Large Exposures: Revised SPM Modules and Banking Returns

1 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Interpretation In this module (including the Annex):  BCBS means the Basel Committee on Banking Supervision;  BELR means the Banking (Exposure Limits) Rules (Cap.155S);  BO means the Banking Ordinance (Cap.155); and, unless otherwise specified,  other abbreviations and terms in this module follow those used in the BELR;  a reference to a Rule, Subdivision, Division or a Part means a Rule, Subdivision, Division or a Part respectively of the BELR Purpose To set out the minimum standards and requirements that AIs are expected to follow, and to describe how the HKMA proposes to exercise its supervisory powers in relation to controls on large exposures and risk concentrations Classification A statutory guideline issued by the MA under the Banking Ordinance, §16(10) Previous guidelines superseded Guideline 5.3 “Specification of Factors for Off-balance Sheet Exposures under §81(3) of the Banking Ordinance” dated 04.10.91; CR-G-8 “Large Exposures and Risk Concentrations” (V.1) dated 31.08.01; CR-L-2 “Exemption of Financial Exposures: §81(6)(b)(i)” (V.1) dated 31.08.01; CR-G-8 “Large Exposures and Risk Concentrations” (V.2) dated 01.04.04, CR-G-8 “Large Exposures and Risk Concentrations” (V.3)

2 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] 27.12.19 Application To all locally incorporated AIs, except for the reporting requirements which are also applicable to AIs incorporated outside Hong Kong For AIs incorporated outside Hong Kong, the overall supervision of large exposures and risk concentrations is the responsibility of their home regulatory authorities. They are, however, required to report the large exposures of their Hong Kong operation to the HKMA in the “Return of Large Exposures” (MA(BS)28) and certify compliance with certain provisions under the BELR applicable to them1 as specified in the “Certificate of Compliance” (MA(BS)1F(b)). Structure

1. Introduction 1.1 Background 1.2 Forms of risk concentration 1.3 Rationale for controlling risk concentrations
2. Statutory limitations on exposures and risk concentrations 2.1 General 2.2 Summary of relevant rules in the BELR 2.3 Definition of exposure under Part 7 2.4 Treatment of credit risk transfer 2.5 A group of linked counterparties (“LC group”) 2.6 Grouping special controllers 2.7 Sovereign concentration risk 2.8 Valuation of exposures 2.9 Treatment of recognized collateral for valuation of CRM uncovered portion of exposure 2.10 Exposure disregarded 2.11 Deduction 2.12 Exempt exposures under Parts 2 and 6
3. Prudent principles for controlling risk concentrations
4. Prudential limits 4.1 Authority

1 Parts 4 and 5 are applicable to the Hong Kong operation of AIs incorporated outside Hong Kong.

3 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] 4.2 Clustering limit 5. Controls over large exposures and risk concentrations 5.1 Oversight by Board of Directors 5.2 Policy 5.3 Regular monitoring 5.4 Independent audits and compliance 6. Consequences of breaches 6.1 General 6.2 Statutory notification 6.3 Remedial action 6.4 Offence 6.5 Regulatory reporting Annex —————————

1. Introduction 1.1 Background 1.1.1 The minimum authorization criterion under paragraph 8 of the Seventh Schedule to the BO provides that the MA must be satisfied that an AI complies with, on a continuing basis, the provisions of Part XV of the BO, and the provisions of the rules made under that Part (i.e. the BELR, which set out the limitations on exposures and risk concentrations of AIs) applicable to it. 1.1.2 Moreover, under paragraph 12 of the Seventh Schedule to the BO, the MA must be satisfied that the business of an AI is carried on, on a continuing basis, with integrity, prudence and the appropriate degree of professional competence and in a manner which is not detrimental, or likely to be detrimental, to the interests of depositors or potential depositors. Whether an AI has the proper control systems to manage its large exposures and guard against concentration risks is one of the factors that the MA will take into account in assessing the AI’s compliance with this minimum authorization criterion. 1.1.3 Failure to adhere to the standards and requirements in this module may indicate that an AI does not have adequate

4 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] systems to control its risk concentrations and carry out its business in a prudent manner. This may call into question whether the AI continues to satisfy the above-mentioned minimum authorization criteria under the Seventh Schedule to the BO. 1.1.4 Non-compliance with this module may also constitute a ground for the MA to impose a higher minimum capital adequacy ratio on the AI under §97F of the BO to address any additional concentration risk. 1.1.5 For the purpose of this module, any exposure to a counterparty or an LC group2 which is greater than or equal to 10% of an AI’s Tier 1 capital is regarded as a large exposure. 1.2 Forms of risk concentration 1.2.1 Risk concentration can be viewed as any exposure with the potential to produce losses that are substantial enough to threaten an AI’s capital strength or earnings or otherwise undermine public confidence in the AI. It can take many forms, including exposures to particular types of asset (e.g. interest in land or shares), individual counterparties, groups of linked counterparties and counterparties in specific geographical locations or economic or industry sectors. 1.2.2 Risk concentration may also arise from subtler or more situation-specific factors. For example, the financial problems in a particular industry or jurisdiction may have a contagion effect on other industries or jurisdictions that have a close economic linkage with it. 1.3 Rationale for controlling risk concentrations 1.3.1 Diversification of risk is essential in banking. Many past bank failures have occurred due to risk concentrations of some kind. It is therefore essential for AIs to properly manage risk concentrations from exposures to particular counterparties, industries, economic sectors, jurisdictions or regions. 1.3.2 While some concentration risks are common to the local banking industry and cannot be totally avoided, they can

2 The term “LC group” means a group of linked counterparties. See Section 2.5 for details.

5 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] be managed by adopting proper risk control and diversification strategies. Safeguarding against risk concentrations should form an important component of an AI's risk management systems. 2. Statutory limitations on exposures and risk concentrations 2.1 General 2.1.1 The statutory limitations on exposures and risk concentrations are set out in the BELR. This module covers mainly Parts 7, 2 and 6, which are relevant to locally incorporated AIs for the control of exposures and risk concentrations3 . They relate to: (a) limitation on exposures to a counterparty or an LC group (Part 7), which implements the BCBS’ large exposures standard set out in the Basel Framework (“LEX standard”) 4 ; (b) limitation on equity exposure (Part 2); and (c) limitation on holding of interest in land (Part 6). 2.1.2 Other relevant parts, which deal with limitations on exposures to connected parties (Part 8) and acquisition by locally incorporated AIs of share capital in companies (Part 3), are covered, respectively, under CR-G-9 “Exposures to Connected Parties” and CR-L-5 “Major Acquisitions and Investments: BELR Part 3”. 2.1.3 Sections 2.2 to 2.12 below provide a summary of the key provisions contained in Parts 7, 2 and 6. They also endeavour to interpret these Parts in simplified language. In case of doubt, AIs should consult the HKMA or seek relevant legal advice. 2.2 Summary of relevant rules in the BELR 2.2.1 Under Rule 44(1), an AI is subject to a statutory limit of 25% of its Tier 1 capital on its exposure to any individual counterparty or LC group.

3AIs should also refer to Part 5, which sets out the limitation on advances to employees. 4 https://www.bis.org/basel_framework/standard/LEX.htm

6 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] 2.2.2 In addition, an AI designated by the MA as a global systemically important authorized institution under §3S of the Banking (Capital) Rules (Cap. 155L) (“Capital Rules”) (i.e. a local G-SIB for the purposes of Part 7) is subject to another limit. Its exposures to a G-SIB-linked group or any counterparty in a G-SIB-linked group must not exceed 15% of its Tier 1 capital. A G-SIB-linked group is an LC group in which an entity is an international G-SIB5 or a local G-SIB. 2.2.3 Various exposures are not to be taken into account for determining the aggregate exposure to a single counterparty (“ASC exposure”) or aggregate exposure to an LC group (“ALCG exposure”) under Rule 48 (see section 2.10 below for details). 2.2.4 Apart from the Part 7 limitation on single counterparty / LC group exposure, an AI should not incur any equity exposure to an aggregate value in excess of 25% of its Tier 1 capital under Rule 11, Part 2. 2.2.5 Part 6 sets out the limitation on holding of interest in land. Under Rule 35(b), an AI should not hold interest in land, excluding self-use land, exceeding 25% of its Tier 1 capital. Under Rule 35(a), an AI should not hold interest in land exceeding 50% of its adjusted Tier 1 capital amount. Adjusted Tier 1 capital amount is the amount of Tier 1 capital plus the amount of cumulative gain arising from the revaluation of the AI’s self-use land in accordance with the applicable accounting standards (if any) which has been excluded from the calculation of the amount of its Tier 1 capital under the Capital Rules. 2.2.6 Exemptions from the limits in Part 2 and Part 6 are available under Rules 14 and 38 respectively (see section 2.12 for details). 2.2.7 The MA is empowered by Rule 12 to vary the equity exposure limit, and Rule 45 to vary the large exposure limits, applicable to an AI. It is expected that these powers will be exercised for tightening a limit if warranted on prudential grounds, e.g. if an AI has shown significant control weaknesses in the monitoring of credit

5 That means, the entity is in the FSB G-SIB list or it is a member of a group of companies that is in the FSB G-SIB list or any member of which is in the FSB G-SIB list.

7 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] concentration risk. Any proposal to exercise these limit variation powers will be subject to the consultation processes prescribed in the BELR. 2.2.8 Rule 6 empowers the MA to require a locally incorporated AI that has any subsidiary to comply with the above statutory limits under the BELR on an unconsolidated basis6 , consolidated basis or on both an unconsolidated and consolidated basis (see Rule 6 and CR-L-1 “Consolidated Supervision of Concentration Risks: BELR Rule 6” for more guidance). The MA has the discretion to decide which subsidiaries of an AI are to be included in the consolidation. Generally, consolidation for the purposes of §79A of the BO and Rule 6 will include subsidiaries that undertake financial business and those which incur risks regulated by the BELR (e.g. subsidiaries that engage in banking, property-holding, hire purchase, etc.). 2.2.9 Under Rule 2(2), the term “Tier 1 capital” for the purposes of the BELR has the meaning given by §2(1) of the Capital Rules. However, the basis of consolidation should be as required under Rule 6. The subsidiaries of a locally incorporated AI consolidated (or solo-consolidated) for BELR purposes may differ from those included for the purpose of calculation of its capital adequacy ratio on a consolidated basis (or solo-consolidated basis) in a notice given to the AI under §3C(1) of the Capital Rules. 2.2.10 The MA may require an AI to provide evidence or information to prove that it complies with the statutory limits under the BELR. 2.3 Definition of exposure under Part 7 2.3.1 For the purposes of Part 7, exposure includes any exposure pertinent to the risk of default of a counterparty. As a rule of thumb, an AI must consider all the exposures defined under the Capital Rules except those not relating to the risk of default of a counterparty (for example, holdings of a commodity or a foreign currency). An exposure may be on- or off-balance sheet, booked in the trading book or banking book, and include counterparty

6 The application of any provision of the BELR to a locally incorporated AI on an unconsolidated basis could be further categorised as being applicable on a solo basis or solo-consolidated basis.

8 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] credit risk as well as indirect exposure to a credit protection provider, as elaborated in section 2.4. An exposure has to be valued by the methods prescribed under Part 7 as highlighted in section 2.8. 2.3.2 For the avoidance of doubt, an AI should recognise an exposure arising from the balance of its Nostro account maintained with another bank only in respect of the amount of the balance that has completed the settlement process and become available to the AI (i.e. on the basis of available balance instead of ledger balance). 2.4 Treatment of credit risk transfer7 2.4.1 A credit risk transfer mechanism is introduced generally for non-CCR exposures in the banking book as well as CCR exposures under the BELR. Where an AI has taken into account the credit risk mitigation (CRM) effect of a recognized credit risk mitigation (recognized CRM) in its calculation of the risk-weighted amount for credit risk in respect of an exposure under the Capital Rules8 , the AI should take into account the same form of recognized CRM to reduce the amount of its exposure to the obligor in accordance with the applicable requirement in Subdivision 2 of Division 3 and Division 6 of Part 7. Where applicable, the AI must at the same time recognize an exposure to the credit protection provider in accordance with Rule 54. On the other hand, an AI must not recognize the effect of a recognized CRM for the purposes of Part 7 if it has not taken into account the effect of the same form of recognized CRM in its calculation of the risk-weighted amount for credit risk in respect of the exposure under the Capital Rules. 2.4.2 In relation to credit risk transfer, the HKMA will on its volition designate AIs which are internationally active or systemically important locally as a Category A institution. These institutions are required to recognize the effect of a recognized CRM as highlighted in section 2.4.1 above. 2.4.3 An AI that is not designated as a Category A institution is treated as a Category B institution, to which a simplified

7 It should be noted that the meaning of “credit risk transfer” used in this module is different from a similar term used in the SPM module CR-G-12 “Credit Risk Transfer Activities”. 8 See the definition of “recognized credit risk mitigation” in §2(1) of the Capital Rules.

9 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] credit risk transfer framework applies. Category B institutions should determine an exposure to a direct obligor by taking into account recognized CRM only in respect of the following exposures: (a) a CRM covered exposure that is a CCR exposure; (b) a CRM covered exposure that is a non-CCR exposure, if the related recognized CRM is (i) a recognized netting done under a valid bilateral netting agreement; or (ii) a recognized collateral that is a cash deposit. 2.4.4 In the case of a CCR exposure in respect of derivative contracts under Rule 59, or a CCR exposure in respect of SFTs under Rule 60, if the effect of a recognized CRM is already taken into account in the calculation of the amount of default risk exposure of the contract or transaction under Part 6A of the Capital Rules (i.e. reflected in the CCR exposure value determined under Rule 59 or 60), the AI must not take into account the effect of the same recognized CRM under Subdivision 2, Division 3 of Part 7 again. Besides, if the credit protection as taken into account in the calculation of the amount of default risk exposure of the contract or transaction under Part 6A of the Capital Rules is in the form of a collateral, the AI must also recognize an exposure to the collateral issuer in accordance with Rule 54(2)(a)(ii). In general, the amount assigned to the collateral issuer is the amount by which the default risk exposure to the counterparty is reduced with the consideration of the collateral in its calculation under Part 6A of the Capital Rules. This applies independently of whether the AI is a Category A or Category B institution. 2.4.5 Notwithstanding section 2.4.2, a Category B institution may opt for implementing credit risk transfer in exposure calculation by applying for the designation as a Category A institution. The HKMA will grant the designation if it is satisfied that the AI has the capacity (systems and resources) to determine an ASC exposure or an ALCG exposure taking into account the effect of a recognized CRM applicable to a Category A institution. In assessing an AI’s application, the MA will consider the following factors:

10 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] (a) whether the AI has established systems and processes to support the accurate calculation of the ASC exposure and ALCG exposure by taking into account the effect of a recognized CRM, including but not limited to the systems and processes for: (i) maintenance of exposure records and corresponding CRM records; (ii) determining whether a CRM is a recognized CRM under Part 7; (iii) calculation of exposure after CRM and the corresponding recognition of exposure to the credit protection provider; (b) whether the IT system for the purposes of paragraph (a)(iii) has successfully completed user acceptance tests; (c) whether the systems and processes mentioned in paragraph (a) have been reviewed by a party or unit independent of the development team to ensure that it calculates ASC exposure or ALCG exposure accurately taking into account the effect of a recognized CRM applicable to a Category A institution according to Part 7; and (d) whether there is a unit within the AI responsible for ensuring the effectiveness of the systems and keeping track of room for improvement of the systems. 2.4.6 The designation of AIs for the purposes of Part 7 is conducted independently from the designation of AIs under the Banking (Liquidity) Rules (“Liquidity Rules”). Notwithstanding that, in practice the HKMA will likely designate a category 1 institution under the Liquidity Rules as a Category A institution under Part 7 except for institutions of which the designation as a category 1 institution is purely for liquidity reasons. The HKMA will review the designation of Category A institutions annually and on an as-needed basis. 2.4.7 As an AI incorporated outside Hong Kong is not subject to Part 7, they will not receive designation as a Category A institution or Category B institution under that Part. To reduce the reporting burden of an AI incorporated outside

11 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] Hong Kong, it may choose to apply credit risk transfer as if it were a Category A institution or Category B institution for the purposes of reporting the Return of Large Exposures (i.e. MA(BS)28). Alternatively, it may either (i) apply similar credit risk adjustment and risk transfer mechanism under the formal rules of its place of incorporation to implement the LEX standard; or (ii) (if the regulator of its place of incorporation has not implemented the LEX standard) apply the credit risk adjustment and risk transfer mechanism, if any, applicable to it under its home rules on large exposures. The AI should indicate in MA(BS)28 its choice of application of credit risk adjustment and risk transfer mechanism for the purpose of reporting the Return of Large Exposures and is expected to apply the chosen method consistently. 2.4.8 Exposures booked in the trading book are subject to the trading book offsetting provisions under Subdivision 4 of Division 3 of Part 7. Where the offsetting involves a credit derivative contract under Rule 56(2), an exposure to the credit protection provider has to be recognized pursuant to Rule 54. This “risk transfer” in the trading book applies to a Category A institution and a Category B institution alike. 2.4.9 An AI may incur an exposure to the issuer of (1) a recognized collateral, (2) the underlying assets of an investment structure or (3) the underlying assets of a derivative contract with respect to which the AI has no other banking relationship. The BELR do not intend to introduce new requirements on know-your-customer (KYC) solely for economic dependence identification purpose. However, the HKMA expects an AI should have factored in its knowledge on the relevant issuers to the extent as corresponding SPM modules required, such as CR-G-7 on collateral acceptance. For example, a prudent banker should not accept collateral issued by an entity on an international sanction list in relation to money laundering. 2.5 A group of linked counterparties (“LC group”) 2.5.1 Rule 41 provides two major factors for linking two or more

12 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] counterparties to form an LC group – i.e. by control9 and by economic dependence. See Annex for illustrative examples for the formation of an LC group. 2.5.2 Apart from subrule (7) of Rule 41, the control factor is relatively simple and straightforward. Subrule (7) provides that if a parent entity controls a subordinate entity only by virtue of its fiduciary capacity on behalf of a non￾anonymous beneficiary, the subordinate entity is not to be treated as being controlled by the parent entity. To avoid doubt, the subordinate entity is treated as being controlled by the beneficiary if a normal criterion of control is met. For example, a trustee legally controls a trust in a fiduciary capacity on behalf of beneficiaries known to the AI. The AI is not required to treat the trustee and the trust as an LC group. If one of the beneficiaries controls the trust by its beneficial interests, the AI should treat the beneficiary and the trust as an LC group. 2.5.3 The economic dependence factor is more complicated and elaborated below. 2.5.4 First, an AI may choose not to consider whether any counterparties are economically dependent on a counterparty of the AI (“reference counterparty”) if (i) the exposure to the reference counterparty does not exceed 5% of the AI’s Tier 1 capital or (ii) the reference counterparty is an exempted sovereign entity. This results from Rule 41(3), which allows an AI to exclude the following entities from the LC group of a reference counterparty which is an exempted sovereign entity or to which the exposure does not exceed 5% of the AI’s Tier 1 capital: an entity economically dependent on the reference counterparty (Rule 41(3)(a)), entities that it controls (Rule 41(3)(b)) and entities that control it and are economically dependent on it (Rule 41(3)(c)). 2.5.5 While the 5% threshold applies on a per entity basis, an AI must not intentionally avoid the economic dependence check for a counterparty by splitting its exposures to that counterparty through allocating them to different legal entities within the counterparty’s consolidation group.

9 The meaning of “control” is provided in Rule 41(6). In assessing whether counterparties are linked by control, AIs should also refer to relevant criteria specified in applicable accounting standards for further qualitative guidance when determining control.

13 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] When considering whether the exposures to an entity have exceeded the 5% threshold, an AI should take into account all exposures after CRM, offsetting and deduction to the entity, including, e.g. arising from credit risk transferred to the entity as a credit protection provider or look-through to the entity underlying an investment structure. 2.5.6 Rule 41(4) provides for the following: “For subrule (1), if a counterparty of an authorized institution (counterparty A) is a linked counterparty of the reference counterparty by virtue of subrule (2)(a), (b) or (c) and the institution’s ASCE ratio in relation to the counterparty A does not exceed 5%, the institution, in determining its ASC exposure to the LC group (by reference to the reference counterparty), may treat any of the following entities as not being in the LC group— (a) an entity specified in subrule (2)(d) that is economically dependent on counterparty A; (b) an entity specified in subrule (2)(e) that is controlled by an entity specified in paragraph (a); (c) an entity specified in subrule (2)(f) that controls and is economically dependent on an entity specified in paragraph (a).” 2.5.7 In relation to a reference counterparty, any of its controller, fellow subsidiary and subsidiary (counterparty A) is to be included in the LC group of the reference counterparty (Rule 41(2)(a), (b) and (c)). Normally, any counterparty economically dependent on counterparty A is also included in the same LC group (Rule 41(2)(d), (e) or (f)). However, Rule 41(4) provides that if the AI’s ASCE ratio to counterparty A does not exceed 5%, counterparties economically dependent on counterparty A may be excluded from the grouping. It follows that if the AI’s ASCE ratio to counterparty A does not exceed 5%, the AI may not attempt to check for counterparties economically dependent on counterparty A. This is the key content of Rule 41(4). In fact, subrule (4) is provided for the avoidance of doubt. By looking at counterparty A from the perspective of “a reference counterparty”, subrule (3) should already serve the same purpose.

14 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] 2.5.8 For a counterparty of which all the exposure is disregarded under Rule 48, for example, an exempted sovereign entity, as a matter of course, it is not necessary to check for counterparties economically dependent on it. 2.5.9 Under Rule 41(8), an entity (Entity A) is economically dependent on another entity (Entity B) if they are connected in a way that if Entity B were to encounter financial problems (in particular funding or repayment difficulties), Entity A would also be likely to encounter financial problems (in particular funding or repayment difficulties). The concept of economic dependence is further elaborated in the Banking (Exposure Limits) Code (“the Code”), which is the code of practice issued for clarifying the BELR. 2.5.10 Paragraph 6(4) of the Code provides for the following: “An AI should regard, for the purposes of Rule 41(8), that if Entity B were to encounter financial problems (in particular funding or repayment difficulties), Entity A would also be likely to encounter financial problems (in particular funding or repayment difficulties) and hence Entity A is economically dependent on Entity B when any of the following applies: (a) 50% or more of the gross receipts or gross expenditures (on an annual basis) of Entity A are derived from transactions with Entity B; (b) Entity A has fully or partly guaranteed the exposure of Entity B, or is liable in respect of that exposure in any other manner (e.g. by the giving of an indemnity), and the exposure is so significant that Entity A is likely to default if a claim occurs; (c) 50% or more of Entity A’s product/output or services is sold to Entity B, and Entity B cannot easily be replaced by other customers; (d) the expected source of funds to repay the loans of both Entity A and Entity B is the same and neither Entity A nor Entity B has another independent source of income from which the loans may be fully repaid; (e) it is likely that the financial problems of Entity B would cause difficulties for Entity A in terms of full and timely repayment of liabilities;

15 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] (f) the insolvency or default of Entity A is likely to be associated with the insolvency or default of Entity B; (g) both Entity A and Entity B rely on the same source for 50% or more of their funding and neither Entity A nor Entity B has another independent source of funding.” 2.5.11 For criteria (a), (b), (c), (e) and (f) above, economic dependence is one-way, i.e. if Entity A depends on Entity B, Entity A has to be included in the LC group of Entity B (but not vice versa). The situation is different for criteria (d) and (g) above where Entity A and Entity B depend on the same third party as the sole source of funding. In that case, Entity A and Entity B have to be included in the LC group of each other. 2.5.12 In general, except as specified in sections 2.5.4, 2.5.7 and 2.6.1, any counterparty (“Counterparty B”), that is economically dependent on (1) the reference counterparty, (2) an entity that controls the reference counterparty, or (3) an entity that is controlled by the reference counterparty or the entity that controls the reference counterparty, has to be taken into account in the formation of an LC group of the reference counterparty. The BELR, however, do not require AIs to identify counterparties that are economically dependent on Counterparty B. The overarching principle underlying economic dependence is whether the financial problem of one entity will likely cause financial problem in another counterparty and in general, AIs are expected to be at least able to only identify direct economic dependent relationship. For example, counterparty Y is economically dependent on the reference counterparty X and counterparty Z in turn is economically dependent on counterparty Y. If an AI’s ASCE ratio to reference counterparty X exceeds 5%, it should identify counterparty Y in the formation of the LC group of reference counterparty X and may choose not to further check whether any entity in turn is indirectly economically dependent on reference counterparty X via counterparty Y. Nonetheless, if it comes to the AI’s knowledge that counterparty Z is indirectly economically dependent on reference counterparty X, as a good practice, the AI is encouraged to include counterparty Z in the LC group of

16 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] reference counterparty X for risk management. 2.5.13 The Code provides further details for identifying entities which are economically dependent on another entity. Among others, paragraph 6(4)(d) and (g) of the Code holds two entities as economically dependent on each other if they rely on the same source of funds and neither of them has another independent source of funds. To avoid doubt, an AI should not put two counterparties in an LC group merely because they rely on the same primary banker for funds, unless neither of them has another independent source of funding. 2.5.14 AIs are free to adopt an internal policy more stringent than the Code to identify counterparties linked by economic dependence. For example, by disapplying the 5% threshold under Rule 41(3) and (4). 2.5.15 For the determination of the ALCG exposure to an LC group of the AI, the AI may exclude the value of the AI’s clearing-related exposures to a counterparty of the group which acts as a CCP. Such exposures should, however, be included in determining the AI’s ASC exposure to that CCP under Rule 46. For the avoidance of doubt, regarding clearing-related exposures (including the AI acting as a clearing member or being a client of a clearing member), the AI should determine the counterparty to which exposures must be assigned by following the same methodology it has applied for the calculation of exposures to CCPs, clearing members or clients under Division 4 of Part 6A of the Capital Rules. 2.6 Grouping special controllers 2.6.1 If entities are directly controlled by or economically dependent on an exempted sovereign entity, a specified sovereign-owned entity or The Financial Secretary Incorporated established under the Financial Secretary Incorporation Ordinance (Cap.1015), and are otherwise not in an LC group, regardless of whether the exempted sovereign entity, the specified sovereign-owned entity or the Financial Secretary Incorporated is a counterparty of the institution, these entities are treated as not being in an LC group of the institution. See Part C of the Annex for illustrative examples for the formation of an LC group

17 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] related to exempted entities. 2.6.2 In the diagram below, A1, A2 and A3 are controlled by the same entity (parent entity). Normally all four of them and B1 have to be put together as an LC group. However, if the parent entity is an exempted sovereign entity, specified sovereign-owned entity or The Financial Secretary Incorporated stated under Rule 41(5) (collectively exempted parent), and A1, A2 and A3 are not otherwise linked, it is not necessary to group A1, A2 and A3 together in an LC group. This de-grouping under Rule 41(5), however, only applies to entities controlled by an exempted parent but not to the exempted parent itself. Therefore, each of A1, A2 and A3 should be grouped with its exempted parent as usual. In the case that the exempted parent is an exempted sovereign entity, the exposure to the exempted sovereign entity is exempted pursuant to Rule 48(1)(c). In addition, although both A1 and B1 are controlled by an exempted sovereign entity, A1 controls B1. In other words, the condition for de-grouping under Rule 41(5) that the entities “are not otherwise linked” is violated. Accordingly, B1, A1 and the exempted parent should form an LC group. 2.6.3 Currently the list of specified sovereign-owned entity includes China Investment Corporation (“CIC”) and Central Huijin Investment Ltd. (“Huijin”). These are special purpose vehicles of the Government of Mainland China through which the investment holdings of the large state￾owned finance companies (including the big four banks, large insurance companies, etc.) are held. The special treatment makes it unnecessary to include these finance Exempted parent A1 B1 A2 A3

18 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] companies in an LC group just because they are controlled by the two special purpose vehicles stated above. Again, an individual finance company controlled by CIC and Huijin should still be grouped with these two companies, and individual finance companies have to be grouped if they themselves are linked by other relevant criteria cited under Rule 41. 2.7 Sovereign concentration risk 2.7.1 While Part 7 strictly adheres to the LEX standard by excluding exposures to an exempted sovereign entity from the statutory limits, by experience exposures to sovereigns may not be risk-free. An AI is therefore required to provide additional capital under Part 10 of the Capital Rules if it has concentrated sovereign exposures 10. In brief, an AI may have aggregate exposures to the specified sovereign entities11 of a jurisdiction up to 100% of its Tier 1 capital without the need to provide for additional capital; beyond that threshold, additional capital is required12. The risk weights applicable to the portions of concentrated sovereign exposures in excess of the 100% Tier 1 capital threshold increase with the magnitude of the amount in excess. 2.8 Valuation of exposures 2.8.1 AIs should refer to Divisions 4 and 5 of Part 7 for details of valuation of CCR and non-CCR exposure respectively. The measurement methodologies set out in these BELR provisions generally follow those prescribed for the standardized approaches for credit risk and market risk under the Capital Rules 13 . The following paragraphs highlight certain features that warrant special attention in determining the value of an exposure for the purposes of Part 7. 2.8.2 The relevant credit conversion factors for measuring the value of off-balance sheet exposures other than default risk

10 See §343 of the Capital Rules for the definition of “concentrated sovereign exposure”. 11 See §342(1) of the Capital Rules for the definition of “specified sovereign entity”. 12 For the avoidance of doubt, when calculating concentrated sovereign exposures on a solo-consolidated or consolidated basis, only sovereign exposures incurred by the AI itself or its subsidiaries which are consolidated for capital purposes under the Capital Rules would be subject to the additional capital charge. 13 Where appropriate, adaptions are made in the BELR in respect of AIs that use the BSC approach for credit risk and/or the SSTM approach for market risk under the Capital Rules.

19 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] exposures or exposures arising from unsegregated collateral are subject to a floor of 10%. 2.8.3 An AI should recognize two distinct exposures on a derivative contract or securities financing transaction – one to the underlying of the contract/transaction and the other to the counterparty of the contract/transaction. 2.8.4 In respect of an AI that does not use the STM approach, the IMA or a combination of both to calculate its regulatory capital for market risk, the AI should value a non-CCR exposure arising from an item in its trading book in accordance with Subdivision 4, Division 5 of Part 7. In particular, in measuring exposures to the underlying of a futures, forward or swap contract, the contract must be decomposed into separate legs in accordance with §§289(2)(c)(i), (ii) and (iii) and 292(1)(c), (d) and (e) of the Capital Rules, as if those provisions were applicable to the AI. For example, an equity forward contract is decomposed into a leg representing a position in the underlying equity (§292(1)(c)) and a leg representing an interest rate exposure (§292(1)(e)). The first leg represents a non-CCR exposure in the underlying equity, which should be included for valuation. The second leg is an interest rate exposure, which should be excluded (Rule 48(1)(b)). In relation to a bond futures contract, the contract may be decomposed into a leg of the underlying bond and a leg representing an exposure being treated as arising from a zero-coupon specific risk-free security. An exposure to the latter leg may also be excluded (Rule 75(5)). 2.8.5 In respect of an AI that uses the STM approach, the IMA or a combination of the STM approach and the IMA to calculate its regulatory capital for market risk, the AI should value a non-CCR exposure arising from an item in its trading book in accordance with Subdivision 3A, Division 5 of Part 7. The relevant exposure for trading book positions to any counterparty must be calculated as the gross jump￾to-default risk amount in accordance with §281U of the Capital Rules as if the AI were calculating the SA-DRC (non-securitization) under the STM approach but subject to the following modifications: (a) a loss given default of 100% must be assigned to the exposure;

20 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] (b) any adjustment to the maturity of an exposure set out under §281U of the Capital Rules is not applicable for the purpose of Part 7. 2.8.6 AIs should value a non-CCR exposure arising from an option contract (whether booked in the banking book or trading book of the AIs) at the gross jump-to-default risk amount (see section 2.8.5). 2.8.7 For the purposes of valuing a CCR exposure under Part 7- (a) An AI should value a CCR exposure arising from a derivative contract at the amount of default risk exposure calculated by using: (i) if the AI does not use any internal model based approach to calculate the amount of the default risk exposure of its derivative contracts for calculating its capital adequacy ratio under the Capital Rules – the approach or method under Part 6A of the Capital Rules that it currently uses for that calculation; or (ii) if the AI uses an internal model based approach to calculate the amount of default risk exposure of its derivative contracts for calculating its capital adequacy ratio under the Capital Rules – the SA￾CCR approach; (b) An AI should value a CCR exposure arising from an SFT at the amount of the default risk exposure calculated by using the methods set out in Division 2B of Part 6A of the Capital Rules except the internal model-based approach specified in §226ML of the Capital Rules. 2.9 Treatment of recognized collateral for valuation of CRM uncovered portion of exposure 2.9.1 Irrespective of the method used under the Capital Rules, Part 7, in substance, only accepts the simple approach and comprehensive approach under the STC approach to the treatment of recognized collateral for valuation of the CRM uncovered portion of an exposure14 . In this connection, an

14 AIs that adopt the BSC approach for credit risk in essence apply the simple approach to the treatment of recognized collateral.

21 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] AI should pay attention to the following: (a) §78 of the Capital Rules contains the criteria of when to use the simple approach or comprehensive approach. However, the use of the simple approach is constrained by Rule 48B(3), which requires that in the case of a CCR exposure in respect of SFTs valued in accordance with Rule 60, an AI that uses the STC approach, or a combination of the STC approach and IRB approach, to calculate its credit risk for non￾securitization exposures under the Capital Rules must only use the comprehensive approach to the treatment of recognized collateral; (b) When the simple approach is used, the protected exposure is reduced by the market value of the recognized collateral. This is different from the treatment under the Capital Rules, which takes the form of “risk-weight substitution”. This modification corresponds to the overarching principle of the LEX standard of capturing the risk of an immediate default of a counterparty. Therefore, risk-weights, which reflect probability of default, are irrelevant; (c) As reflected in §77(3)(b) of the Capital Rules, the simple approach requires that the collateral be pledged (or otherwise provided as security) for not less than the remaining life of the protected exposure. Furthermore, the simple approach does not apply haircuts to the collateral value as it is applied under the comprehensive approach; (d) The comprehensive approach is by and large the same as that under the Capital Rules. Nonetheless, attention should be paid to any adjustments to the haircuts required under §§90, 91 and 92 of the Capital Rules; and (e) As reflected in §103 of the Capital Rules, CRM with maturity shorter than that of the protected exposure is recognized only when the CRM’s original maturity is equal to or greater than one year and the residual maturity is not less than three months. If there is a maturity mismatch in respect of a CRM, the adjustment under §103 of the Capital Rules applies.

22 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] 2.10 Exposure disregarded 2.10.1 Rule 48 sets out a number of exposures to be disregarded for the purposes of Part 7. Particular attention is drawn to the following: (a) Subrule (1)(a) – exemption to an AI’s exposure to its own affiliates which are accounted for on a full basis in the consolidated financial statements of the holding company of the group of companies to which they belong. To complement this exemption, an AI is required to set an internal aggregate intragroup exposure limit for the monitoring and control of the AI’s aggregate exposures to its own group of companies taking account of the following requirements: (i) the limit should encompass, but not be limited to, all the affiliates of the AI exempted under subrule (1)(a) (i.e. the AI may include other affiliates for internal risk management purposes), and be expressed as a ratio of the AI’s aggregate intragroup exposures to the amount of the AI’s Tier 1 capital; (ii) the limit should be in line with the AI’s internal risk appetite and take into account the AI’s operational needs; the nature, size and complexity of the AI’s intragroup exposures; the AI’s limits on third parties of equivalent risk; and the group policies and arrangements for liquidity/market risk management; (iii) the internal aggregate intragroup exposures should be determined according to Rule 46 as if the exemption to intragroup exposures under subrule (1)(a) did not apply; (iv) the AI may also establish more granular internal intragroup exposure limits for more robust risk management of intragroup exposures; and (v) the AI should have adequate systems and controls for monitoring its intragroup exposures (see CR-G-9 “Exposures to Connected Parties”), discuss with its usual contact at the HKMA when setting or revising internal risk limit for the

23 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] monitoring and control of intragroup exposures, and inform the HKMA as soon as practicable of any material change to the limit; (b) Subrule (1)(c) – this subrule exempts AIs’ exposures to an entity that meets the definition of “exempted sovereign entity” in Rule 39(1), among which includes the Government. This exemption generally covers the HKMA. An AI’s exposure to the HKMA is for the account of the Exchange Fund, which is part of the Government; (c) Subrule (1)(d) – this subrule exempts a security held by an AI for a financial facility provided by the AI, other than a recognized collateral under Rule 54(2)(a)(iii) being taken into account to calculate the CRM uncovered portion of an exposure of the AI or a collateral mentioned in Rule 54(2)(a)(ii); (d) Subrule (1)(k) – this subrule provides exemption to an intraday exposure to a bank (including an AI), i.e. an exposure to a bank that meets both of the following descriptions: (i) the exposure was incurred at a location on a particular calendar date by reference to the time zone of that location; (ii) that calendar date has not ended at that location. In this paragraph “a location” should mean a location of the counterparty. The operation of this subrule is illustrated by the following examples: (i) Example (1) – An AI places money to a bank in New York at 2230 Hong Kong time / 0930 New York time on Day 0. The exposure will be exempted until 0000 of Day 1 New York time or 1300 Hong Kong time of Day 1; (ii) Example (2) – An AI places money to a bank in New York at 1030 Hong Kong time on Day 1 / 2130 New York time on Day 0. The exposure will be exempted until 0000 of Day 1 New York time or 1300 Hong Kong time of Day 1; (iii) Example (3) – An AI’s London branch places money to a bank in New York at 1500 London time on Day 0 / 1000 New York time on Day 0 / 2300 Hong Kong time on Day 0. The exposure

24 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] will be exempted until 0000 of Day 1 New York time or 0500 London time of Day 1 or 1300 Hong Kong time of Day 1; and (e) It should be noted that exposure to a multilateral development bank is not exempted under the current BELR. This exemption is considered not necessary locally as an AI seldom has substantial exposure to a multilateral development bank. 2.10.2 Rule 48(2) provides a general exemption power to the MA. The HKMA only intends to exercise the general exemption power in exceptional scenarios of significant financial instability and to avert adverse developments. An example where the power could be used may be as case of an AI in the process of resolution which is to be acquired by another AI. If the acquiring AI would breach some large exposure limits (due to the merging of assets), the HKMA might temporarily allow exempting the acquired exposures and require the AI to devise a plan to bring down the aggregate exposures to relevant counterparties to a level below the normal statutory limits within a reasonable timeframe. 2.11 Deduction 2.11.1 Rule 57 provides for certain deduction from the amount of an exposure. Under Rule 57(1)(d), in valuing an exposure of an AI, the amount of exposure covered by a letter of comfort approved by the MA should be deducted provided that the conditions (if any) attached to the approval, whether generally or in any particular case or class of cases, are complied with. It has been the HKMA’s general policy that, except for a letter of comfort issued by the Government, not to accept any new letter of comfort under Rule 57(1)(d). Further, pursuant to Rule 116(2), letters of comfort that had been accepted under the now-repealed §81(6)(b)(ii) of the BO and deemed to be approved by virtue of Rule 116(1) have ceased to have effect at the end of 30 June 2020. 2.11.2 As for the letters of comfort issued by the Government to the HKMA before 1 July 2019 in relation to the 80% Loan Guarantee Product under the SME Financing Guarantee Scheme set up by The Hong Kong Mortgage Corporation Limited, an AI’s exposure arising from that scheme to (a)

25 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] The Hong Kong Mortgage Corporation Limited or (b) a subsidiary of The Hong Kong Mortgage Corporation Limited is deductible under Rule 57(1)(d) by virtue of the transitional provisions of Rule 116. The MA may continue to approve under Rule 57(1)(d), where appropriate, similar letters of comfort issued by the Government. 2.11.3 Under the BELR, a Category A institution can value an exposure covered by a recognized collateral or recognized guarantee issued by an exempted sovereign entity in accordance with either (1) the CRM provision under Subdivision 2, Division 3 of Part 7 (if applicable) or (2) the deduction provision under Rule 57(1)(c) 15 . However, for consistency in the treatment of recognized CRM, a Category A institution is expected to apply only the former option to value the relevant exposure. 2.12 Exempt exposures under Parts 2 and 6 2.12.1 Rule 14(1) provides exemptions to certain equity exposures from the exposure limit in Rule 11. However, some of these exemptions require the MA’s written approval, including exemptions to: (a) An equity exposure arising from the holding of capital interest acquired under an underwriting or sub-underwriting contract for a period exceeding seven working days 16; (b) An equity exposure arising from the holding of capital interest in another AI or a company carrying out nominee, executor or trustee functions, or other functions related to banking, deposit-taking or insurance business, investments or other financial services; (c) An equity exposure specified in a consent given under Rule 14(2). In this connection, the MA intends to give consent to equity exposure arising from

15 For the avoidance of doubt, when applying the deduction provision under Rule 57(1)(c), no supervisory haircut needs to be applied to the recognized collateral issued by the exempted sovereign entity. 16 The MA’s approval is not required for the exemption on holding of capital interest acquired under an underwriting or sub-underwriting contract for a period not exceeding seven working days. See CR-L-4 “Underwriting of Securities: BELR” for the MA’s policy on extending the exemption period for the underwriting or sub-underwriting of securities.

26 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] stabilizing action undertaken by a stabilizing manager in relation to an IPO, subject to the following conditions: (i) the stabilizing action must include all of the following - over-allocation of the shares offered before listing, selling relevant shares creating a short position before listing and acquisition of relevant shares to close out short position within the stabilizing period specified in a relevant agreement; (ii) the stabilizing manager has been granted an option from the issuer company at offer price to subscribe new shares to cover over-allocation (Green Shoe option); (iii) the purchase of relevant shares (either from a market purchase or through exercising the Green Shoe option) must be for the sole purpose of preventing or minimizing any reduction in the market price of the relevant securities; (iv) the stabilization activities are conducted in accordance with the Securities and Futures (Price Stabilizing) Rules (Cap. 571W); (v) the exemption is valid until the end of the stabilizing period set out in a relevant agreement. 2.12.2 An AI should apply to the HKMA in writing if it intends to obtain the exemption under section 2.12.1. 2.12.3 Except where a general policy has been established in this module, the HKMA expects it will rarely exercise the general consent power under Rule 14(2). An AI should only propose a case for the HKMA’s consideration if it is prudentially justified. For example, due to the unique circumstances of a case, it is convincing for certain equity exposures of an AI to be exempted from the equity exposure limit but subject to other regulatory measures. 2.12.4 Also excluded from the equity/land exposure limit are equity interests/ interests in land (i) mortgaged to an AI or held as security for facilities granted by an AI under Rule 14(1)(a)/Rule 38(a); or (ii) acquired by an AI during debt

27 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] recovery under Rule 14(1)(b)/Rule 38(b). In case (ii), however, such equity interests/interests in land acquired should be disposed of within 18 months after its acquisition or within such further period as may be approved by the MA. 3. Prudent principles for controlling risk concentrations 3.1 AIs should carefully manage and avoid excessive risk concentrations of various kinds, including exposures to individual counterparties (see section 3 . 3 below), groups of counterparties with similar characteristics, economic and geographical sectors, types of lending with similar characteristics (e.g. property lending, share margin financing, taxi loans) and holdings of securities or investments. 3.2 Statutory limits are not necessarily indicative of the level of risks an AI should take. For example, a statutory limit of 25% under Rule 44(1) does not mean that as high a level of exposure as this is appropriate for a particular counterparty or a particular AI. AIs should establish internal exposure limits that are reasonable in relation to their Tier 1 capital, balance sheet size, risk management capabilities, etc. They should require exceptional justifications before allowing such internal limits to be exceeded. 3.3 When considering the extension of large credit facilities (in particular those exceeding 10% of an AI’s Tier 1 capital), AIs should exercise extra care in ensuring that prudent credit granting criteria are met. They should have a thorough understanding of the borrower's background, financial strength and repayment sources, nature of business and funding needs, as well as management capabilities. The credit decision should be supported by an in-depth credit assessment of the borrower's debt-servicing capacity based on sufficient and reliable information (see CR-G-2 “Credit Approval, Review and Records” for further guidance). 3.4 Although certain types of exposure or exposures to certain counterparties are not subject to the statutory limit under Rule 44 (see sections 2.10 and 2.11 above for the nature of such exemptions or deductions), this does not mean that they are totally free of credit risk. AIs should still exercise particular care to

28 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] avoid undue concentration of risk in respect of any such exposure. Each exempted exposure or the exposure to each exempted counterparty should be subject to a robust internal risk management process. 3.5 AIs should avoid undue reliance on collateral, guarantees, or credit derivative contracts. Where collateral (or a guarantee) is taken to support a large exposure, AIs should make sure that the primary consideration is the borrower’s debt-servicing capacity. Part 7 allows for the reduction of exposure to the extent that the exposure is secured by a recognized CRM. AIs should however note that the reduction of exposure does not imply that the excess risk on the CRM covered exposure is totally eliminated. 3.6 As a general rule, AIs should ensure that the level of exposure to any counterparty, whether the exposure is exempted or covered by a recognized CRM, is commensurate with that counterparty’s financial strength and creditworthiness. 3.7 AIs that have developed an internal risk rating system for credit risk management may have regard to the internal ratings assigned to individual counterparties as a basis for setting the internal exposure limits for these counterparties. The internal risk rating system in use should be commensurate with the nature, size and complexity of an AI's activities. 3.8 AIs should not necessarily limit the definition of a “group of linked counterparties” by the criteria for linking in section 2.5 above. The definition should ideally capture all parties linked in such a way that the financial strength of any of them may affect that of the others, i.e. counterparties that constitute a single risk. For example, an AI may choose to apply linking by economic dependence without regard to whether the AI’s ASCE ratio to the reference counterparties exceeds 5%. 3.9 Apart from credit risk, it is important for AIs to ensure that other risks associated with large exposures (e.g. legal, operational and market risk) are adequately monitored and controlled. For example, there should be adequate control procedures to ensure that the AI’s legal rights are properly protected and that the chance of operational fraud or errors is minimized. Exposures subject to market risk should be periodically revalued. 3.10 Where appropriate, AIs should conduct stress-testing and

29 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] scenario analysis of large exposures to assess the impact of different scenarios and of the potential losses that may arise from changes in key risk factors such as economic cycles, interest rate and other market movements and liquidity conditions. 4. Prudential limits 4.1 Authority 4.1.1 Consistent with paragraph 12 of the Seventh Schedule to the BO, the HKMA may set prudential limits to prevent AIs from taking excessive concentration risks that may be detrimental to the interests of depositors or potential depositors. 4.1.2 If an AI is, in the opinion of the HKMA, exposed to a significant level of risk concentration that may affect its financial stability, the HKMA may set prudential limits on the AI's exposures to particular counterparties, groups of counterparties, economic or geographical sectors. These limits will be determined on a case-by-case basis, having regard to the AI's individual circumstances. 4.1.3 The HKMA may also direct an AI to take such other measures as it deems necessary to reduce its level of risk concentration. 4.2 Clustering limit 4.2.1 Normally, an AI which has a “clustered” loan portfolio (i.e. a large number of sizeable single exposures) will be subject to a higher level of concentration risk than an AI with a widely diversified loan portfolio. 4.2.2 In this regard, every locally incorporated AI is expected to set an internal limit in its large exposures and risk concentrations policy (see section 5.2 below) to control the aggregate of its non-exempt large exposures, other than exposures to banks 17 (including multilateral development banks), on both an unconsolidated basis (which includes solo basis and solo-consolidated basis)

17 In other words, the clustering limit does not apply to exposures to banks. For the purpose of the determination of aggregate exposures under the clustering limit, exposure to a bank holding company that is subject to the supervision of a prudential regulator is taken to be an exposure to a bank, i.e. excluded from the clustering limit. For the avoidance of doubt, a Category B institution should treat a corporate bond covered by a recognized bank guarantee as a corporate exposure, i.e. this is not excluded from the clustering limit.

30 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] and consolidated basis 18 (referred to as the clustering limit hereafter). This limit, expressed in terms of amount or percentage of an AI’s Tier 1 capital, should be approved by its Board of Directors and communicated to the HKMA once it is approved by the AI’s Board of Directors. 4.2.3 As a reference, most AIs in Hong Kong have an aggregate amount of non-exempt large exposures which is within 200% of their Tier 1 capital. This appears to provide a reasonable benchmark for AIs to set their clustering limit.The HKMA will have regard to this level in monitoring an AI’s large exposures. It is important that the limit set by AIs should be realistic and should not be set at a level so high that it could never be breached. 4.2.4 In considering whether the clustering limit set by an AI is acceptable, the HKMA will take into account the following factors: (a) the level of the AI’s capital adequacy ratio; (b) consistency with the AI's large exposures and risk concentrations policy (see section 5.2 below); (c) the number of exposures, their individual size and the nature of business of the borrowers concerned; and (d) the characteristics of the AI, including the nature of its business, the experience of its management and the robustness of the AI’s risk management capabilities. 4.2.5 In determining the amount of exposures subject to the clustering limit, an AI should aggregate those exposures that are equal to or more than 10% of its Tier 1 capital, which are currently not disregarded under Rule 4819 and not to banks. If the same exposure to a single counterparty is included in more than one LC group to which the aggregate non-exempted exposure of an AI equals or exceeds 10% of the AI’s Tier 1 capital, such exposure should only be counted once for the purpose of calculation of the clustering limit.

18 The subsidiaries for solo-consolidation or consolidation for the purposes of the clustering limit are the same as those for compliance with Part 7 as the AI has been notified of under Rule 6. 19 See Rule 48 for the exemptions available.

31 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] 4.2.6 In the case of an exposure supported by a letter of comfort approved by the MA under Rule 57(1)(d)(i), the amount of the exposure so covered by the letter of comfort is excluded for the purposes of the clustering limit. The total of all exposures covered by a letter of comfort is, however, subject to aggregate lending limit as specified by the MA. See sections 2.4.3 and 2.5.1 of CR-L-3 “Letters of Comfort: BELR Rule 57(1)(d)” for more details. 4.2.7 AIs should establish adequate systems to monitor compliance with the clustering limit that is approved by its Board of Directors. 5. Controls over large exposures and risk concentrations 5.1 Oversight by Board of Directors 5.1.1 The Board of Directors should ensure that the AI fully understands its legal obligations in relation to the limitations on exposures and risk concentrations under the BELR. 5.1.2 The Board should ensure that the AI establishes a policy on the control of large exposures and risk concentrations. The policy, and any changes thereto, should be reviewed and approved by the Board. 5.1.3 The Board should be responsible for ensuring that the AI establishes appropriate procedures and systems to identify, measure and control large exposures and risk concentrations and to monitor compliance with the approved policy. 5.1.4 The Board should ensure that large exposures are approved by the appropriate level of management in the AI. Normally, the Credit Committee approves large credits to customers, e.g. those with total facilities in excess of 5% of the AI’s capital base20 (see section 2.1 of CR-G-2 “Credit Approval, Review and Records”). 5.1.5 The Board should receive regular reports to facilitate its review of the AI’s large exposures and risk concentrations.

20 An AI may also define large credits requiring special approval with reference to its Tier 1 capital following the implementation of BELR.

32 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] 5.2 Policy 5.2.1 The details that should be included in the large exposures and risk concentration policy depend on the nature of an AI’s business, its scale of operation and its risk management capabilities. 5.2.2 Nevertheless, the policy should cover, at a minimum, the following: (a) the definition of exposure. While the definition under Part 7 is already very comprehensive, an AI is free to extend the definition as appropriate for internal risk monitoring purposes; (b) the criteria to be used for identifying a group of linked counterparties; (c) the individual and aggregate exposure limits for various types of counterparty (e.g. governments, banks, corporate and individual borrowers). The 25% statutory limit under Rule 44(1) should not necessarily be seen as the maximum limit for counterparty exposures; (d) the aggregate maximum exposure limits for an industry, an economic sector, a jurisdiction, a region or a group of borrowers which have a similar or homogeneous risk; (e) the delegation of credit authority within the AI for approving large exposures; (f) the circumstances in which the above limits can be exceeded and the party authorized to approve such excesses, e.g. the AI's Board of Directors or Credit Committee with delegated authority from the Board; (g) any differentiation between the limits for secured and unsecured exposures. AIs should note however that secured exposures are not risk-free; (h) the clustering limit (see section 4.2 above), i.e. the maximum amount of aggregate non-exempt, non-bank large exposures, in terms of amount or percentage of the AI’s Tier 1 capital, which may exist at any one time; (i) the procedures for identifying, reviewing, monitoring and controlling large exposures; and

33 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] (j) the allocation of responsibility for reporting large exposures to the HKMA and for ensuring compliance with the BELR, Part XV of the BO (e.g. §81B) and other prudential obligations in relation to concentration risk. 5.2.3 Where applicable, the above internal limits should be set on both an unconsolidated (which can be further distinguished as solo or solo-consolidated basis) and a consolidated basis. 5.2.4 Every AI is required to provide a copy of its policy on large exposures and risk concentrations to its usual contact at the HKMA and notify the HKMA no less than one month in advance in writing of intended changes in the policy. 5.3 Regular monitoring 5.3.1 AIs should have a central liability record (preferably based on an automated system) for each large exposure. AIs should be able to monitor such exposures against statutory and prescribed internal limits on a daily basis. See CR-G-2 "Credit Approval, Review & Records" and CR-G-3 “Credit Administration, Measurement and Monitoring” for further guidance. 5.3.2 Every AI should have adequate management information and reporting systems that provide robust risk data aggregation and risk reporting capabilities. This should enable management to exercise their oversight roles through access to comprehensive, accurate and timely information and therefore be able to identify risk concentrations within the asset portfolio of the AI or of the group (including subsidiaries and overseas branches) on a timely basis. If a concentration does exist, AIs should reduce it in accordance with their prescribed policies. 5.4 Independent audits and compliance 5.4.1 AIs should maintain regular and independent checks on the adequacy of controls over large exposures and on compliance with relevant internal policies and applicable laws and regulatory requirements. 5.4.2 AIs should ensure that their internal or external auditors conduct a regular review of the quality of large exposures and controls to safeguard against risk concentrations. Their review should ascertain whether:

34 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] (a) the AI's relevant policies, limits and procedures are complied with; and (b) the existing policies and controls remain adequate and appropriate for the AI's business. 5.4.3 Management should take prompt corrective action to address concerns and exceptions raised. 5.4.4 There should also be an independent compliance or other appropriate independent function to ensure that all relevant internal and statutory requirements and limits (including the BELR and Part XV provisions of the BO) are complied with. Any breaches of statutory requirements and deviations from established policies and limits should be reported to senior management, and the HKMA where appropriate, in a timely manner. 6. Consequences of breaches 6.1 General 6.1.1 For any breach of the statutory limits under the BELR, the clustering limit, the internal aggregate intragroup exposure limit or other prudential limits imposed by the HKMA, an AI should: (a) notify the HKMA as soon as practicable after the AI is aware of the event or ought to be aware of the event; (b) assess the impact of the breach, particularly the associated risks posed to the AI; (c) prepare a plan for the timely and effective rectification of the breach and inform the HKMA of the plan and key progress in and results of its implementation; and (d) take prompt remedial action in accordance with the plan prepared pursuant to paragraph (c). 6.2 Statutory notification 6.2.1 If an AI fails to comply with an exposure limit or a condition attached to the MA’s approval that falls under notifiable event under Rule 7(2), the AI must, pursuant to Rule 7(1), (i) notify the MA of the event as soon as practicable after the AI is aware of the event or ought to be aware of the event; and (ii) provide the MA with any particulars of the event that the MA

35 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] requests. 6.2.2 An AI should notify the MA of a notifiable event in writing, to be supported by the following information to the extent available and practical: (a) which exposure limit or condition under the BELR has been breached; (b) when the breach started; (c) how the breach was identified; (d) what causes the breach; (e) whether the breach has been rectified, if so when and how; (f) what remedial action has been taken by the AI. 6.2.3 If the information above is not available all at once, it can be provided by batches based on availability. 6.2.4 If the AI becomes aware that a breach has likely occurred but it takes time to investigate, it is expected to report the case to the HKMA first and complete its investigation as soon as possible. If a breach is eventually confirmed, it should notify the HKMA formally without delay. 6.3 Remedial action 6.3.1 Pursuant to §81A(5) of the BO, an AI must comply with any provision of the BELR applicable to it. This does not confine to the provisions on exposure limits or conditions that constitute notifiable events. If an AI contravenes §81A(5), pursuant to §81B, the MA must enter into discussions for the purposes of determining what remedial action should be taken by the AI to comply with the section, but the MA is not bound by the discussions. The MA may, after holding such discussions, by notice in writing served on the AI to require it to take the remedial action specified in the notice. This is referred to under §81C of the BO as the remedial action requirement. 6.4 Offence 6.4.1 Pursuant to §81C(2) of the BO, failure to comply with a prescribed notification requirement or remedial action requirement is an offence. In proceedings for such an offence, it shall be a defence under §126 of the BO for the person

36 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] charged to prove that he took reasonable precautions and exercised due diligence to avoid the commission of such an offence by himself or any person under his control. The AI itself and every director, every chief executive and every manager 21 of the AI are liable to penalties (e.g. fine and imprisonment). The HKMA will consider whether the offence should be recommended for prosecution based on the circumstances of each case. 6.4.2 On the one hand, the breach of statutory limits under the BELR may indicate that the AI does not have adequate systems of control to ensure that the limits specified in the BELR will not be exceeded. On the other hand, the breach of prudential limits agreed with the HKMA may indicate that the AI does not carry out its business in a prudent manner. This may call into question whether the AI continues to satisfy the relevant authorization criteria under the Seventh Schedule to the BO (i.e. paragraphs 8 and 12). The HKMA will consider whether the MA’s power to revoke the authorization of the AI is exercisable22 and if so, whether it should be exercised. 6.4.3 If a breach occurs, the HKMA may consider taking other appropriate actions, e.g. increasing the AI’s minimum capital adequacy ratio or limiting its business expansion. It may also require the AI to agree a timetable to bring the exposure quickly below the statutory limit or any agreed limit and to report progress on a regular basis. 6.5 Regulatory reporting 6.5.1 AIs are required to report to the HKMA their large exposures in the “Return of Large Exposures” (MA(BS)28) and to certify compliance with the BELR in the “Certificate of Compliance” (MA(BS)1F(a) is applicable to locally incorporated AIs while MA(BS)1F(b) is applicable to AIs incorporated outside Hong Kong). 6.5.2 Where necessary, the HKMA may require particular AIs to adhere to different reporting requirements in relation to large exposures. 6.5.3 AIs should have adequate management information and reporting systems that provide robust risk data aggregation

21 The meaning of “manager” is as defined under §2(1) of the BO. 22 The MA’s power to revoke the authorization of an AI is exercisable when the AI fails to meet any minimum authorization criterion stipulated in the Seventh Schedule to the BO.

37 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] and risk reporting capabilities. This should enable the AI to generate accurate and reliable risk data not only for the normal regulatory reporting as mentioned under section 6.5.1 but also for meeting ad hoc supervisory reporting requirements on a timely basis, especially during periods of financial stress. ————————— Contents Glossary Home Introduction

38 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] Annex Illustrative examples for the formation of an LC group A. Linking by control factor Diagram 1 In Diagram 1 above, assuming that A is the holding company of A1, A2, A3 and A4, all the entities falling within this controlling structure that are counterparties of the AI should be regarded as an LC group of the AI. To avoid doubt, a subsidiary should be included in the LC group even if its holding company is not a direct counterparty of the AI. For example, in Diagram 1 if A is not a counterparty of the AI but A1, A2, A3 and A4 are, A1 to A4 should still be treated as an LC group of the AI. Similarly, if A1 is not a counterparty of the AI but A3 is, A3 should still be included in this LC group. B. Linking by economic dependence factor Diagram 2 A A1 A3 A2 A4 A A1 A3 A2 A4 B B1 B2 C C1 D

39 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] In Diagram 2 above, assuming all entities are the AI’s counterparties and the entities are not economically dependent on each other except the following: B1 is economically dependent on A, C1 is economically dependent on A1 and D is economically dependent on B1. Scenario 1: If the AI’s ASCE ratio to A, A1 and B1 does not exceed 5%, by virtue of Rule 41(3) and (4), the AI may choose not to include B1 and C1 in the LC group of A (this implies that B, B2 and D that relate to B1 and C that relates to C1 are also not part of the LC group) or include D in the LC group of B. Accordingly, the following LC groups are identified: LC group A LC group B LC group C Counterparty D Scenario 2: If the AI’s ASCE ratio to A, A1 and B1 exceeds 5%, the AI needs to include B1, B2 and C1 in the LC group of A and include D in the LC group of B. B and C are not included in the LC group of A because this example assumes that B is not dependent on B1 and C is not dependent on C1. Please note that an AI is expected to identify direct economic dependent relationship only. Therefore it may choose not to include D in the LC group of A as D is only indirectly economically dependent on A via B1. LC group C is the same as under scenario

1. LC groups A and B are illustrated in the diagrams below: A A1 A3 A2 A4 B B1 B2 C C1 D

40 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] LC group A LC group B Scenario 3: If the AI’s ASCE ratio to A and B1 exceeds 5% but its ASCE ratio to A1 does not exceed 5%, by virtue of Rule 41(3), the AI may choose not to include C1 in the LC group of A. (Similarly, if the AI’s ASCE ratio to A does not exceed 5%, the AI may choose not to include B1 and B2 in the LC group of A.) Hence LC groups B and C are the same as under scenario 2. It is not necessary to include D in the LC group of A because D is not directly economically dependent on A. LC group A is illustrated in the diagram below: LC group A A A1 A3 A2 A4 B1 B2 C1 B B1 B2 D A A1 A3 A2 A4 B1 B2

41 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] C. LC group of exempted entities Diagram 3 In Diagram 3 above, assuming all entities are the AI’s counterparties and the counterparties are not economically dependent on each other except the following: B1 is economically dependent on exempted sovereign entity A, C1 is economically dependent on specified sovereign-owned entity A1 and C is economically dependent on C1. By virtue of Rule 41(3) and (5), an AI: (1) may choose not to identify entities that are economically dependent on an exempted sovereign entity A in its LC groups; (2) should not group entities under the control of or economically dependent on the exempted sovereign entity A (i.e. A1, A2, A3, A4, A5, B1, B2) all into the same LC group if they are not otherwise linked to each other under Rule 41(1); (3) should not group entities under the control of or economically dependent on the specified sovereign-owned entity A1 (i.e. A3, A4, C1, C) all into the same LC group if they are not otherwise linked to each other under Rule 41(1). Scenario 1: Assume the AI’s ASCE ratio to specified sovereign-owned entity A1 does not exceed 5%, by virtue of Rule 41(3), the AI may choose not to include entities that are economically dependent on A1 in its LC group. Hence the following LC groups should be identified: Exempted sovereign entity A Specified sovereign￾owned entity A1 A3 A4 A2 A5 B B1 B2 C C1

42 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] LC groups of exempted sovereign entity A LC group C LC group B Exempted sovereign entity A Specified sovereign-owned entity A1 A3 Exempted sovereign entity A Specified sovereign-owned entity A1 A4 Exempted sovereign entity A A2 A5 C C1 B B1 B2

43 Supervisory Policy Manual CR-G-8 Large Exposures and Risk Concentrations V.4 – [01.01.25] Scenario 2: Assume that the AI’s ASCE ratio to specified sovereign-owned entity A1 exceeds 5%. The AI needs to include C1 and by virtue of Rule 41(2)(f) C into the LC group of A1. The LC groups B and C are the same as under scenario 1. The LC groups of exempted sovereign entity A are illustrated in the diagrams below: LC groups of exempted sovereign entity A

Note: When completing the Large Exposures Return (MA(BS)28), an AI should determine the aggregate exposure to each of the above LC groups according to the completion instructions and report the exposures that meet the reporting criteria in Parts II, III & IV accordingly. Exempted sovereign entity A Specified sovereign-owned entity A1 A3 Exempted sovereign entity A Specified sovereign-owned entity A1 C C1 Exempted sovereign entity A A2 A5 Exempted sovereign entity A Specified sovereign-owned entity A1 A4