageing is not allowed, and §149(9) defines several terms used in this section. Q22. Guidance is sought on the “material” threshold in relation to the requirements set out in §149(1)(b), (1A)(a) and (c). A22. AIs are expected to develop their own criteria for determining the materiality of a credit obligation and the materiality of credit-related economic loss for the purposes of §149(1)(b), (1A)(a) and (c). The criteria should be prudent, applied consistently across the institution’s consolidation group, and should not jeopardize its internal policies and procedures for problem credit management. If an AI’s parent bank outside Hong Kong is subject to capital standards and/or supervisory guidance published by the parent bank’s regulator that have specified materiality thresholds or other criteria for determining materiality, the institution’s own criteria should be at least as prudent as those criteria, including materiality thresholds, unless otherwise justified. To avoid doubt, it is acceptable for an AI to ignore the word “material” in §149(1) and (1A). Furthermore, an AI may, at its discretion, apply the flexibility for identifying defaults with respect to a group of exposures covering retail exposures of an obligor (or a connected group) set out in §149(2)(b) and (5B) in considering the relevant amount under its “materiality” criteria. Q23. Is an AI required to treat an “automatic” realisation of an obligor’s collateral in respect of certain facility types (e.g. share margin financing) as an event of default when the realisation of collateral is not due to the deterioration in the obligor’s creditworthiness but by a fall in the value of the collateral? A23. The definition of “default” may not apply in cases where the realisation of collateral is not triggered by deterioration in an obligor’s creditworthiness but by a fall in the value of the obligor’s collateral (say, the shares pledged). In such cases, an AI will not be required to record a default of the obligor if the following two characteristics exist—

Chapter IV IRB approach (August 2026) Page 11 of 37 (a) the facility is granted to finance the obligor’s position in a financial asset which qualifies as recognized financial collateral under the IRB approach; and (b) the collateral is realized to restore an agreed collateral coverage ratio after a fall in the value of the obligor’s collateral, as a standard practice for such type of facility and where such practice has been disclosed to the obligor in writing at the inception of the facility. Q24. What is meant by a “connected group” as referred to in §149(5A), (5B), (5C) and (5D)? A24. The term “connected group” in these subsections should reflect the definition used by an AI for the purposes of §154(d)(ii). Where an AI adopts a “group support” policy in rating assignment in accordance with §154(c) and (d), the institution is required to determine and define, among other things, what constitutes a “connected group” of its obligors in that context. Please refer to subsection 3.2 of the SPM module CA-G-4 “Validating Risk Rating Systems under the IRB Approach” for further guidance. Q25. Why is an AI required to treat its exposures to all individual obligors in a connected group as being in default in the circumstances described in §149(5A)? Are there exceptions to the requirement? A25. To the extent that members of a connected group are treated on a group basis by an AI for the purposes of rating assignment pursuant to §154(c) and (d) and have, as a result, been assigned more favourable ratings (based on the available group support) than if they were rated on a standalone basis, it is prudent and logical that such group members be treated consistently on the same group basis for the purposes of the recognition of default within the group as provided for under §149(5A). Accordingly, AIs that adopt a group support policy in rating assignment should accept both: (a) the benefit of more favourable ratings being assigned to members of a connected group on the strength of available group support pursuant to §154(c) and (d); and (b) the adverse impact on members’ ratings when §149(5A) becomes applicable. It would amount to cherry-picking if AIs were initially allowed to rate members of a connected group favourably on a group basis when there is no default among the members but subsequently allowed to revert to rating other group members on a standalone basis once the group support so recognized actually fails to prevent the default of a group member. This approach would essentially ignore the interdependencies between the group members that had been recognized and relied upon pre-default. Recognizing however that the form and structure of conglomerates vary widely, AIs are not expected to identify the default of any one member of a connected group as a default of all the group members in all circumstances. §149(5B), (5C) and (5D) sets out circumstances under which §149(5A) will not apply.

Chapter IV IRB approach (August 2026) Page 12 of 37 5. Rating system design and operations17 General Q26. Is it permissible for an AI to use multiple rating methodologies/systems within an IRB class?18 A26. It is recognised that an AI’s size and complexity of business, as well as the range of products it offers, will affect the type and number of rating systems it has to employ (e.g. customised rating systems for specific industries or market segments such as middle market and large corporate). An AI may use more than one rating system for exposures which fall within an IRB class if it demonstrates to the satisfaction of the MA that the rating systems concerned are necessary having regard to the considerations and requirements set out in §147(4). Noteworthy, AIs must not allocate obligors across rating systems inappropriately to minimise regulatory capital requirements (i.e. cherry-picking by choice of rating system). Q27. To what extent should material and relevant information on climate-related financial risks be used when assigning ratings to obligors and facilities? Relatedly, to what extent do the requirements for rating criteria and rating assignment require consideration of climate-related financial risks? A27. AIs are advised to consider material and relevant information on the impact of climate-related financial risks in rating assignment. The range of economic conditions or unexpected events that should be considered when making the assessment of a borrower’s ability to perform should include climate-related financial risks, including both physical and transition risks, if these risks materialise as credit risks. For further guidance, please refer to each individual FAQ1 inserted to Basel Framework CRE36.26, CRE36.30 and CRE36.86. The FAQs on climate-related financial risks published by the BCBS are primarily intended to encourage banks to continuously develop their measurement and mitigation of climate-related financial risks (given the challenges arising from methodological and data limitations cannot be fully resolved at this time) and is not to introduce changes to the Pillar 1 standards.19 Thus, the HKMA will adopt a proportionate approach in assessing an AI’s compliance and consider it pragmatic for an AI to focus initially on enhancing its framework and processes, with the aim of gradually improving its robustness over time. 20 Q28. How can AIs reflect climate-related financial risks in the supervisory slotting criteria for specialized lending?21 A28. When performing the assessment of the category of the sub-factor components, AIs should analyse how climate-related financial risks could negatively impact the assignment into a category. This includes any potential impact on, but not limited 17 Reference: §§150 – 155 and 170 – 175 of the BCR. 18 Reference: Basel Framework CRE36.10. 19 See the introduction section of the BCBS’s FAQs, accessible at https://www.bis.org/bcbs/publ/d543.pdf. Note that the FAQs therein have been integrated into the Basel Framework. 20 To avoid doubt, this paragraph is also applicable to Q28, Q50 and Q79. 21 Reference: FAQ1 inserted to Basel Framework CRE33.13.

Chapter IV IRB approach (August 2026) Page 13 of 37 to— (a) the financial strength (e.g. estimations of the future demand, economic assumption and stressed economic conditions used for stress analysis), (b) the political and legal environment (e.g. transition risk into “stability of legal and regulatory environment (risk of change in law)”), (c) physical risk into “force majeure risk (war, civil unrest, etc.)”, and (d) the asset characteristic in the case of object finance. AIs should also take into consideration whether climate-related financial risks have been adequately mitigated (e.g. through improving adaptation or taking insurance coverage against physical climate risks). Rating dimensions Q29. Must an AI assign the same obligor grade to separate exposures to the same obligor?22 A29. Yes, an AI must do so unless the institution demonstrates to the satisfaction of the MA that the risk of default of the obligor in respect of such exposures is different (re: §150(3)(b)). This is irrespective of any differences in the nature of each specific transaction. Below are two envisaged exceptions — (a) The presence of country risk and transfer risk23 could justify an AI to assign different obligor grades to the separate exposures depending on whether each of them is denominated in local or foreign currency. (b) The treatment of associated guarantees (or credit derivative contracts) to a facility may be reflected in an adjusted obligor grade in accordance with the BCR. Q30. How could the requirements of §150(1)(b) regarding facility grades be satisfied?24 A30. §150(1)(b) requires that facility grades must reflect transaction-specific factors, such as collateral, seniority, product type, etc. Under the foundation IRB approach, this requirement may be fulfilled by the existence of a rating dimension, which reflects both obligor and transaction-specific factors (re: §150(2)). For example, a rating dimension that reflects expected loss (EL) by incorporating both obligor strength (PD) and loss severity (LGD) considerations would qualify. Likewise, a rating system that exclusively reflects LGD would qualify. Where a rating dimension reflects EL but does not separately quantify LGD, the supervisory estimates of LGD 22 Reference: Basel Framework CRE33.12. 23 Please refer to the Glossary of the SPM modules for the meaning of these terms. 24 Reference: Basel Framework CRE36.13 to CRE36.15.

Chapter IV IRB approach (August 2026) Page 14 of 37 must be used. Under the advanced IRB approach, facility grades must reflect exclusively LGD. These ratings can reflect any and all factors that can influence LGD including, but not limited to, the type of collateral, product, industry, and purpose. Obligor characteristics may be included as LGD rating criteria only to the extent they are predictive of LGD. AIs may alter the factors that influence facility grades across segments of the portfolio as long as they can satisfy the MA that the alteration improve the relevance and precision of their estimates. Note that the two-dimension requirement does not apply to AIs using the supervisory criteria approach for specialized lending. Given the interdependence between obligor and transaction characteristics in these exposures, an AI may use a rating system with a single rating dimension that reflects EL by incorporating both obligor strength and loss severity considerations for these exposures. (re: §150(4)) Q31. What are the expectations for assigning retail exposures into particular pools? Please provide examples of the three risk drivers when assigning exposures to a pool as referred to in §170(1)(a)(ii).25

A31. AIs must demonstrate that the process for assigning exposures to specific pools provides for a meaningful risk differentiation, a grouping of sufficiently homogeneous exposures, and accurate and consistent estimation of loss characteristics at the pool level. The level of differentiation must ensure that the number of exposures in a given pool is sufficient so as to allow for meaningful quantification and validation of the loss characteristics at the pool level. There must be a meaningful distribution of obligors and exposures across pools, and no single pool shall include an undue concentration of the institution’s total retail exposure. (re: §§170 and 171) In addition, the following are some examples (not intended to be exhaustive) of the three risk drivers as referred to in §170(1)(a)(ii)— (a) Risk characteristics of obligors: obligor type, demographics such as age/occupation; (b) Risk characteristics of transactions: product and/or collateral type (e.g. loan-to -value measures, seasoning, guarantees, and seniority (first vs. second lien)). AIs must explicitly address cross-collateral provisions, where present; (c) Frequency and duration of delinquency: AIs should separately identify delinquent and non-delinquent exposures. Q32. What analyses should an AI perform concerning the seasoning of retail exposures mentioned in bullet (b) of A31 above?26

25 Reference: Basel Framework CRE36.16, CRE36.17 and CRE36.24. 26 Reference: Basel Framework CRE36.17 footnote 2.

Chapter IV IRB approach (August 2026) Page 15 of 37 A32. For each pool where an AI estimates PD and LGD, the institution should analyse the representativeness of the age of the facilities (in terms of time since origination for PD and time since the date of default for LGD) in the data used to derive the estimates of their actual facilities. The AI must adjust the estimates with an adequate margin of conservatism to account for the lack of representativeness as well as anticipated implications of rapid exposure growth that may lead to default rates peaking several years after origination. Rating criteria Q33. Could the HKMA elaborate the requirements on rating criteria set out in §§152 and 172?27

A33. AIs must have specific rating definitions, processes and criteria for assigning exposures to grades within a rating system. The rating definitions and criteria should be both plausible and intuitive, and must result in a meaningful differentiation of risk. (a) The grade descriptions and criteria must be sufficiently detailed to allow staff responsible for rating assignments to consistently assign the same grade to obligors or facilities posing similar risks. This consistency should exist across lines of business, departments and geographic locations. If rating criteria and procedures differ for different types of obligors or facilities, the AI must monitor for possible inconsistency and alter rating criteria to improve consistency when appropriate. (b) Written rating definitions must be clear and detailed enough to allow independent third parties (e.g. the HKMA, internal audit function or external auditors) to (i) understand the rating assignments, (ii) replicate them and (iii) evaluate their appropriateness. (c) The criteria must be consistent with AI’s internal lending standards and its policies for handling troubled obligors and facilities. To ensure consistent consideration of available information, AIs must use all relevant and material information in assigning ratings to obligors and facilities. Information must be current. The less information an AI has, the more conservative must be its rating assignments. An external rating can be the primary factor determining an internal rating assignment; however, the AI must ensure that it considers other relevant information. Q34 and Q35 provide the relevant factors for AIs to consider when assigning obligor and facility ratings. Q34. What factors should an AI consider in assigning obligor grades?28

27 Reference: Basel Framework CRE36.25 and CRE36.26. 28 Reference: paragraph 265 of BCBS (2001), “The New Capital Accord — Consultative Document”, accessible at: https://www.bis.org/publ/bcbsca02.pdf.

Chapter IV IRB approach (August 2026) Page 16 of 37 A34. The following factors are relevant factors for an AI to consider when assigning obligor grades. The list is not exhaustive, and the relative importance of each factor vary depending on the specific obligor. (a) historical and projected capacity to generate cash to repay the obligor’s debt and support its other cash requirements (e.g. capital expenditures required to keep it a going concern and to sustain its cash flow); (b) capital structure and the likelihood that unforeseen circumstances could exhaust its capital cushion and result in insolvency; (c) quality of earnings, i.e., the degree to which its revenue and cash flow emanate from core business operations as opposed to unique and non-recurring sources; (d) quality and timeliness of information about the obligor, including the availability of audited financial statements and their conformity with applicable accounting standards; (e) degree of operating leverage and the resulting impact that demand variability would have on the obligor’s profitability and cash flow; (f) financial flexibility resulting from its access to debt and equity markets to gain additional funding; (g) depth and skill of the management to effectively respond to changing conditions and deploy resources, and its degree of aggressiveness vs. conservatism; (h) its position within the industry and its future prospects; and (i) the risk characteristics of the jurisdiction in which it is operating, and the extent to which the obligor will be subject to transfer risk or currency risk if it is located in another jurisdiction. Q35. What factors should an AI consider in assigning facility grades? A35. AIs should refer to the following transaction-specific factors, where applicable, when assigning facility grades: (a) the presence of third-party support (e.g. owner/guarantor) in respect of a facility: considerable care and caution should be exercised if ratings are to be improved because of the presence of any third-party support. In all cases, AIs should be convinced that the third party is committed to ongoing support of the obligor and the credit protection is permissible under the credit risk mitigation framework of the IRB approach. AIs should establish specific rules for third-party support; (b) the maturity of the transaction: it is recognized that higher risk is associated with longer-term facilities while shorter-term facilities tend to have lower risk. A possible approach is to consider further adjustment to the facility rating

Chapter IV IRB approach (August 2026) Page 17 of 37 (after adjusting for third-party support), taking into account the remaining term to maturity; (c) the structure and lending purposes of the transaction: these may refer to the status of the obligor, the priority of the security, any covenants attached to a facility, etc., which can positively or negatively influence the strength and quality of the credit; (d) the presence of recognized collateral: AIs should carefully review the quality of collateral (e.g. documentation and valuation) to determine its likely contribution in reducing any loss. While collateral value often fluctuates with market rates, it should be assessed in a conservative manner (e.g. based on net realizable value or forced-sale value, where necessary). Q36. Is there any expectation on the mapping referred to in §158(2)(c) regarding the supervisory slotting criteria approach?29 A36. There is no expectation that the criteria adopted by an AI to assign exposures to internal grades perfectly align with the criteria that define the supervisory rating grades. Nonetheless, AIs— (a) must demonstrate that their mapping process has resulted in an alignment of grades consistent with the preponderance of the characteristics in the respective supervisory rating grade; and (b) should take special care to ensure that any overrides of their internal criteria do not render the mapping process ineffective. Rating structure Q37. Is it possible for an AI to have more than one obligor grade or pool to which exposures to obligors who are in default can be assigned? A37. Yes, provided that the rating definitions and criteria of these obligor grades or pools are clear and specific. Q38. Are there specific requirements for defining obligor grades?30 A38. An obligor grade is defined as an assessment of obligor risk on the basis of a specified and distinct set of rating criteria, from which estimates of PD are derived. The grade definition must include a description of the degree of default risk typical for obligors assigned the grade, and the criteria used to distinguish that level of credit risk. Furthermore, “+” or “-” modifiers to alpha or numeric grades will only qualify as distinct grades if the institution has developed complete rating descriptions and 29 Reference: Basel Framework CRE36.28. 30 Reference: Basel Framework CRE36.20.

Chapter IV IRB approach (August 2026) Page 18 of 37 criteria for assigning them, and has separately quantified estimates of PD for these modified grades. Q39. What are the requirements concerning rating structure on facility grade in respect of rating structure?31

A39. There is no specific minimum number of facility grades required for AIs using the advanced IRB approach to estimate LGD. An AI must have a sufficient number of facility grades to prevent the grouping facilities with widely varying LGDs into a single grade. The criteria used to define facility grades must be grounded in empirical evidence. Q40. What are the requirements concerning rating structure for specialized lending exposures?32

A40. In respect of rating systems for specialized lending— (a) under the supervisory slotting criteria approach, the system must have at least four obligor grades for non-default obligors and one for defaulted obligors (re: §151(3)), and (b) under the foundation IRB approach or advanced IRB approach, the system must comply with the same requirements concerning rating structure as those for corporate exposures that are not specialized lending. Q41. What are the expectations in respect of rating structure for loan portfolios concentrated on a particular market segment and range of default risk? Under what circumstances will the MA regard an AI’s process for assigning its exposures to obligor grades, as leading to excessive concentration on a particular obligor grade?33

A41. AIs with loan portfolios concentrated in a particular market segment and a range of default risk must have enough grades within that range to avoid undue concentration of obligors in particular grades. Significant concentration within a single grade or grades must be supported by convincing empirical evidence that the grade or grades cover reasonably narrow PD bands and that the default risk posed by all obligors in a grade fall within that band. Generally, if an AI’s process of assignment results in more than 30% of its exposures being assigned to a particular obligor grade, this will be regarded as a sign of excessive concentration. Rating assignment horizon 31 Reference: Basel Framework CRE36.22. 32 Reference: Basel Framework CRE36.23. 33 Reference: Basel Framework CRE36.21.

Chapter IV IRB approach (August 2026) Page 19 of 37 Q42. What measures an AI may take to satisfy the requirements of §§153(a) and 173(a)?34 A42. AIs may satisfy these requirements by— (a) basing rating assignments on specific, appropriate stress scenarios; or (b) taking appropriate consideration of obligor characteristics that are reflective of the obligor’s vulnerability to adverse economic conditions or unexpected events, without explicitly specifying a stress scenario. For the expectations on the range of economic conditions, see §153(b) and §173(b) and Q43. Given the difficulties in forecasting future events and their potential impact on a particular obligor’s financial condition, an AI must assess the relevant information prudently and take a conservative view of projected information (re: §153(c) and §173(c)). In situations where limited data are available, an AI must adopt a conservative bias to its analysis. Q43. What are the requirements concerning the drivers of migrations from one category of obligor grade to another for the assessments referred to in §§153(b) and 173(b)? 35 A43. The range of economic conditions that are considered when making assessments referred to in §§153(b) and 173(b) must be consistent with current conditions and those that are likely to occur over a business cycle within the respective industry/geographic region. Rating systems should be designed in such a way that idiosyncratic or industry-specific changes are a driver of migrations from one category to another, and business cycle effects may also be a driver. Q44. How are highly leveraged obligors to be defined (e.g. will non-financial entities be included in the definition)? Furthermore, how should the estimates of PD of highly leveraged non-financial counterparties be estimated if there are no underlying traded assets or other assets with observable prices? (re: §153(d))36 A44. The reference to highly leveraged obligors is intended to capture hedge funds or any other equivalently highly leveraged counterparties that are financial entities. In the case of highly leveraged counterparties that are likely to be significantly vulnerable to market risk, an AI must assess the potential impact on the counterparty’s ability to perform that arises from “periods of stressed volatilities” when assigning a rating and corresponding PD to that counterparty under the IRB approach. Integrity of rating process 34 Reference: Basel Framework CRE36.32. 35 Reference: Basel Framework CRE36.30. 36 Reference: FAQ1 and FAQ2 inserted to Basel Framework CRE36.31.

Chapter IV IRB approach (August 2026) Page 20 of 37 Q45. §155(a) requires that policies and procedures be in place to ensure that the rating process of an AI be “independent” of the staff and management responsible for originating such exposures. Please elaborate on this independence criterion. A45. Consistent with the generic interpretation of “independence” in risk management, the following scenarios would generally indicate that a member of the staff or management of an AI37 is considered “independent” of the credit origination process for an exposure for the purposes of §155(a): (a) the person does not directly stand to benefit from the extension of credit (e.g. through bonuses or other types of monetary or non-monetary compensation that are primarily linked to the origination of credit exposures); (b) the person is independent of the institution’s risk-taking functions, in terms of decision-making, reporting structure and resourcing (i.e. the risk-taking functions do not control the person’s remuneration package, or the budget or financing of the organisational unit to which that person belongs); and (c) the person is free from potential conflicts of interest in relation to the credit origination process in general and the exposures being rated or reviewed in particular (e.g. not being a connected person, as defined by the relevant regulatory and supervisory requirements applicable to the institution, in respect of the obligor of the exposure concerned). Q46. What is the supervisory expectation on the timeliness of rating review in response to new material information on an exposure in respect of audited financial statements of obligors (re: §155(c))? A46. In assessing whether an AI has timely incorporated new material financial information in respect of the audited financial statements of obligors into rating assignments under §155(c), the HKMA will consider various factors, including the regulations and accounting standards in different jurisdictions, the utilisation of information within a rating system, the characteristics of obligors, and an indicative benchmark of a 15-month time lag38. Similar to the guidance provided in A7, other reliable information, subject to necessary adjustments, may be used when the updated audited financial report is unavailable. The HKMA considers that conservative adjustments to rating assignments could be used to compensate for the use of stale data, but these adjustments cannot replace an AI’s efforts to obtain new material information on exposures in order to ensure the integrity of its rating process, as required by §155(c). 37 In cases where the rating approval process is highly automated, this refers to the parties responsible for overseeing the process. 38 For certain types of corporate obligors, it is not necessarily unacceptable for an AI’s internal benchmark of a time lag to exceed 15 months, provided that the internal benchmark is justified by genuine practical difficulties and has been approved by senior management following consideration of challenges received in independent reviews, such as those from the independent validation function or internal audit function.

Chapter IV IRB approach (August 2026) Page 21 of 37 Q47. Please provide guidance on how an AI can ensure the integrity of rating process, in addition to the requirements set out in §§155 and 175?39 A47. In line with the requirements set out in §§155 and 175— (a) Rating assignments and periodic rating reviews must be completed or approved by a party that does not stand to benefit from the extension of credit. (b) AIs should adhere to the requirements set out in the SPM module CR-G-2 “Credit Approval, Review and Records” relating to credit approval and review. (c) Credit policies and underwriting procedures must reinforce and foster the independence of the rating process. (d) In addition to §155(b) 40 , obligor and facility ratings must be refreshed whenever material information on the obligor or facility comes to light. Upon receipt of such information, an AI needs to have a procedure to update the obligor’s rating in a timely fashion. The rating should generally be updated within 90 days for performing obligors and within 30 days for obligors with weakening or deteriorating financial conditions. (e) The review of the risk characteristics and delinquency status of each pool of retail exposures, as required under §175(b), may be conducted by reviewing a representative sample of exposures in the pool. 6. Estimation of credit risk components41 General Q48. What are the regulatory requirements on the data for the estimation of credit risk components?42 A48. Internal estimates of PD, LGD, and EAD must incorporate all relevant, material and available data, information and methods. An AI may utilise internal data and data from external sources (including pooled data), provided that─ (a) the AI must demonstrate that its estimates are representative of long run experience (covering at least one economic cycle which captures a reasonable mix of high-default and low-default years) (re: §148(d)(i)); (b) the AI must also demonstrate that the economic or market conditions that underlie the data are relevant to current and foreseeable conditions (re: 39 Reference: Basel Framework CRE36.40 to CRE36.43 40 That section requires a regular review and update of rating assignment (at least annually), with riskier exposures subject to a higher frequency. 41 Reference: §§148, 159 – 169, 177 – 182, 195 – 202C and 203 – 219 of the BCR. 42 Reference: Basel Framework CRE36.66, CRE36.79, CRE36.82, CRE36.87, CRE36.88, CRE36.98 and CRE36.99. Separately, this Q&A is referred to in footnote 23 of paragraph 6.4.2 of SPM module CA-G-4 “Validating Risk Rating Systems under the IRB Approach”.

Chapter IV IRB approach (August 2026) Page 22 of 37 §148(d)(ii)); (c) the population of exposures represented in the data used for estimation, and lending standards in use when the data were generated, and other relevant characteristics should be closely matched to or at least comparable with those of the institution’s exposures and standards; (d) the number of exposures in the sample and the data period used for quantification must be sufficient to provide the AI with confidence in the accuracy and robustness of its estimates; and (e) the criteria for identifying the default of an obligor in respect of an exposure must comply with §149. In addition, the data should be in compliance with the specific requirements set out in – (a) §159(1)(d) for the estimation of PD under the foundation IRB approach or the advanced IRB approach; (b) §161(1)(e) for the estimation of LGD under the advanced IRB approach; (c) §164(4)(f) for the estimation of EAD under the advanced IRB approach; (d) §177(1)(e) and (2) for the estimation of PD under the retail IRB approach; (e) §178(1)(g) for the estimation of LGD under the retail IRB approach; and (f) §180(3)(b) for the estimation of EAD under the retail IRB approach. Further to meeting the specific requirements for the minimum data observation period, if the available observation period for any source spans a longer period, and the data are relevant and material, then this longer period must be used. In addition, as a general principle, the less data an AI has, the more conservative it must be in its estimation of credit risk components. Q49. Generally, the estimation of PD, LGD and EAD requires the data source, among other things, to cover at least one economic cycle (see Q48 above). What is meant by an “economic cycle”? A49. There is no universally accepted definition of the term “economic cycle”. However, an “economic cycle” typically consists of a sequence of 4 distinct phases as described below– (a) economic downturn (or economic contraction) which depicts a trend of slowdown in the level of economic activity in terms of real GDP and other macroeconomic variables; (b) economic trough which describes the bottom of an economic cycle where an

Chapter IV IRB approach (August 2026) Page 23 of 37 economic downturn turns into an economic upturn; (c) economic upturn (or economic expansion) which depicts a trend of acceleration in the level of economic activity in terms of real GDP and other macroeconomic variables; and (d) economic peak which describes the peak of an economic cycle where an economic upturn turns into an economic downturn. Q50. Should AIs add a margin of conservatism to estimates of credit risk components to account for the fact that historical data are less satisfactory for capturing climate-related financial risks, thereby increasing the likely range of errors?43 A50. When an AI’s credit portfolio is materially exposed to climate-related financial risks, the institution should strive primarily to consider these risks directly in its estimates. To account for data deficiencies, such as poor data quality or scarce climate-related data, and other sources of additional uncertainties, the AI should incorporate a margin of conservatism. For further guidance, please refer to FAQ1 inserted to Basel Framework CRE36.67 and FAQ2 inserted to Basel Framework CRE36.86. Loss given default (“LGD”) Q51. Are the LGD floor values in Table 19A intended to be applied uniformly to all recognized collaterals under the advanced IRB approach, irrespective of whether they are recognized financial collateral or recognized IRB collateral? If a recognized collateral cannot be mapped to any of the four types of collateral listed in the table, what LGD floor value should be used for the purposes of §161? A51. In accordance with §139(1), a recognized collateral under the advanced IRB approach means any collateral which— (a) is recognized by an AI for credit risk mitigation in accordance with its policies and procedures, and (b) satisfies the requirements under §77(2). For the purposes of §161, an AI may map a recognized collateral that secures an exposure under the advanced IRB approach to the LGD floors by types of recognized collateral as specified in Table 19A of §161. In this connection, an AI should maintain comprehensive policies and procedures regarding collateral recognition for capital calculation purposes. Any recognized collaterals that an AI is unable to map to the categories specified in Table 19A should be excluded from the LGD floor determination. Maturity under foundation IRB approach / advanced IRB approach 43 This Q&A is referred to in footnote 9 of paragraph 3.5.8 of SPM module CA-G-4 “Validating Risk Rating Systems under the IRB Approach”.

Chapter IV IRB approach (August 2026) Page 24 of 37 Q52. §167(1)(c) and (2) allows an AI that uses the foundation IRB approach to give written notice to the MA within 7 days after commencing to calculate the maturity (“M”) of the institution’s corporate, sovereign and bank exposures in accordance with §168. What requirements should an AI meet for the purpose of this arrangement? A52. To strike a balance among flexibility, operational complexity and potential regulatory arbitrage, AIs are expected to– (a) switch the maturity treatment of all their applicable corporate, sovereign and bank exposures from the foundation IRB approach to the advanced IRB approach, without the option of partial adoption or phased implementation. 44

Furthermore, the maturity treatment under §168 should be adopted for any subsequent applications for switching the calculation approach of other corporate, sovereign and bank exposures from the STC approach to the foundation IRB approach; (b) establish rigorous internal processes and systems to capture the relevant data and calculate the maturity of exposures under the advanced IRB approach. Institutions should put in place adequate controls and monitoring to ensure the reliability and accuracy of the M used in regulatory capital calculation. Please refer to sections 4 to 6 of the SPM module CA-G-4 “Validating Risk Rating Systems under the IRB Approach” in this regard; and (c) subject the related processes and systems to adequate assessment by a competent independent party with proper documentation available for review by a third party. The “independent party” and the “third party” can be managed by departments or units within an institution, provided that these parties are independent from the development of the rating systems and related processes for determining M. Calculation of risk-weighted amount in respect of purchased receivables Q53. Regarding the use of top-down approach for the purchased receivables for default risk or dilution risk of an institution, §200(c) requires AIs to comply with Division 6 of the BCR in respect of the methods and data used for estimating the PD and LGD (or, if applicable, EL). Further guidance is sought in this respect.45

44 As a transitional arrangement, an AI that— (i) had obtained the MA's consent under the pre-amended §167(c) before 1 January 2025 to calculate the M under §168 for specific, but not all, corporate, sovereign or bank exposures, and (ii) encounters genuine difficulties in calculating the maturity for all relevant exposures in accordance with §168 by the commencement of the revised §167, may continue the prevailing calculation until the date set out in its plan to expand the treatment under §168 to all relevant corporate, sovereign or bank exposures agreed by the MA. Also note that, regardless of whether the previous consent covers all or specific corporate, sovereign or bank exposures, an AI must give written notice to the MA in the manner specified in §167(2), i.e. the previous consent has no bearing on the notification requirement. 45 Reference: Basel Framework CRE36.114.

Chapter IV IRB approach (August 2026) Page 25 of 37 A53. The quantification should reflect all information available to the purchasing institution regarding the quality of the underlying receivables, including data for similar pools provided by the seller, by the purchasing institution, or by external sources. The purchasing institution must determine whether the data provided by the seller are consistent with expectations agreed upon by both parties concerning, for example, the type, volume and on-going quality of receivables purchased. Where this is not the case, the purchasing institution is expected to obtain and rely upon more relevant data. Q54. Are there any special considerations regarding the use of the top-down approach to estimate PD and LGD (or EL, if applicable) for the calculation of the risk￾weighted amount for default risk of purchased receivables (as referred to in §§198 and 200)? A54. For the purposes of using the top-down approach to calculate the risk-weighted amount for default risk of purchased receivables, AIs must be operationally capable of managing various risks associated with the pool of purchased receivables and their advances against those receivables, as described in Basel Framework CRE36.114 to CRE36.121. To achieve this, AIs should establish requisite systems, policies and controls that are comparable to those applicable to the recognition of financial receivables for credit risk mitigation purposes under the IRB approach set out in §205(1) (re: Basel Framework CRE36.134 to CRE36.142), or that reflect general credit risk management principles set out in the HKMA’s supervisory guidelines. The overarching objective is to ensure that AIs’ use of the top-down approach is supported by prudent risk management of the purchased receivables designed to safeguard their claims on those receivables from potential loss. Key elements of systems, policies and controls relevant to the risk management of purchased receivables are highlighted as follows. Please also refer to Basel Framework CRE36.116 to CRE36.121 for further guidance. (a) Legal certainty: to ensure that, through the proper structuring of the contractual terms of the relevant facility and through the verification of payments where applicable, there is effective ownership and control of the purchased receivables and the associated cash receipts or remittances, including in cases where the seller or servicer of the receivables is in financial distress or bankruptcy; (b) Effective monitoring and work-out systems: including measures to ensure the effective monitoring of both the quality of the purchased receivables and the financial condition of the relevant sellers and servicers. These would cover: (i) assessment of correlation between these two factors and safeguards against related contingencies; (ii) assessment of eligibility of the sellers and servicers and their credit risk management and collection systems; (iii) assessment and monitoring of the risk characteristics (including concentration risk) of the receivables; (iv) monitoring compliance with established policies, procedures and limits in respect of exposures to receivables; (v) monitoring and handling of problem credits; and (vi) related management reporting and documentation requirements;

Chapter IV IRB approach (August 2026) Page 26 of 37 (c) Effective controls over purchased receivables, credit availability and cash: including having clear and effective policies and procedures to govern key aspects of the receivables purchase programme (“RPP”), including collateral requirements and controls, advancement of funds and receipt of cash; and (d) Compliance with internal policies and procedures: including an effective internal process to assess compliance with critical policies and procedures through: (i) regular internal and/or external audits of all critical phases of the RPP; (ii) verification of separation of duties between business and risk management functions; and (iii) adequacy of back-office operations. Credit risk mitigation Q55. Please provide examples of recognized financial receivables.46 A55. Recognized financial receivables include both self-liquidating debt arising from the sale of goods or services linked to a commercial transaction and general amounts owed by buyers, suppliers, renters, national and local governmental authorities, or other non-affiliated parties not related to the sale of goods or services linked to a commercial transaction, that fulfils §205. Q56. Guidance is sought on the legal certainty and risk management requirements set out in §205?47 A56. Certain provisions of §205 are elaborated below. An AI must also comply with the requirements set out in the SPM module CR-G-7 “Collateral and Guarantees”. (a) The legal mechanism by which collateral is given must be robust and ensure that the lender has clear rights over the proceeds from the collateral. All documentation used in collateralised transactions must be binding on all parties and legally enforceable in all relevant jurisdictions. AIs must have conducted sufficient legal review to verify this and have a well-founded legal basis to reach this conclusion and undertake such further review as necessary to ensure continuing enforceability. (re: §205(1)(a) and (c)) (b) The process for assessing, monitoring and controlling the credit risk of the receivable collateral referred to in §205(1)(g) should include, among other things, analyses of the obligor’s business and industry (e.g. the effects of the business cycle) and the types of customers with whom the obligor does business. (c) The institution must maintain a continuous monitoring process that is appropriate for the specific exposures (either immediate or contingent) attributable to the collateral to be utilised as a risk mitigant. This process may include, as appropriate and relevant, ageing reports, control of trade documents, 46 Reference: Basel Framework CRE36.133. 47 Reference: Basel Framework CRE36.134 to CRE36.142.

Chapter IV IRB approach (August 2026) Page 27 of 37 borrowing base certificates, frequent audits of collateral, confirmation of accounts, control of the proceeds of accounts paid, analyses of dilution (credits given by the obligor to the issuers) and regular financial analysis of both the obligor and the issuers of the receivables, especially in the case when a small number of large-sized receivables are taken as collateral. Observance of the AI’s overall concentration limits should be monitored. Additionally, compliance with loan covenants, environmental restrictions, and other legal requirements should be reviewed on a regular basis. (d) In addition to the two factors referred to in §205(1)(i), the potential concentration risk within an institution’s total exposures shall, where applicable, also be reflected in the loan-to-value ratio referred to in that section. Q57. Guidance is sought on the recognition of subsequent liens on, or subsequent charge over, the property collateral referred to in §206(c)(ii).48

A57. Subsequent liens or subsequent charges (“junior liens”) may be taken into account where there is no doubt that the claim for collateral is legally enforceable and constitutes an efficient credit risk mitigant. Where junior liens are recognized, an AI must first take the haircut value of the collateral, then reduce it by the sum of all exposures with liens that rank higher than the junior lien, the remaining value is the collateral that supports the exposure with the junior lien. In cases where liens are held by third parties that rank pari passu with the lien of the institution, only the proportion of the collateral (after the application of haircuts and reductions due to the value of exposures with liens that rank higher than the lien of the institution) that is attributable to the institution may be recognized. Q58. Guidance is sought on the operational requirements to constitute commercial or residential real estate as recognized commercial real estate or recognized residential real estate.49 A58. Apart from observing paragraphs (a) to (l) of §206, 50 AIs must monitor on an ongoing basis the extent of any permissible prior claims (e.g. tax) on the property. For the purposes of §206(f), among other measures, an AI should ensure any claim on collateral is properly filed on a timely basis. Regarding paragraph (j) of §206, AIs should conduct more frequent monitoring of the property collateral when the relevant property markets experience significant changes in conditions such as heightened volatility. Statistical methods of evaluation (e.g., reference to property price indices and sampling) may be used to update estimates or to identify collateral that may have declined in value and that may need re-appraisal. A qualified professional must evaluate the property when information 48 Reference: Basel Framework CRE36.131(4). In addition, it is recognized that in some jurisdictions, first liens are subject to the prior right of preferential creditors, such as outstanding tax claims and employees’ wages (re: CRE36.131(4)). 49 Reference: Basel Framework CRE36.130, CRE36.131(1) and (3), CRE36.132(3) and (4). 50 To avoid doubt, specialized lending of income-producing real estate is specifically excluded from recognition as collateral for corporate exposures in accordance with §§143(1)(d) and 206(a).

Chapter IV IRB approach (August 2026) Page 28 of 37 indicates that the value of the collateral may have declined materially relative to general market prices or when a credit event, such as default, occurs.51

AIs must also appropriately monitor the risk of environmental liability arising in respect of the collateral, such as the presence of toxic materials on the property. The assessment of the risk of environmental liability should have been a part of their collateral management, where a risk-based approach to the assessment and monitoring of it is deemed acceptable. Specifically, an AI’s collateral management system should specify possible follow-up actions for negative monitoring results, and the removal of a property’s eligibility as collateral for capital adequacy purposes should be one of the options where warranted. Such monitoring may be carried out on a best effort basis, but should not rely on a single tool such as solely checking for negative news. Q59. Guidance is sought on the recognition of physical collateral for an exposure secured by a general security agreement (or an equivalent form of floating charges) under the foundation IRB approach.52

A59. If an AI’s exposure is secured by a general security agreement (or an equivalent form of floating charge) over both recognized collateral and other types of collateral, the institution may only recognize the security interest over the recognized collateral. Such recognition is conditional on the fulfilment of the relevant operational requirements set out in §207. Q60. What should an AI observe regarding the periodic revaluation under §207(j) of “fashion-sensitive” physical collateral?53

A60. For the purposes of the periodic revaluation process, besides those requirements applicable to all physical collateral, an AI must pay particular attention to “fashion￾sensitive” collateral to ensure that valuations are appropriately adjusted downward of fashion, or model-year, obsolescence as well as physical obsolescence or deterioration. Q61. In general, what circumstances would be considered not practicable for an AI to conduct periodic inspections of physical collateral as required under §207(j)? A61. An AI that has not conducted a periodic inspection of physical collateral on practicality grounds under §207(j) should be ready to explain, and substantiate with objective and reliable evidence, why it has not been possible or feasible for the institution to conduct a physical inspection. The institution’s justification will be assessed on a case-by-case basis, taking into account the specific circumstances of 51 These procedures should be detailed in AIs’ management policies and procedures of credit risk mitigant, including triggers for more frequent monitoring and evaluation by qualified professionals. Furthermore, AIs are reminded to comply with the requirements in Section 5 “Valuation of collateral” in the SPM module CR-G-7 “Collateral and Guarantees”. 52 Reference: Basel Framework CRE36.145. 53 Reference: Basel Framework CRE36.144(4).

Chapter IV IRB approach (August 2026) Page 29 of 37 the institution at the relevant time. Physical inspections may be hindered by events such as— (a) the institution concerned was subject to some form of severe bank-wide distress or crisis, rendering it imprudent to allocate resources to some routine operations, such as scheduled inspections of physical collateral; (b) the physical collateral to be inspected was contaminated (e.g. by chemical spills), rendering it hazardous for staff of the institution to conduct the inspection; (c) the physical collateral to be inspected was located in an area where there was a severe natural disaster (e.g. an earthquake). These examples are provided for illustrative purposes only and it should be noted that strong justifications will be required to support claims of impracticability of inspection. The HKMA would not concur that it was not practicable for an AI to conduct periodic inspection of physical collateral as required under §207(j) if the institution clearly had the ability, and was in a position, to do so without incurring significant cost or effort. Therefore, a general principle is that if a “hindering” event is outside the control or influence of the institution concerned, the HKMA would be more inclined to accept it as an acceptable justification for the purposes of §207(j). Q62. Could an AI take into account the credit risk mitigating effect of a recognized guarantee or a recognized credit derivative contract if the institution does not use the IRB approach to calculate its credit risk for exposures to the guarantor or counterparty? A62. Yes. An AI is allowed to take into account the credit risk mitigating effect of a recognized guarantee or a recognized credit derivative contract even if the institution uses the STC approach to calculate its credit risk for exposures to the guarantor or counterparty provided the relevant requirements set out in §216 or 217, where applicable, are satisfied. Q63. What are the key requirements governing the adjustment of an AI's estimate of the PD or LGD of the underlying exposure for the purpose of taking into account the credit risk mitigating effect of a recognized guarantee or a recognized credit derivative contract under §217? A63. To take into account the credit risk mitigating effect, an AI must, according to §217(1), adjust the institution’s estimate of the PD or LGD of the underlying exposure. §217(3) further requires that if PD adjustment is chosen, such adjustment has to be made in accordance with §216, which implies that the discretionary LGD replacement under §216(3)(c) is also available. Correspondingly, an AI may reflect the concerned credit risk mitigating effect by adjusting the estimate of LGD exclusively. Regarding the criteria and processes for making adjustments to the PD and LGD estimates, §217(2) requires an AI to ensure that its criteria and processes satisfy,

Chapter IV IRB approach (August 2026) Page 30 of 37 subject to some other conditions, the requirements set out in Part 6 of the BCR applicable to the institution for assigning exposures to obligor grades and facility grades. As such, the guarantor, the counterparty and the credit risk mitigant are subject to the same requirements on rating assignment and credit risk component estimation as the obligor and the underlying exposure. In addition, §217(2) also aims to cover Basel Framework CRE32.27, which stipulates that adjustments, whether made through PD or LGD, must be made consistently for a given guarantee or credit derivative type. 7. Treatment of expected losses and eligible provisions54 Q64. Why is an AI required to compare its total eligible provisions with its total EL amount as calculated under the IRB approach for determining its capital base? A64. The IRB approach is based on measures of unexpected losses and expected losses. For capital adequacy purposes, an AI should cover its expected losses by making adequate provisions and cover its unexpected losses by setting aside sufficient regulatory capital. The formulae used (e.g. Formula 16 of the BCR) to calculate the risk-weighted amount of an exposure produce a capital requirement for the exposure which covers unexpected loss only.55 Each AI is thus required to separately calculate the total EL amount of its exposures subject to the IRB approach and compare the amount so calculated with the total eligible provisions which are attributable to these exposures. Any excess of, or shortfall in, an AI’s eligible provisions should then be reflected in the institution’s capital base, as if the institution had reduced, or increased, its provisions to a level that would fully cover its expected losses. This rationale explains why requirements for an AI to calculate its EL amount for its other exposures under the specific risk-weight approach is not required. Q65. How should an AI apportion its total regulatory reserve for general banking risks and collective provisions for the purpose of §221 if the institution uses a combination of approaches, say the IRB approach and STC approach, to calculate its credit risk? A65. The method of apportionment is set out in §42(2)(a). In general, an AI should apportion its total regulatory reserve for general banking risks and collective provisions among the approaches it uses to calculate its credit risk (i.e. the STC approach, the IRB approach, SEC-IRBA, SEC-ERBA, SEC-SA and SEC-FBA) on a pro rata basis. The apportionment should be made in accordance with the proportions of the institution’s risk-weighted amount for credit risk calculated using the different approaches. However, if an AI has obtained the MA’s prior consent under §42(2)(b), the institution may use its own method to apportion its total regulatory reserve for general 54 Reference: §§42, 43 and 220 – 223. 55 Please refer to “An Explanatory Note on the Basel II IRB Risk Weight Functions” issued by BCBS in July 2005 for further information in this regard.

Chapter IV IRB approach (August 2026) Page 31 of 37 banking risks and collective provisions among the various approaches used, provided that the institution can justify doing so. Q66. What information would the MA obtain to determine whether to give the consent to an AI, which uses the foundation IRB approach, to use the supervisory estimate for the LGD as the EL of its corporate, sovereign and bank exposures which are in default under §220(2)(c)? A66. Without limiting the information to be obtained by the MA, an AI needs to demonstrate that the external auditor of the institution has not qualified the institution’s provisioning practices (including models/methodologies used to determine expected credit losses or other impairment allowances) in the auditor’s report or in any reports prepared for the purposes of §§59(2) or 63(3A) of the Banking Ordinance, for the preceding 24 months, where applicable. 8. IRB use test 56 Q67. What is the rationale behind the IRB use test? 57

A67. The IRB use test is based on the concept that supervisors can take additional comfort in the credit risk components generated by a bank’s rating system where such components play an essential role in how the bank measures and manages risk in its businesses. If a bank were to use the credit risk components generated by its rating system solely for regulatory capital purposes, this could create an incentive for the bank to minimise its capital requirements, rather than produce an accurate measurement of those components. Moreover, a bank would have less incentive to maintain the accuracy and timeliness of the credit risk components accurate, whereas if using these components in the bank’s internal decision-making processes would automatically create an incentive for the bank to ensure the quality and robustness of the rating system that generates these components. It is considered that the IRB use test plays a key role in ensuring and promoting the accuracy, robustness and timeliness of the credit risk components generated by an AI’s rating system, thereby confirming the institution’s confidence in those components and enabling the MA to place greater reliance on the institution’s rating system, which in turn enhances the adequacy of its regulatory capital. Q68. How long does the MA expect an AI to have been using its rating system prior to the institution adopting the IRB approach for regulatory capital purposes? A68. In general, any AI that seeks to use the IRB approach is required to have a credible track record of at least 3 years in using its rating system for the relevant exposures (which should be broadly consistent with the minimum requirements set out in the BCR relating to the use of the IRB approach) prior to the institution becoming qualified to use the relevant IRB approach. The MA will nevertheless take into account all relevant circumstances in deciding the use test period, which may be 56 The requirements regarding the track records in using a rating system set out in §§(1)(b)(v) and (vi) and 2(b) of Schedule 2 of the BCR are collectively referred to as the “IRB use test” herein. 57 See BCBS Newsletter No. 9 “The IRB Use Test: Background and Implementation” issued in September 2006.

Chapter IV IRB approach (August 2026) Page 32 of 37 longer or shorter than 3 years, during which an AI should use its rating system prior to adopting the IRB approach. Q69. If an AI’s rating system has been developed by its parent bank and used at the group level for a certain period of time, is the institution allowed to observe a shorter use test period than would otherwise be required? A69. Even if an AI’s rating system developed by its parent bank has been used at the group level for some time, the MA would still expect the institution to have a credible track record of at least 3 years in using its rating system for the institution’s exposures. Q70. If an AI refines or modifies its rating system during the use test period, does the use test period have to start again from the date of the refinement or modification?58 A70. Generally, refinements or modifications to an AI’s rating system will not render the institution non-compliant with the IRB use test. The use test period will usually only have to start again if the refinements or modifications involve a significant change in the design or operation of an AI’s rating system that substantially alters the ways the institution uses the internal ratings and default and loss estimates generated by the rating system. Q71. If an AI intends to start using its rating system for different portfolios (or segments) of exposures on different dates (e.g. phased implementation by business units), on which date does the use test period commence? A71. The MA would consider it reasonable for an AI to treat the use test period for its rating system as commencing on the date the rating system is used for a substantial portion (say, at least 50%) of the exposures in respect of which it intends to adopt the IRB approach. Q72. What is the meaning of the term “essential role” in §1(b)(v) and (vi) of Schedule 2? A72. “Essential role” means that the information generated by an AI’s rating system should be used in a manner that exerts a direct and observable influence on the institution’s internal decision-making processes. Where the internal ratings and default and loss estimates generated by the rating system are only used by an AI as auxiliary or reference information, the rating system will not normally be considered as playing an “essential role” for the purposes of §1(b)(v) and (vi) of Schedule 2. Q73. What evidence is required regarding the use of rating systems? A73. Considering that the use of internal ratings and default and loss estimates for internal decision-making purposes may vary by institution and portfolio type, the MA will normally expect an AI to have the following evidence to demonstrate that it satisfies the IRB use test– (a) the use of internal ratings and default and loss estimates should be articulated 58 Reference: Basel Framework CRE36.61.

Chapter IV IRB approach (August 2026) Page 33 of 37 in the policies relating to given areas or functions as referred to in subsection 5.4 of the SPM module CA-G-4 “Validating Risk Rating Systems under the IRB Approach” as approved by the institution’s board of directors or senior management; (b) for each area (or function) of use, there should be a clear indication that the information generated by the institution’s rating system plays an essential role in its internal decision-making process and that there is a clear relationship between the information generated by the rating system and the decisions made or actions taken (such indication should be able to facilitate the internal audit review as required in item (d) below); (c) users should be able to articulate how the information generated by the institution’s rating system is used and what role it plays in the institution’s internal decision-making process; and (d) regular internal audit reviews should be conducted to verify compliance with the institution’s approved policies referred to in item (a) above. Documentation of internal challenges to the accuracy, robustness or timeliness of the relevant internal ratings and default and loss estimates during the internal decision￾making process, together with any follow-up actions taken, will also be regarded as evidence which demonstrates the institution’s commitment to the validity of its rating system for internal use. 9. Stress-testing59 Q74. What types of stress tests should an AI conduct for the purpose of §1(h) of Schedule 2? 60 A74. An AI using the IRB approach is expected to conduct general stress tests which must involve identifying possible events or future changes in economic conditions that could have unfavourable effects on the institution’s credit exposures and assessment of its ability to withstand such changes. Examples of stress scenarios that may be used include economic or industry downturns, market risk events (such as currency, stock or bond market crises) and liquidity squeezes. At a minimum, a specific stress test should be conducted to assess the effect of mild recession scenarios on the AI’s estimates of credit risk components.61 In devising the stress scenario for this specific stress test, the institution may have regard to the conditions experienced in any 2 or more consecutive quarters of negative GDP growth occurring in Hong Kong during the period from 2001 to 2003 and/or occurring 59 Reference: §1(h) of Schedule 2 of the BCR. Separately, this section is referred to in paragraph 3.7.1 of SPM module CA-G-4 “Validating Risk Rating Systems under the IRB Approach”. 60 Reference: Basel Framework CRE36.50 and CRE36.51. 61 Where an AI operates in several markets, it does not need to test for the conditions in all of those markets, but an AI should stress portfolios containing the vast majority of its total exposures (re: Basel Framework CRE36.53).

Chapter IV IRB approach (August 2026) Page 34 of 37 during other financial crises relevant to the institution, e.g. the global financial crisis in 2007/2008 or the subsequent European sovereign debt crisis. The impact of the stress scenario should be assessed based on a 1-year time horizon and take into account the lag effect of the recession on the institution’s credit exposures. The purpose of this specific stress test is to assess whether the assumptions and data used in the institution’s rating system are prudent enough to ensure that its regulatory capital calculated under the IRB approach is sufficient to cover any potential loss arising in a period of mild recession.62 The MA would expect to be consulted by the institution on the choice of the stress scenario to be used for this specific stress test. Please also refer to the SPM module IC-5 “Stress-testing” for guidance on the key elements of an effective stress-testing programme. Q75. Is there any guidance on the sources of information for the stress tests for the purpose of §1(h) of Schedule 2? 63 A75. Whatever method of stress-testing is used, an AI must include a consideration of the following sources of information. (a) The institution’s own data should allow estimation of the ratings migration of at least some of its exposures. (b) The institution should consider information about the impact of smaller deterioration in the credit environment on the institution’s ratings, giving some information on the likely effect of bigger, stress circumstances. (c) The institution should evaluate evidence of ratings migration in external ratings. This would include the institution broadly matching its buckets to rating categories. Q76. How frequently should an AI conduct its stress tests for the purpose of §1(h) of Schedule 2? A76. Generally, an AI is expected to conduct its stress tests referred to in A74 above at least on an annual basis or more frequently if this is warranted by significant changes in the business strategies of the AI or in the external environment in which it operates. Q77. What are the HKMA’s expectations regarding stress tests for the purpose of §1(h) of Schedule 2 in addition to the applicable requirements set out in the SPM module IC-5 “Stress-testing”? A77. The HKMA expects an AI to: 62 It is acknowledged that the results of the stress test may indicate no difference in the capital calculated if an AI uses such an approach for its internal rating purposes (re: Basel Framework CRE36.53). 63 Reference: Basel Framework CRE36.52.

Chapter IV IRB approach (August 2026) Page 35 of 37 (a) conduct a regular credit risk stress test to assess the effect of specific conditions on their total regulatory capital requirements for credit risk. The test may be chosen by the AI, and would be subject to supervisory review by the HKMA; (b) use a static or dynamic test or both to calculate the impact of the stress scenario; (c) ensure that the key data for stress-testing (e.g. internal ratings, exposure amount, collateral value) are timely, valid and of the required quality; (d) ensure that the assumptions underlying the risk models (e.g. credit portfolio models, credit pricing models), if any, employed in the stress test will also be valid in stress situations, especially regarding default rate volatility, rating migrations, and correlation between individual credit facilities or obligors; and (e) take remedial action to reduce risks and/or to hold additional capital/provisions when the results of their stress test indicate a deficiency of capital calculated based on the IRB approach. Q78. What would be the consequences for an AI which fails to address any shortfall in its regulatory capital identified by the specific stress test referred to in A74 above? A78. The two most likely consequences are that – (a) the MA may refuse to grant an approval to, or may withdraw an approval from, an AI for the use of the IRB approach if he is satisfied that the institution fails to operate its rating system in a prudent and consistently effective manner as required under §1(b)(iii) of Schedule 2; and (b) the MA may consider exercising his power under §97F of the Banking Ordinance to vary any capital requirement rule applicable to an AI, including by increasing all or any of the institution’s CET1 capital ratio, Tier 1 capital ratio and Total capital ratio (see item B6.2 in Annex B of the SPM module CA￾G-5 “Supervisory review process”). Q79. Should AIs consider climate-related risk drivers as possible events or future changes when performing stress tests used in the assessment of capital adequacy? A79. Climate-related financial risks may have a significant impact an AI’s credit exposures within the assessment period. An AI should refer to FAQ1 attached to Basel Framework CRE36.50 for guidance on stress-testing purposes. 10. Parallel calculations64 64 Reference: §§2(a) and 3 of Schedule 2 of the BCR.

Chapter IV IRB approach (August 2026) Page 36 of 37 Q80. What is the period of time for which the MA requires an AI to carry out parallel calculations for the purpose of demonstrating the suitability and capability of its rating system for using the IRB approach? A80. The MA would normally expect an AI to carry out parallel calculations for a period of 4 consecutive calendar quarters (i.e. 1 year) before using the IRB approach for capital calculation. For example, an AI adopting the advanced IRB approach on 1 January 2026 would be required to carry out parallel calculations based on the STC approach, as the case may be, and the advanced IRB approach for the year 2025, covering the calendar quarter end dates of 31 March, 30 June, 30 September and 31 December. The MA may, however, consider extending the period of an AI’s parallel calculations if the quality of the institution’s parallel calculations is not satisfactory, any subsequent slippage is identified in the institution’s implementation efforts, or any serious weaknesses are found in the institution’s rating system. Q81. Is an AI applying for switching the IRB calculation approach from the foundation IRB approach to the advanced IRB approach to calculate its credit risk for corporate and sovereign exposures of a particular IRB adoption class required to carry out parallel calculations? A81. Yes. The purpose of parallel calculations is to enable an AI to demonstrate to the MA’s satisfaction the suitability and capability of its rating system for the calculation of the institution’s credit risk and to familiarise itself with the use of its rating system prior to it implementing the IRB approach. As using the advanced IRB approach will require an AI to have a more sophisticated system for generating its own estimates of LGD and EAD, it is both prudent and reasonable to require the institution to provide similar parallel calculations to the MA to prove its readiness to migrate to a more advanced approach. In such a situation, the parallel calculations will consist of one set of calculations using the foundation IRB approach (i.e. the current approach used by the institution) and the other using the advanced IRB approach (i.e. the approach the institution is seeking the MA’s prior consent to use). To be consistent with the time period referred to in A80 above, the MA would expect an AI to carry out parallel calculations for a period of 4 consecutive calendar quarters (i.e. 1 year) before migrating from the foundation IRB approach to the advanced IRB approach for regulatory capital calculation. Without limiting the considerations of the MA, a shorter timeframe (unlikely to be less than 2 consecutive calendar quarters) may be agreed by the MA on a case-by-case basis after considering the relevant factors and evidence, for example, the robustness of the change management in respect of the relevant regulatory reporting and the track record of an AI in implementing the IRB approach. Q82. In what form, and using what type of data, should an AI provide its parallel calculations to the MA? A82. Generally, an AI should provide 2 sets of calculations to the MA: one based on the approach it currently adopts and the other based on the IRB approach it is applying

Chapter IV IRB approach (August 2026) Page 37 of 37 to use, using the Return of Capital Adequacy Ratio of an Authorized Institution Incorporated in Hong Kong (MA(BS)3) (“the CAR return”). As regards the calculations derived from the IRB approach, the institution should complete Part IIIc of the CAR return and other relevant items relating to the use of that IRB approach under other parts of the CAR return (e.g. Division B of Part I for the calculation of the output floor and various items in Part IIId for the calculation of the risk-weighted amount for securitization exposures if SEC-IRBA is used). If an AI encounters any practical difficulties in completing the CAR return for parallel calculation purposes, it should consult with the MA to discuss any alternative arrangement.