Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 1 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To set out the minimum standards which the HKMA expects AIs to adopt for the calculation of their market risk capital charges. This module is designed not just to provide details in addition to the Banking (Capital) Rules but to integrally cover all the related requirements. Classification A statutory guideline issued by the MA under the Banking Ordinance (the Ordinance), section 7(3). Previous guidelines superseded MR-1 “Market Risk Capital Charge” (V.1) dated 15.03.2024 Application To all locally incorporated AIs Structure

1. Introduction 1.1 Terminology 1.2 Background 1.3 Scope of application 1.4 Approaches to calculation of market risk capital charge 1.5 Implementation
2. Boundaries between books 2.1 Scope of the trading book 2.2 Treatments of internal risk transfers 2.3 Definition of trading desks
3. Standardised (market risk) approach

Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 2 3.1 Structure 3.2 Sensitivities-based method 3.3 SBM: risk factors and sensitivity definition 3.4 SBM: delta risk weights and correlations 3.5 SBM: vega risk weights and correlations 3.6 SBM: curvature risk weights and correlations 3.7 Residual risk add-on 3.8 Standardised default risk charge 3.9 SA-DRC for non-securitisations 3.10 SA-DRC for securitisations (non-CTP) 3.11 SA-DRC for securitisations (CTP) 4. Internal models approach 4.1 General provisions 4.2 Specification of risk factors 4.3 Model eligibility of risk factors 4.4 Backtesting and PLAT 4.5 Capital charges under the IMA 4.6 Capital charges for non-modellable risk factors 4.7 IMA default risk charge 4.8 Aggregation of capital charge 5. Simplified standardised approach 5.1 Eligibility criteria 5.2 Capital charges under the SSTM approach 6. Cryptoasset exposures 6.1 Treatment of Group 1 cryptoassets 6.2 Treatment of Group 2a cryptoassets Annex A: Example of calculations under structural FX exemption Annex B: Abbreviations

3 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025

1. Introduction 1.1 Terminology 1.1.1 Unless otherwise specified, the terms used in this module have the same meaning as those used in the Banking (Capital) Rules (“the Rules”). 1.1.2 For the purposes of this module, the interpretation of certain terms is set out as follows:  “curvature” has the same meaning of “SBM curvature” as defined in section 281 of the Rules;  “delta” has the same meaning of “SBM delta” as defined in section 281 of the Rules;  “fund” has the same meaning of “collective investment scheme” as defined in section 2 of the Rules; and  “vega” has the same meaning of “SBM vega” as defined in section 281 of the Rules. 1.2 Background 1.2.1 In January 2019, the Basel Committee on Banking Supervision (“BCBS”) issued its revised Minimum capital requirements for market risk, commonly referred to as the “Fundamental Review of the Trading Book” (“FRTB”).1 The framework aims at addressing the structural shortcomings of the market risk framework under the Basel 2.5 regime. It follows up on an original version published in January 2016 2 and includes a set of amendments to address issues that have been identified through input from a wide spectrum of stakeholders. 1.2.2 The HKMA implemented the new market risk capital framework closely aligned with the FRTB standards 1 http://www.bis.org/bcbs/publ/d457.htm 2 http://www.bis.org/bcbs/publ/d352.htm

4 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 issued by the BCBS. 3 They are set out in Part 8 of the Rules and, with additional technical details, in this module. 1.2.3 This module is based on the Rules and intends to provide all the requirements for implementing the new market risk capital framework in Hong Kong. It covers the standardised (market risk) approach (“STM approach”), the internal models approach (“IMA”), the simplified standardised approach (“SSTM approach”), as well as requirements related to the boundary between the trading book and banking book. 1.2.4 In case of any discrepancy between this module and the Rules, the Rules will prevail. 1.3 Scope of application 1.3.1 Market risk is defined as the risk of losses arising from movements in market prices. The risks subject to market risk capital charges include:  interest rate risk, credit spread risk, equity risk, foreign exchange risk, commodities risk and default risk for trading book instruments;  foreign exchange risk and commodities risk for banking book instruments; and  risk for cryptoasset exposures subject to the trading book treatment as mentioned in section 6.2. 1.3.2 All transactions, including forward sales and purchases, should be included in the calculation of capital charges as of the date on which they were entered into. Although regular reporting will in principle take place only at intervals, an AI is expected to:  manage its market risk in such a way that the 3 Unless otherwise specified, the FAQs incorporated in the Basel Framework prior to 1 January 2025 are applicable to the market risk capital framework in Hong Kong, with the key ones being incorporated into this module. For FAQs published by the BCBS after 1 January 2025, we will notify AIs of the effective implementation date of such FAQs, and the key ones will be incorporated into this module in due course.

5 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 capital charges are being met at any time. The AI must not window-dress by showing systematically lower market risk positions on reporting dates; and  maintain strict risk management systems to ensure that intraday exposures are not excessive. If an AI fails to meet the capital charges at any time, it should take immediate measures to rectify the situation. 1.3.3 A matched currency risk position will protect an AI against loss from movements in exchange rates, but will not necessarily protect its capital adequacy ratio. If the AI has its capital denominated in HKD and has a portfolio of foreign currency assets and liabilities that is completely matched, its capital/asset ratio will fall if HKD depreciates. By running a short risk position in HKD, the AI can protect its capital adequacy ratio, although the risk position would lead to a loss if HKD were to appreciate. The AI is allowed to protect its capital adequacy ratio4 in this way and exclude certain currency risk positions from the calculation of net open currency risk positions, subject to meeting each of the following conditions:  The risk position is taken or maintained for the purpose of hedging partially or totally against the potential that changes in exchange rates could have an adverse effect on its capital ratio.  The risk position is of a structural (i.e. non￾dealing) nature such as positions stemming from: – investments in affiliated but not consolidated entities denominated in foreign currencies; or – investments in consolidated subsidiaries or branches denominated in foreign currencies.  The exclusion is limited to the amount of the risk position that neutralises the sensitivity of the 4 The HKMA does not intend to limit the choice of the capital ratio to be hedged. An AI is free to choose the ratio it intends to hedge and develop a sound hedging strategy accordingly as long as the relevant ratio is used consistently over time.

6 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 capital ratio to movements in exchange rates.5 The AI should determine this threshold at least on a monthly basis and monitor the risk position level on a continuous basis. Any excess portions must be included in the calculation of net open currency risk positions and are subject to the market risk capital charge for foreign exchange (“FX”) risk.  The exclusion from the calculation is made for at least six months.  The establishment of a structural FX position and any changes in its position should follow the AI’s risk management policy for structural FX positions. This policy should be pre-approved by the HKMA.  Any exclusion of the risk position needs to be applied consistently, with the exclusionary treatment of the hedge remaining in place for the life of the assets or other items.  The AI should document and have available for supervisory review the positions and amounts to be excluded from market risk capital charges. 1.3.4 No FX risk capital charge need apply to positions related to items that are deducted from an AI’s capital when calculating its capital base. 1.3.5 Holdings of capital instruments that are deducted from an AI’s capital or risk-weighted at 1,250% are not allowed to be included in the market risk framework. This includes:  holdings of the AI’s own eligible regulatory capital instruments; and  holdings of other AIs’, securities firms’ and other financial entities’ eligible regulatory capital instruments, as well as intangible assets, where 5 For example, an AI maintains an open position of CNY (a net long position) and such a risk position fulfils all the other conditions specified in this paragraph. The AI should determine the maximum exclusion allowed as the amount of CNY position such that the capital ratio is insensitive to the movements in the exchange rate CNY/HKD. See Annex A for a numerical example.

7 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 the HKMA requires that such assets are deducted from capital. 1.3.6 For the purposes of calculating the capital adequacy ratio of an AI that has one or more than one subsidiary, the HKMA may require the capital adequacy ratio of the AI to be calculated:  on an unconsolidated basis in respect of the AI;  on a consolidated basis in respect of the AI and one or more of such subsidiaries; or  on an unconsolidated basis in respect of the AI and on a consolidated basis in respect of the AI and one or more of such subsidiaries. 1.3.7 An AI should include the net short and net long risk positions, no matter where they are booked. However, there will be circumstances in which the HKMA may demand that the individual risk positions be taken into the measurement system without any offsetting or netting against other risk positions. This may be needed, for example, where there are obstacles to the quick repatriation of profits from a foreign subsidiary or where there are legal and procedural difficulties in carrying out the timely management of risks on a consolidated basis. 1.4 Approaches to calculation of market risk capital charge 1.4.1 All locally incorporated AIs, with the exception of those mentioned in paragraph 1.4.3, will be required to calculate their market risk capital charge using (i) the STM approach, (ii) subject to approval, the IMA or (iii) subject to approval, the SSTM approach. 1.4.2 All AIs, except for those that are allowed to use the SSTM approach as set out in section 5 or qualify for the de-minimis exemption as set out in paragraph 1.4.3, should calculate the capital charges using the STM approach. AIs that have an HKMA approval to use the IMA for market risk capital charges should also report the capital charges calculated as set out below.  An AI that uses the IMA for any of its trading

8 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 desks should also calculate the capital charge under the STM approach for all instruments across all trading desks, regardless of whether those trading desks are eligible for the IMA.  In addition, an AI that uses the IMA for any of its trading desks should calculate the STM approach capital charge for each trading desk that is eligible for the IMA as if that trading desk were a standalone regulatory portfolio (i.e. with no offsetting across trading desks). This will serve as an indication of the fallback capital charge for those desks that fail the eligibility criteria for inclusion in the AI’s internal model as outlined in section 4. 1.4.3 An AI with market risk positions permanently below (i) HKD 60 million and (ii) 6% of total on-balance sheet and off-balance sheet positions in accordance with section 22 of the Rules qualifies for the de-minimis exemption and shall not include market risk in the calculation of its capital adequacy ratio. 1.5 Implementation 1.5.1 Version 2 of this module takes effect on the same date as the commencement date of the Banking (Capital) (Amendment) Rules 2025 (i.e. 1 January 2026). 2. Boundaries between books 2.1 Scope of the trading book 2.1.1 A trading book consists of all instruments that meet the specifications for trading book instruments set out in paragraphs 2.1.2 to 2.1.13. All other instruments should be included in the banking book. 2.1.2 Instruments comprise financial instruments, foreign exchange, and commodities. A financial instrument is any contract that gives rise to both a financial asset of one entity and a financial liability or equity instrument of another entity. Financial instruments include both primary financial instruments (or cash instruments) and derivative financial instruments. A financial asset is any

9 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 asset that is cash, the right to receive cash or another financial asset or a commodity, or an equity instrument. A financial liability is the contractual obligation to deliver cash or another financial asset or a commodity. Commodities also include non-tangible (i.e. non￾physical) goods such as electric power. 2.1.3 An AI should only include a financial instrument, instruments on FX or commodity in the trading book when there is no legal impediment against selling or fully hedging it. 2.1.4 An AI should fair value daily any trading book instrument and recognise any valuation change in the profit and loss (“P&L”) account. Standards for assigning instruments to the regulatory books 2.1.5 When an AI holds any instrument for one or more of the following purposes, the AI should designate it as a trading book instrument upon initial recognition on its books, unless specifically otherwise provided for in paragraph 2.1.3 or paragraph 2.1.8:  short-term resale;  profiting from short-term price movements6 ;  locking in arbitrage profits; or  hedging risks that arise from instruments meeting the criteria above. 2.1.6 Any of the following instruments is seen as being held for at least one of the purposes listed in paragraph 2.1.5 and should therefore be included in the trading book, unless specifically otherwise provided for in paragraph 2.1.3 or paragraph 2.1.8:  instruments in the correlation trading portfolio7 (“CTP”); 6 For instruments that are measured at fair value with value changes recognised in the profit and loss account, such instruments are generally perceived as being held for profiting from short-term price movements. 7 The term “correlation trading portfolio” has the same meaning as defined in section 281 of the Rules.

10 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  instruments that would give rise to a net short credit or equity position in the banking book8 ; or  instruments resulting from underwriting commitments, where underwriting commitments refer only to securities underwriting, and relate only to securities that are expected to be actually purchased by an AI on the settlement date. 2.1.7 Any instrument which is not held for any of the purposes listed in paragraph 2.1.5 at inception, nor seen as being held for these purposes according to paragraph 2.1.6, should be assigned to the banking book. 2.1.8 An AI should assign the following instruments to the banking book:  unlisted equities;  instruments designated for securitisation warehousing;  real estate holdings, where in the context of assigning instrument to the trading book, real estate holdings relate only to direct holdings of real estate as well as derivatives on direct holdings;  retail and small or medium-sized enterprise (“SME”) credit;  equity investments in a fund, unless the AI meets at least one of the following conditions: – the AI is able to look through the fund to its individual components and there is sufficient and frequent information, verified by an independent third party, provided to the AI regarding the fund’s composition; or – the AI obtains daily price quotes for the fund and it has access to the information contained 8 An AI will have a net short risk position for equity risk or credit risk in the banking book if the present value of the banking book increases when an equity price decreases or when a credit spread on an issuer or group of issuers of debt increases.

11 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 in the fund’s mandate or in the relevant regulations governing such investment funds;  hedge funds;  derivative instruments and funds that have the above instrument types as underlying assets; or  instruments held for the purpose of hedging a particular risk of a position in the types of instrument above. 2.1.9 There is a general presumption that any of the following instruments are being held for at least one of the purposes listed in paragraph 2.1.5 and therefore are trading book instruments, unless specifically otherwise provided for in paragraph 2.1.3 or paragraph 2.1.8:  instruments held as accounting trading assets or liabilities;9

 instruments resulting from market-making activities;  equity investments in a fund excluding those assigned to the banking book in accordance with paragraph 2.1.8;  listed equities;10  trading-related repo-style transaction;11 or 9 Under HKAS 39, these instruments would be designated as held for trading. Under HKFRS 9, these instruments would be held within a trading business model and include all instruments falling under the definition of “held for trading” in HKFRS 9. These instruments would be fair valued through the P&L account. 10 Subject to the HKMA’s review, certain listed equities may be excluded from the market risk framework. Examples of equities that may be excluded include, but are not limited to, equity positions arising from deferred compensation plans, convertible debt securities, loan products with interest paid in the form of “equity kickers”, equities taken as a debt previously contracted, bank-owned life insurance products, and legislated programmes. The set of listed equities that an AI wishes to exclude from the market risk framework should be made available to, and discussed with, the HKMA and should be managed by a desk that is separate from desks for proprietary or short-term buy/sell instruments. 11 Trading-related repo-style transactions comprise those entered into for the purposes of market-making, locking in arbitrage profits or creating short credit or equity positions. Repo-style transactions that are (i) entered for liquidity management and (ii) valued at accrual for accounting purposes are not part of the presumptive list of paragraph 2.1.9.

12 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  options (including embedded derivatives12 that (i) relate to instruments issued out of the institution’s own banking book and (ii) relate to credit or equity risk). 2.1.10 An AI is allowed to deviate from the presumptive list specified in paragraph 2.1.9 according to the process set out below.  If an AI believes that it needs to deviate from the presumptive list established in paragraph 2.1.9 for an instrument, it should submit a written request to the HKMA and receive explicit approval. In its request, the AI should provide evidence that the instrument is not held for any of the purposes in paragraph 2.1.5. Examples of evidence include but are not limited to (i) policies or guidelines in relation to the investment strategy or hedging strategy regarding the instrument, and (ii) transaction records of similar products.  In cases where this approval is not given by the HKMA, an AI should designate the instrument as a trading book instrument. The AI should document any deviations from the presumptive list in detail on an ongoing basis. Supervisory power 2.1.11 Notwithstanding the process established in paragraph 2.1.10 for instruments on the presumptive list, the HKMA may require an AI to provide evidence that an instrument in the trading book is held for at least one of the purposes of paragraph 2.1.5. If the HKMA is of the view that the AI has not provided sufficient evidence or if the HKMA believes the instrument customarily would belong in the banking book, the HKMA may require the AI to assign the instrument to the banking book, except if it is an instrument listed under paragraph 2.1.6. 12 An embedded derivative is a component of a hybrid contract that includes a non-derivative host such as liabilities issued out of an AI’s own banking book that contain embedded derivatives. The embedded derivative associated with the issued instrument (i.e. host) should be bifurcated and separately recognised on the AI’s balance sheet for accounting purposes.

13 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 2.1.12 The HKMA may require an AI to provide evidence that an instrument in the banking book is not held for any of the purposes of paragraph 2.1.5. If the HKMA is of the view that the AI has not provided enough evidence, or if the HKMA believes such instruments would customarily belong in the trading book, the HKMA may require the AI to assign the instrument to the trading book, except if it is an instrument listed under paragraph 2.1.8. Documentation of instrument designation 2.1.13 An AI should have clearly defined policies, procedures and documented practices for determining which instruments to include in or to exclude from the trading book for the purposes of calculating their regulatory capital, ensuring compliance with the criteria set forth in this subsection, and taking into account an AI’s risk management capabilities and practices. The AI’s internal control functions should conduct an ongoing evaluation of instruments both in and out of the trading book to assess whether its instruments are being properly designated initially as trading or non-trading instruments in the context of the AI’s trading activities. Compliance with the policies and procedures should be fully documented and subject to periodic (at least yearly) internal audit and the results should be available for the HKMA to review. Restrictions on moving instruments between the regulatory books 2.1.14 Apart from moves required by paragraphs 2.1.5 to 2.1.10, there is a strict limit on the ability of an AI to move instruments between the trading book and the banking book by their own discretion after initial designation, which is subject to the process in paragraphs 2.1.15 and 2.1.16. 13 Switching instruments for regulatory arbitrage is strictly prohibited. In practice, switching should be rare and will be approved by the 13 Re-designation of books at the time of implementation of the new boundary requirements as well as transfers between books resulting from a cryptoasset reclassification specified in paragraphs 2.1.2 and 2.1.3 of CRP-1 “Classification of Cryptoassets” are not considered a move as specified in this paragraph and are therefore not subject to the capital surcharge specified in paragraph 2.1.15.

14 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 HKMA only in extraordinary circumstances. Examples are a major publicly announced event, such as an AI restructuring that results in the permanent closure of trading desks, requiring termination of the business activity applicable to the instrument or portfolio or a change in accounting standards that allows an item to be fair-valued through P&L. Market events, changes in the liquidity of a financial instrument, or a change of trading intent alone are not valid reasons for reassigning an instrument to a different book. When switching positions, the AI should ensure that the standards described in paragraphs 2.1.5 to 2.1.10 are always strictly observed. 2.1.15 Without exception, a capital benefit as a result of switching will not be allowed in any case or circumstance. This means that an AI should determine its total capital charge (across the banking book and trading book) before and immediately after the switch. If this capital charge is reduced as a result of this switch, the difference as measured at the time of the switch will be imposed on the AI as a disclosed Pillar 1 capital surcharge. This surcharge will be allowed to run off as the positions mature or expire, in a manner agreed with the HKMA. 14 To maintain operational simplicity this additional capital charge does not need to be recalculated on an ongoing basis, although the positions will continue to also be subject to the ongoing capital charges of the book into which they have been switched. 2.1.16 Any reassignment between books should be approved by senior management and the HKMA as follows. Any reallocation of securities between the trading book and banking book, including outright sales at arm’s length, should be considered a reassignment of securities and is governed by requirements of this paragraph.  Any reassignment should be approved by senior 14 In general, the capital surcharge could be discharged in full once the position concerned has matured or expired. In other situations, for example, early terminations or close-out before the maturity date, AIs are expected to communicate the date of discharging the capital surcharge with the HKMA before doing so.

15 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 management; thoroughly documented; determined by internal review to be in compliance with an AI’s policies; subject to prior approval by the HKMA based on supporting documentation provided by the AI; and publicly disclosed.  Unless required by changes in the characteristics of a position, any such reassignment is irrevocable.  If an instrument is reclassified to be an accounting trading asset or liability, there is a presumption that this instrument is in the trading book, as described in paragraph 2.1.9. Accordingly, in this case an automatic switch without approval of the HKMA is acceptable.15 2.1.17 An AI should adopt relevant policies that are updated at least yearly. Updates should be based on an analysis of all extraordinary events identified during the previous year. Updated policies with changes highlighted should be sent to the HKMA. Policies should include the following:  the reassignment restriction requirements in paragraphs 2.1.14 to 2.1.16, especially the restriction that re-designation between the trading book and banking book may only be allowed in extraordinary circumstances, and a description of the circumstances or criteria where such a switch may be considered;  the process for obtaining senior management and supervisory approval for such a transfer;  how the AI identifies an extraordinary event; and  a requirement that re-assignments into or out of the trading book be publicly disclosed at the earliest reporting date. 15 For example, a failure in the hedge effectiveness test leads to a reclassification of the hedging instrument to an accounting trading asset or liability, the hedging instrument immediately and automatically switches from the banking book to the trading book. This means at that time the derivatives should be included in calculation of market risk capital charge. In addition, paragraph 2.1.15 still applies to this situation.

16 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 2.2 Treatment of internal risk transfers 2.2.1 An internal risk transfer is an internal written record of a transfer of risk within the banking book, between the banking and the trading book or within the trading book (between different desks), for example, via internal derivative trades. The reallocation of securities between the trading and banking book is considered a reassignment of securities and is subject to the restrictions of paragraph 2.1.16. 2.2.2 There will be no regulatory capital recognition for internal risk transfers from the trading book to the banking book. Thus, if an AI engages in an internal risk transfer from the trading book to the banking book (e.g. for economic reasons) this internal risk transfer would not be taken into account when the regulatory capital charges are determined. 2.2.3 For internal risk transfers from the banking book to the trading book, paragraphs 2.2.4 to 2.2.10 apply. Internal risk transfer of credit risk 2.2.4 When an AI hedges a banking book credit risk exposure using a hedging instrument purchased through its trading book (i.e. using an internal risk transfer), the credit exposure in the banking book is deemed to be hedged for capital charge purposes if and only if the internal risk transfer fulfils the requirements of section 99B or 213 of the Rules, as the case requires. 2.2.5 Where the requirements in paragraph 2.2.4 are fulfilled, the banking book exposure is deemed to be hedged by the banking book leg of the internal risk transfer for capital purposes in the banking book. Moreover, both the trading book leg of the internal risk transfer and the external hedge should be included in the market risk capital charges. 2.2.6 Where the requirements in paragraph 2.2.4 are not fulfilled, the banking book exposure is not deemed to be hedged by the banking book leg of the internal risk transfer for capital purposes in the banking book.

17 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Moreover, the third-party external hedge should be fully included in the market risk capital charges and the trading book leg of the internal risk transfer should be fully excluded from the market risk capital charges. 2.2.7 A banking book short credit position created by an internal risk transfer 16 and not capitalised under banking book rules should be capitalised under the market risk rules together with the trading book exposure. Internal risk transfers of general interest rate risk 2.2.8 When an AI hedges a banking book interest rate risk exposure using an internal risk transfer with its trading book, the trading book leg of the internal risk transfer is treated as a trading book instrument under the market risk framework if and only if:  the internal risk transfer is documented with respect to the banking book interest rate risk being hedged and the sources of such risk;  the internal risk transfer is conducted with a dedicated internal risk transfer trading desk 17 which has been specifically approved by the HKMA for this purpose; and  the internal risk transfer should be subject to trading book capital charges under the market risk framework on a standalone basis for the dedicated internal risk transfer desk, separate from any other general interest rate risk or other market risks generated by activities in the trading book. 16 Banking book instruments that are over-hedged by their respective documented internal risk transfer create a short (risk) position in the banking book. 17 Similar to the notional trading desk treatment set out in paragraph 2.3.9 for FX or commodities positions held in the banking book, GIRR internal risk transfers may be allocated to a trading desk that need not have traders or trading accounts assigned to it. Only the quantitative trading desk requirements (i.e. profit and loss attribution test and backtesting) set out in section 4.4 apply to this dedicated internal risk transfer trading desk for the use of the IMA, subject to approval. The qualitative criteria as set out in paragraphs 2.3.5 to 2.3.7 do not apply. In addition, this dedicated trading desk should not be allocated with any trading book positions other than the internal risk transfers of general interest rate risk between the trading book and the banking book as well as any external hedges that meet the conditions specified in paragraph 2.2.10.

18 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 2.2.9 Where the requirements in paragraph 2.2.8 are fulfilled, the banking book leg of the internal risk transfer should be included in the banking book’s measure of interest rate risk exposures for regulatory capital purposes. 2.2.10 The approved internal risk transfer desk may include instruments purchased from the market (i.e. external parties to an AI). Such transactions may be executed directly between the internal risk transfer desk and the market. Alternatively, the internal risk transfer desk may obtain the external hedge from the market via a separate non-internal risk transfer trading desk acting as an agent, if and only if the GIRR internal risk transfer entered into with the non-internal risk transfer trading desk exactly matches the external hedge from the market. In this latter case the respective legs of the GIRR internal risk transfer are included in the internal risk transfer desk and the non-internal risk transfer desk. Internal risk transfers between trading desks 2.2.11 Internal risk transfers between trading desks within the scope of application of the market risk capital charges (including FX risk and commodities risk in the banking book) will generally receive regulatory capital recognition. Internal risk transfers between the internal risk transfer desk and other trading desks will only receive regulatory capital recognition if the constraints in paragraphs 2.2.8 to 2.2.10 are fulfilled. 2.2.12 The trading book leg of internal risk transfers should fulfil the same requirements under section 2 as instruments in the trading book transacted with external counterparties. Eligible hedges for the CVA risk capital charge 2.2.13 Eligible external hedges that are included in the credit valuation adjustment (“CVA”) risk capital charge should be removed from an AI’s market risk capital charge calculation. 2.2.14 An AI may enter into internal risk transfers between the CVA portfolio and the trading book. Such an internal

19 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 risk transfer consists of a CVA portfolio side and a non￾CVA portfolio side. Where the CVA portfolio side of an internal risk transfer is recognised in the CVA risk capital charge, the CVA portfolio side should be excluded from the market risk capital charge, while the non-CVA portfolio side should be included in the market risk capital charge. 2.2.15 In any case, such internal CVA risk transfers can only receive regulatory capital recognition if the internal risk transfer is documented with respect to the CVA risk being hedged and the sources of such risk. 2.2.16 Internal CVA risk transfers that are subject to curvature, default risk or residual risk add-on as set out in section 3 may be recognised in the CVA portfolio capital charge and market risk capital charge only if the trading book additionally enters into an external hedge with an eligible third-party protection provider that exactly matches the internal risk transfer. 2.2.17 Independent from the treatment in the CVA risk capital charge and the market risk capital charge, internal risk transfers between the CVA portfolio and the trading book can be used to hedge the counterparty credit risk exposure of a derivative instrument in the trading or banking book as long as the requirements of paragraph 2.2.4 are met. 2.3 Definition of trading desks 2.3.1 For the purposes of market risk capital calculations, a trading desk is the level at which model approval is granted for the IMA and is defined as a group of traders or trading accounts that implements a well-defined business strategy operating within a clear risk management structure. 2.3.2 Trading desks are defined by the AI but subject to the regulatory approval of the HKMA for regulatory capital purposes under the IMA. 2.3.3 The HKMA will consider the definition of the trading desk as part of the initial model approval for the trading desk, as well as ongoing approval.

20 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  The HKMA will determine, based on the size of the AI’s overall trading operations, whether the proposed trading desk definitions are sufficiently granular.  The HKMA will review the policy document prepared by the AI documenting how the proposed definition of trading desk meets the criteria listed in this subsection. 2.3.4 An AI may further define operational subdesks for internal operational purposes without the need of an HKMA approval. 2.3.5 A trading desk for regulatory capital purpose under the IMA is an unambiguously defined group of traders or trading accounts18 .  The trading desk should have one head trader who has direct oversight of the group of traders or trading accounts. The trading desk can have up to two head traders provided their roles, responsibilities and authorities are either clearly separated or one has ultimate oversight over the other.  Each trader or each trading account in the trading desk should have a clearly defined specialty (or specialties).  Each trading account should only be assigned to a single trading desk that has a clearly defined risk scope (e.g. permitted risk class and risk factors) consistent with its pre-established objectives.  There is a presumption that traders (as well as head traders) are allocated to one trading desk. An AI can deviate from this presumption provided it can be justified to the HKMA on the basis of sound management, business and/or resource allocation reasons. Such assignments should not be made for the only purpose of avoiding other 18 A trading account is an indisputable and unambiguous unit of observation in accounting for trading activity.

21 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 trading desk requirements (e.g. to optimise the likelihood of success in the backtesting and profit and loss attribution tests).  The trading desk should have a clear reporting line to the senior management, and should have a clear and formal compensation policy clearly linked to the pre-established objectives of the trading desk. 2.3.6 A trading desk should have a well-defined and documented business strategy.  There should be a clear description of the economics of the business strategy for the trading desk, its primary activities and trading/hedging strategies.  The management team at the trading desk should have a clear annual plan for the budgeting and staffing of the trading desk.  The documented business strategy of a trading desk should include regular management information reports, covering revenue, costs and risk-weighted assets for the trading desk. 2.3.7 A trading desk should have a clear risk management structure.  The AI should identify key groups and personnel responsible for overseeing the risk-taking activities at the trading desk.  A trading desk should clearly define trading limits (e.g. sensitivity or notional limits) based on the business strategy of the trading desk and these limits should be reviewed at least annually by senior management of the AI. In setting limits, the trading desk should have well-defined trader mandates.  A trading desk should produce, at least weekly, appropriate risk management reports. This would include, at a minimum: – P&L reports, which would be periodically

22 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 reviewed, validated and modified (if necessary) by Product Control; and – internal and regulatory risk measure reports, including trading desk value-at-risk (“VaR”) / expected shortfall (“ES”), trading desk VaR/ES sensitivities to risk factors and backtesting. 2.3.8 The AI should prepare, evaluate, and have available for the HKMA the following for all trading desks:  inventory ageing reports;  daily limit reports including exposures, limit breaches, and follow-up action;  reports on intraday limits and respective utilisation and breaches for AIs with active intraday trading; and  reports on the assessment of market liquidity. 2.3.9 Any foreign exchange or commodity positions held in the banking book should be included in the market risk capital charge as set out in paragraph 1.3.1. For regulatory capital calculation purposes, these positions will be treated as if they were held on notional trading desks within the trading book, which does not require having any traders or trading accounts assigned to it and need not meet the qualitative trading desk requirements set out in paragraphs 2.3.5 to 2.3.8. An AI that wishes to use the IMA to measure the FX or commodity risk of such notional trading desks should take the following actions:  transfer all or part of the banking book FX and commodity risks to another trading desk via intra￾trading book internal risk transfers (where trading desk requirements would continue to apply as appropriate for that desk), and/or  apply for IMA approval for the notional trading desk. In this case, the notional desk only needs to meet the quantitative trading desk requirements.

23 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3. Standardised (market risk) approach 3.1 Structure 3.1.1 An AI should calculate and report the capital charges under the STM approach to the HKMA on a monthly basis, except for AIs that qualifies for the de-minimis exemption mentioned in paragraph 1.4.3 or, subject to approval of the HKMA, uses the SSTM approach. 3.1.2 An AI should also determine its regulatory capital charge for market risk according to the STM approach at any time at the demand of the HKMA. 3.1.3 An AI should calculate the capital charge for market risk with the STM approach for all its trading book positions and the foreign exchange and commodity risks from its banking book positions as the sum of the following three components, as well as any capital surcharge specified elsewhere in the framework:  sensitivities-based method (“SBM”) allows the use of sensitivities to capture delta, vega and curvature risks within a prescribed set of risk classes. The SBM entails expanding the use of sensitivities across the STM approach;  residual risk add-on (“RRAO”) is introduced to capture any other risks beyond the main risk factors already captured in the sensitivities-based method and the default risk charge. It provides for a simple and conservative capital treatment for the universe of more sophisticated instruments; and  standardised default risk charge (“SA-DRC”) is intended to capture jump-to-default (“JTD”) risk for equity and credit instruments.

24 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.2 Sensitivities-based method (“SBM”) Main definitions 3.2.1 Risk class means one of the following seven risk classes for the sensitivities-based method: (i) general interest rate risk (“GIRR”), (ii) credit spread risk for non￾securitisation (“CSR non-SEC”), (iii) credit spread risk for securitisations19 (non-correlation trading portfolio) (“CSR SEC (non-CTP)”), (iv) credit spread risk for securitisations (correlation trading portfolio) (“CSR SEC (CTP)”), (v) equity risk, (vi) commodity risk and (vii) foreign exchange risk. 3.2.2 Risk factor means a variable, e.g. a tenor of an interest rate curve or an equity price, that affects the value of an instrument falling within the scope of the risk factor definitions in subsection 3.3. Risk factors are mapped to a risk class. 3.2.3 Risk position is the main input that enters the risk charge computation. For delta and vega risks, it is a sensitivity to a risk factor. For curvature risk, it is based 19 The term “securitisation” has the same meaning of “securitization exposure” as defined in section 2(1) of the Rules.

25 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 on the worse of upward and downward stress scenarios. 3.2.4 Bucket means a set of risk factors within one risk class which are grouped together by common characteristics, as defined in paragraphs 3.4.2, 3.4.9, 3.4.15, 3.4.18, 3.4.24 and 3.4.35. 3.2.5 Risk charge is the amount of capital that an AI should hold as a consequence of the risks it takes; it is computed as an aggregation of risk positions first at the bucket level, and then across buckets within a risk class defined for the sensitivities-based method. Components of the SBM 3.2.6 An AI should calculate the risk charge for market risk under the sensitivities-based method by aggregating the following risk measures:  Delta risk which captures the risk of changes in the market value of an AI’s position due to movements in its non-volatility linear risk factors, as defined in paragraphs 3.3.1, 3.3.11, 3.3.15, 3.3.19, 3.3.22, 3.3.25, 3.3.28 and 3.3.29;  Vega risk which captures the risk of changes in the market value of an AI’s position due to movements in its volatility linear risk factors, as defined in paragraphs 3.3.8, 3.3.12, 3.3.16, 3.3.20, 3.3.23, 3.3.26 and 3.3.31; and  Curvature risk which captures the risk of changes in the market value of an AI’s position due to movements in its non-volatility risk factors not captured by the delta risk, as defined in paragraphs 3.3.9, 3.3.13, 3.3.17, 3.3.21, 3.3.24, 3.3.27, 3.3.32 and 3.3.33. Curvature risk is based on two stress scenarios involving an upward and a downward shock to a given risk factor. 3.2.7 The above three risk measures specify risk weights to be applied to the regulatory risk factor sensitivities. To calculate the overall capital charge, the risk-weighted sensitivities are aggregated using specified correlation parameters to recognise diversification benefits

26 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 between risk factors. In order to address the risk that correlations may increase or decrease in periods of financial stress, three risk charge figures should be calculated for each risk class defined under the sensitivities-based method (see paragraphs 3.2.15 to 3.2.16 for details), based on three different scenarios on the specified values for the correlation parameters 𝜌𝑘𝑙 (i.e. correlation between risk factors within a bucket) and 𝛾𝑏𝑐 (i.e. correlation between risk factors across buckets within a risk class). There should be no diversification benefit recognised between individual risk classes. Instrument prices and sensitivity calculation 3.2.8 In calculating the capital charge under the sensitivities￾based method, an AI should determine each delta and vega sensitivity and curvature scenario based on instrument prices or pricing models that an independent risk control unit within the AI uses to report market risks or actual profits and losses to senior management. However, for banking book positions subject to FX risk, the AI may use either the last available accounting value or the last available fair value as a starting point for calculating the delta sensitivity. Although the AI is not expected to perform a full revaluation of these banking book positions, AIs are expected to update the FX component of these positions at least on a monthly basis. 3.2.9 A key assumption of the STM approach is that an AI’s pricing model used in actual P&L reporting provides an appropriate basis for the determination of regulatory capital charges for all market risks. To ensure such adequacy, an AI should at minimum fulfil the requirements in section 4A of the Rules and the CA-S￾10 “Financial Instrument Fair Value Practices”. Instruments subject to delta, vega and curvature 3.2.10 All instruments held in trading desks and subject to the sensitivities-based method (i.e. excluding instruments where the value at any point in time is purely driven by an exotic underlying as set out in subsection 3.7), are subject to delta risk capital charge. Additionally:

27 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  An instrument with optionality is subject to risk charges for vega risk and curvature risk.  An instrument with an embedded prepayment option 20 is an instrument with optionality. Accordingly, the embedded option is subject to risk charges for vega and curvature risk with respect to the interest rate risk and credit spread risk (non-securitisation and securitisation) risk classes. When the prepayment option is a behavioural option, the instrument may also be subject to the residual risk add-on as per paragraph 3.7.2. The pricing model of the AI should reflect such behavioural patterns where relevant. Instruments in the securitised portfolio may have embedded prepayment options as well. In this case they may be subject to the residual risk add-on.  Instruments whose cash flows cannot be written as a linear function of underlying notional are subject to vega risk and curvature risk charges. For example, the cash flows generated by a plain￾vanilla option cannot be written as a linear function (as they are the maximum of the spot and the strike). Therefore, all options are subject to vega risk and curvature risk. Instruments whose cash flows generated by a coupon-bearing bond can be written as a linear function, are not subject to vega risk nor curvature risk charges.  Curvature risks may be calculated for all instruments subject to delta risk, not limited to those subject to vega risk as specified above. For example, where an AI manages the non-linear risk of instruments with optionality and other instruments holistically, the AI may choose to include instruments without optionality in the calculation of curvature risk. This treatment is 20 An instrument with a prepayment option is a debt instrument which grants the debtor the right to repay part or the entire principal amount before the contractual maturity without having to compensate for any foregone interest. The debtor can exercise this option with a financial gain by obtaining funding over the remaining maturity of the instrument at a lower rate in other ways in the market.

28 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 allowed subject to the following restrictions: (i) use of this approach shall be applied consistently through time; and (ii) curvature risk should be calculated for all instruments subject to the sensitivities-based method. Delta and vega risks 3.2.11 An AI should apply the delta and vega risk factors defined in subsection 3.3 to calculate the risk charge for delta and vega risks. 3.2.12 For each risk class, an AI should determine its instruments’ sensitivity to a set of prescribed risk factors, risk-weight those sensitivities, and aggregate the resulting risk-weighted sensitivities separately for delta and vega risk using the following step-by-step approach. Step 1: For each risk factor, a sensitivity is determined as set out in subsection 3.3. Step 2: Sensitivities to the same risk factor should be netted to give a net sensitivity 𝑠𝑘 across all instruments21 in the portfolio to each risk factor k. In calculating the net sensitivity, all sensitivities to the same given risk factor (e.g. all sensitivities to the 1-year tenor point of the HKD 3-month swap curve) from instruments of opposite direction should offset, irrespective of the instrument from which they derive. Step 3: The risk-weighted sensitivity 𝑊𝑆𝑘 is the product of the net sensitivity 𝑠𝑘 and the corresponding risk weight 𝑅𝑊𝑘 as defined in subsections 3.4 and 3.5. 𝑊𝑆𝑘 = 𝑅𝑊𝑘𝑠𝑘 Step 4: Within bucket aggregation: The risk position for delta (respectively vega) bucket 𝑏 , 𝐾𝑏 , should be determined by aggregating the weighted sensitivities to 21 In general, sensitivities must be calculated for each instrument. However, it is acceptable to consider a pair of back-to-back transactions as one instrument given that the net sensitivity of such a pair of back￾to-back transactions is always zero from the market risk perspective. To adopt this approach, an AI should monitor and ensure the market risk of the back-to-back transactions can be exactly offset at any time. Also, in case a broken hedge is resulted for whatever reason, the AI must be ready to calculate the respective sensitivities for its market risk capital charge.

29 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 risk factors within the same bucket using the corresponding prescribed correlation 𝜌𝑘𝑙 set out in the following formula: 𝐾𝑏 = √𝑚𝑎𝑥 (∑𝑊𝑆𝑘 2 𝑘 +∑∑𝜌𝑘𝑙𝑊𝑆𝑘 𝑙≠𝑘 𝑊𝑆𝑙 𝑘 , 0) Step 5: Across bucket aggregation: The delta (respectively vega) risk charge is determined from risk positions aggregated between the delta (respectively vega) buckets within each risk class, using the corresponding prescribed correlations 𝛾𝑏𝑐 as set out in the following formula: Delta (respectively vega) = √∑𝐾𝑏 2 + 𝑏 ∑∑𝛾𝑏𝑐 𝑐≠𝑏 𝑆𝑏𝑆𝑐 𝑏 where Sb= ∑k WSk for all risk factors in bucket b and Sc= ∑k WSk in bucket c. If these values for Sb and Sc produce a negative number for the overall sum of ∑ 𝐾𝑏 2 𝑏 + ∑𝑏 ∑𝑐≠𝑏 𝛾𝑏𝑐 𝑆𝑏𝑆𝑐 , an AI should calculate the delta (respectively vega) risk capital charge using an alternative specification whereby Sb = max [min (∑k WSk ,Kb ), − Kb ] for all risk factors in bucket b and Sc = max [min (∑kWSk ,Kc ), − Kc ] for all risk factors in bucket c. Curvature risk 3.2.13 An AI should apply two stress scenarios on given risk factors which are defined in subsection 3.3 to calculate the risk charge for curvature risk. The two stress scenarios are to be computed per risk factor (an upward and a downward shock) with the delta effect being removed. They are shocked by risk weights and the worst loss is aggregated by correlations provided in subsection 3.6. 3.2.14 An AI should apply the following step-by-step approach to each risk class separately to capture curvature risk:

30 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Step 1: For each instrument sensitive to curvature risk factor k, an upward shock and a downward shock should be applied to k. For example, for GIRR all tenors of all the curves within a given currency (e.g. HKD 1- month swap curve, HKD 3-month swap curve) should be shifted upward. The potential loss, after deduction of the delta risk positions, is the outcome of the upward scenario ( 𝐶𝑉𝑅𝑘 + ). The same approach should be followed on a downward scenario (𝐶𝑉𝑅𝑘 − ). If the price of an option depends on several risk factors, the curvature risk is determined separately for each risk factor. Step 2: The net curvature risk capital charge, determined by the values of 𝐶𝑉𝑅𝑘

• and 𝐶𝑉𝑅𝑘 − for risk factor k is calculated as follows. 𝐶𝑉𝑅𝑘
• = −∑{𝑉𝑖 (𝑥𝑘 𝑅𝑊(𝐶𝑢𝑟𝑣𝑎𝑡𝑢𝑟𝑒)

) − 𝑉𝑖 (𝑥𝑘 ) − 𝑅𝑊𝑘 𝐶𝑢𝑟𝑣𝑎𝑡𝑢𝑟𝑒 ∙ 𝑠𝑖𝑘} 𝑖 𝐶𝑉𝑅𝑘 − = −∑{𝑉𝑖(𝑥𝑘 𝑅𝑊(𝐶𝑢𝑟𝑣𝑎𝑡𝑢𝑟𝑒) − ) − 𝑉𝑖 (𝑥𝑘 ) + 𝑅𝑊𝑘 𝐶𝑢𝑟𝑣𝑎𝑡𝑢𝑟𝑒 ∙ 𝑠𝑖𝑘} 𝑖 This calculates the aggregate incremental loss beyond the delta capital charge for the prescribed shocks, where:  i is an instrument subject to curvature risks associated with risk factor k;  𝑥𝑘 is the current level of risk factor k;  𝑉𝑖 (𝑥𝑘 ) is the price of instrument i depending on the current level of risk factor k;  𝑉𝑖 (𝑥𝑘 (𝑅𝑊(𝑐𝑢𝑟𝑣𝑎𝑡𝑢𝑟𝑒)+) ) and 𝑉𝑖 (𝑥𝑘 (𝑅𝑊(𝑐𝑢𝑟𝑣𝑎𝑡𝑢𝑟𝑒)−) ) both denote the price of instrument i after 𝑥𝑘 is shifted (i.e. “shocked”) upward and downward;  under the FX and equity risk classes: – 𝑅𝑊𝑘 (𝑐𝑢𝑟𝑣𝑎𝑡𝑢𝑟𝑒) is the risk weight for curvature risk factor k for instrument i determined in accordance with paragraph 3.6.2; and

31 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 – 𝑠𝑖𝑘 is the delta sensitivity of instrument i with respect to the delta risk factor that corresponds to curvature risk factor k. The delta sensitivity used for calculating the curvature risk capital charge should be the same as that used for calculating the delta risk capital charge.  under the GIRR, credit spread risk (“CSR”) and commodity risk classes: – 𝑅𝑊𝑘 (𝑐𝑢𝑟𝑣𝑎𝑡𝑢𝑟𝑒) is the risk weight for curvature risk factor k for instrument i determined in accordance with paragraph 3.6.4; and – 𝑠𝑖𝑘 is the sum of delta risk sensitivities to all tenors of the relevant curve(s) of instrument i with respect to curvature risk factor k. The delta sensitivity (before summation) used for calculating the curvature risk capital charge should be the same as that used for calculating the delta risk capital charge. Step 3: Within bucket aggregation: The curvature risk exposure should be aggregated within each bucket using the corresponding prescribed correlation 𝜌𝑘𝑙 as set out in the following formula: 𝐾𝑏 = max(𝐾𝑏 + ,𝐾𝑏 −) 𝑤ℎ𝑒𝑟𝑒 {

𝐾𝑏

• = √max (0,∑𝑚𝑎𝑥(𝐶𝑉𝑅𝑘 +, 0) 2 + ∑∑𝜌𝑘𝑙𝐶𝑉𝑅𝑘 +𝐶𝑉𝑅𝑙 +𝜓(𝐶𝑉𝑅𝑘 +, 𝐶𝑉𝑅𝑙 +) 𝑘 𝑘 𝑙≠𝑘 ) 𝐾𝑏 − = √max (0,∑𝑚𝑎𝑥(𝐶𝑉𝑅𝑘 −, 0) 2 + ∑∑𝜌𝑘𝑙𝐶𝑉𝑅𝑘 −𝐶𝑉𝑅𝑙 −𝜓(𝐶𝑉𝑅𝑘 −, 𝐶𝑉𝑅𝑙 −) 𝑘 𝑘 𝑙≠𝑘 ) where:  the bucket level capital charge (𝐾𝑏) is determined as the greater of the capital charge under the upward scenario (𝐾𝑏

) and the capital charge under the downward scenario (𝐾𝑏 − ). Notably, the selection of upward and downward scenarios is not necessarily the same across the high, medium and low correlations scenarios specified

32 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 in paragraph 3.2.15. – Where 𝐾𝑏=𝐾𝑏 + , this shall be termed “selecting the upward scenario”. – Where 𝐾𝑏=𝐾𝑏 − , this shall be termed “selecting the downward scenario”. – In the specific case where 𝐾𝑏

• = 𝐾𝑏 − , if ∑ 𝐶𝑉𝑅𝑘

𝑘 > ∑ 𝐶𝑉𝑅𝑘 − 𝑘 , it is deemed that the upward scenario is selected; otherwise the downward scenario is selected.   (𝐶𝑉𝑅𝑘 + ,𝐶𝑉𝑅𝑙 + ) takes the value 0 if 𝐶𝑉𝑅𝑘

• and 𝐶𝑉𝑅𝑙
• both have negative signs. In all other cases,  (𝐶𝑉𝑅𝑘

,𝐶𝑉𝑅𝑙 + ) takes the value of 1; and   (𝐶𝑉𝑅𝑘 − ,𝐶𝑉𝑅𝑙 − ) takes the value 0 if 𝐶𝑉𝑅𝑘 − and 𝐶𝑉𝑅𝑙 − both have negative signs. In all other cases,  (𝐶𝑉𝑅𝑘 − ,𝐶𝑉𝑅𝑙 − ) takes the value of 1. Step 4: Across bucket aggregation: Curvature risk positions should then be aggregated across buckets within each risk class, using the corresponding prescribed correlation 𝛾𝑏𝑐. 𝐶𝑢𝑟𝑣𝑎𝑡𝑢𝑟𝑒 𝑟𝑖𝑠𝑘 = √𝑚𝑎𝑥(0,∑𝐾𝑏 2 + 𝑏 ∑∑𝛾𝑏𝑐 𝑐≠𝑏 𝑆𝑏𝑆𝑐 𝑏 𝜓(𝑆𝑏, 𝑆𝑐 ) ) where:  𝑆𝑏 = ∑ 𝐶𝑉𝑅𝑘 + 𝑘 for all risk factors in bucket b, when the upward scenario has been selected for bucket b above. 𝑆𝑏 = ∑ 𝐶𝑉𝑅𝑘 − 𝑘 otherwise; and  𝜓(𝑆𝑏, 𝑆𝑐 ) takes the value 0 if 𝑆𝑏 and 𝑆𝑐 both have negative signs. In all other cases, 𝜓(𝑆𝑏, 𝑆𝑐 ) takes the value of 1. Correlation scenarios and aggregation of risk charges 3.2.15 In order to address the risk that correlations increase or decrease in periods of financial stress, an AI will be required to calculate three risk charge figures for each risk class, corresponding to three different scenarios on the specified values for the correlation parameters

33 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 𝜌𝑘𝑙 (correlation between risk factors within a bucket) and 𝛾𝑏𝑐 (correlation across buckets within a risk class):  the “high correlations” scenario, whereby the correlation parameters 𝜌𝑘𝑙 and 𝛾𝑏𝑐 that are specified in subsections 3.4, 3.5 and 3.6 are uniformly multiplied by 1.25, with 𝜌𝑘𝑙 and 𝛾𝑏𝑐 subject to a cap at 100%;  the “medium correlations” scenario, whereby the correlation parameters 𝜌𝑘𝑙 and 𝛾𝑏𝑐 remain unchanged from those specified in subsections 3.4, 3.5 and 3.6; and  the “low correlations” scenario whereby the corresponding prescribed correlations are the correlations given in subsections 3.4, 3.5 and 3.6 are replaced by: – 𝜌𝑘𝑙 𝑙𝑜𝑤 = max(2 ∙ 𝜌𝑘𝑙 ‒ 100%, 75% ∙ 𝜌𝑘𝑙); and – 𝛾𝑏𝑐 𝑙𝑜𝑤 = max(2 ∙ 𝛾𝑏𝑐 ‒ 100%, 75% ∙ 𝛾𝑏𝑐). 3.2.16 The total capital charge under the sensitivities-based method is aggregated as follows:  For each scenario, an AI should add up the delta, vega and curvature risk charges for all risk classes to determine the overall risk charge for that scenario.  The ultimate risk capital charge is the largest capital charge from the three scenarios. – For the calculation of capital charge for all instruments in all trading desks using the STM approach as set out in paragraph 1.4.2, the capital charge is calculated for all instruments in all trading desks. – For the calculation of capital charge for each trading desk using the STM approach as if that desk were a standalone regulatory portfolio as set out in paragraph 1.4.2, the capital charges under each correlation scenario are calculated and compared at each trading desk level, and the maximum for each trading desk is taken as

34 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 the capital charge. 3.3 SBM: risk factor and sensitivity definitions Risk factor definitions: GIRR 3.3.1 The GIRR delta risk factors are defined along two dimensions: (i) a risk-free yield curve for each currency in which interest rate-sensitive instruments are denominated and (ii) the following tenors: 0.25 years, 0.5 years, 1 year, 2 years, 3 years, 5 years, 10 years, 15 years, 20 years and 30 years.22 3.3.2 An AI should construct the risk-free yield curve per currency by using money market instruments held in the trading book that have the lowest credit risk, such as overnight index swaps (OIS). Alternatively, the AI can construct the risk-free yield curve based on one or more market-implied swap curves used by the AI to mark positions to market, such as interbank offered rate swap curves. 3.3.3 When data on market-implied swap curves described in paragraph 3.3.2 is insufficient, an AI should derive the risk-free yield curve from the most appropriate sovereign bond curve for a given currency, e.g. Exchange Fund Bills and Notes issued by the HKMA for HKD. In such cases the sensitivities related to sovereign bonds are not exempt from the credit spread risk charge. In case if the AI cannot separate the yield into risk-free rate and credit spread, i.e. 𝑦 = 𝑟 + 𝑐𝑠, any sensitivity to 𝑦 is allocated to the GIRR and to CSR risk classes as appropriate with the risk factor and sensitivity definitions in the STM approach. Applying swap curves to bond-derived sensitivities for GIRR will not change the requirement for basis risk to be captured between bond and credit default swap (“CDS”) curves in the CSR risk class. 22 Assignment of risk factors to the specified tenors should be performed by linear interpolation or a method that is agreed to be most consistent with the pricing functions used by the independent risk control function of an AI to report market risks or profits and losses to senior management.

35 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.3.4 For the purpose of constructing the risk-free yield curve per currency, an OIS curve and an interbank offered rate swap curve should be considered two different curves. Two interbank offered rate swap curves (e.g. HKD 1-month swap curve and HKD 3-month swap curve) should be considered two different curves. An onshore and an offshore currency curve (e.g. CNY and CNH) should be considered two different curves. However, they belong to the same currency bucket. 3.3.5 An AI should use its risk-free yield curve per currency on a consistent basis over time. 3.3.6 The GIRR delta risk factors should also include a flat curve of market-implied inflation rates for each currency with term structure not recognised as a risk factor.  The sensitivity to the inflation rate from the exposure to implied coupons in an inflation instrument gives rise to a specific capital charge. All inflation risks for a currency should be aggregated to one number via simple sum.  This risk factor is only relevant for an instrument when a cash flow is functionally dependent on a measure of inflation (e.g. the notional amount or an interest payment depending on a consumer price index). GIRR risk factors other than for inflation risk will apply to such an instrument notwithstanding.  Inflation rate risk is considered in addition to the sensitivity to interest rates from the same instrument, which should be allocated, according to the GIRR framework, in the term structure of the relevant risk-free yield curve in the same currency.

36 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.3.7 The GIRR delta risk factors should also include one of two possible cross-currency basis risk factors 23 for each currency (i.e. each GIRR bucket) with term structure not recognised as a risk factor (i.e. both cross-currency basis curves are flat).  The two cross-currency basis risk factors are basis of each currency over USD or basis of each currency over EUR. For instance, an AI trading a JPY/USD cross-currency basis swap would have a sensitivity to the JPY/USD basis but not to the JPY/EUR basis.  Cross-currency bases that do not relate to either basis over USD or basis over EUR should be computed either on “basis over USD” or “basis over EUR” but not both. GIRR risk factors other than for cross-currency basis risk will apply to such an instrument notwithstanding.  Cross-currency basis risk is considered in addition to the sensitivity to interest rates from the same instrument, which should be allocated, according to the GIRR framework, in the term structure of the relevant risk-free yield curve in the same currency.  A term structure based cross currency basis spread curve may be used. In doing so, sensitivities to individual tenors are aggregated by a simple sum.  Cross-currency basis risk for a currency for both onshore and offshore curves may be aggregated via a simple sum of weighted sensitivities. 3.3.8 The GIRR vega risk factors for each currency should be defined as the implied volatilities of options that 23 Cross-currency basis refers to basis added to a yield curve in order to evaluate a swap for which the two legs are paid in two different currencies. They are in particular used by market participants to price cross-currency interest rate swaps paying a fixed or a floating leg in one currency, receiving a fixed or a floating leg in a second currency, and including an exchange of the notional in the two currencies at the start date and at the end date of the swap.

37 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 reference GIRR-sensitive underlyings; further defined along two dimensions:24  maturity of the option: The implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years; and  residual maturity of the underlying of the option at the expiry date of the option: The implied volatility of the option as mapped to one (or two) of the following residual maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years.25 3.3.9 The GIRR curvature risk factors should be defined along one dimension: the constructed risk-free yield curve without term structure decomposition per currency. For example, the HKD 1-month and HKD 3- month swap curves should be shifted at the same time in order to compute the relevant HKD risk-free yield curve curvature risk charge. For the calculation of sensitivities, all tenors (as defined for delta GIRR) are to be shifted in parallel. There is no curvature risk charge for inflation and cross-currency basis risks. 3.3.10 The treatment described in paragraph 3.3.3 for GIRR delta also applies to GIRR vega and GIRR curvature risk factors. Risk factor definitions: CSR non-SEC 3.3.11 The CSR non-SEC delta risk factors are defined along two dimensions: (i) the relevant issuer credit spread curves (bond and CDS) and (ii) the following tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years to which delta risk factors are assigned. 3.3.12 The CSR non-SEC vega risk factors are the implied volatilities of options that reference the relevant credit issuer names as underlyings (bond and CDS); further 24 For example, an option with a forward-starting 12-month cap on 3-month HIBOR starting in one year will have four caplets with periods of 3 months each. The option maturities for each caplet are 12, 15, 18 and 21 months while the underlying maturity for all the caplets is always 3 months. 25 GIRR vega risk factors in relation to inflation and cross-currency bases should be considered only along the single dimension of the maturity of the option.

38 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 defined along the maturity of the option: the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. 3.3.13 The CSR non-SEC curvature risk factors are defined along one dimension: the relevant issuer credit spread curves (bond and CDS) without term structure decomposition. For instance, the bond-inferred spread curve of company A and the CDS-inferred spread curve of company A should be considered a single spread curve. For the calculation of sensitivities, all tenors (as defined for CSR) are to be shifted in parallel. Risk factor definitions: CSR SEC (non-CTP) 3.3.14 For securitisation instruments that do not meet the definition of correlation trading portfolio as defined in section 281 of the Rules (i.e. non-CTP), the sensitivities of delta risk factors should be calculated with respect to the spread of the tranche rather than the spread of the underlying of the instruments. 3.3.15 The CSR SEC (non-CTP) delta risk factors are defined along two dimensions: (i) the relevant tranche credit spread curves and (ii) the following tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years to which delta risk factors are assigned. 3.3.16 The CSR SEC (non-CTP) vega risk factors are the implied volatilities of the relevant options that reference non-CTP credit spreads as underlyings (bond and CDS), further defined along the maturity of the option. This is defined as the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. 3.3.17 The CSR SEC (non-CTP) curvature risk factors are defined along one dimension: the relevant tranche credit spread curves (bond and CDS) without term structure decomposition. For instance, the bond￾inferred spread curve of a given residential mortgage￾backed security (RMBS) tranche and the CDS-inferred spread curve of that given RMBS tranche would be

39 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 considered a single spread curve. For the calculation of sensitivities, all the tenors are to be shifted in parallel. Risk factor definitions: CSR SEC (CTP) 3.3.18 For securitisation instruments that meet the definition of a CTP as defined in section 281 of the Rules, the sensitivities of delta risk factors should be computed with respect to the names underlying the securitisation or nth -to-default instrument. 3.3.19 The CSR SEC (CTP) delta risk factors are defined along two dimensions: (i) the relevant underlying credit spread curves (bond and CDS) and (ii) the following tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years to which delta risk factors are assigned. 3.3.20 The CSR SEC (CTP) vega risk factors are the implied volatilities of options that reference CTP credit spreads as underlyings (bond and CDS), further defined along the maturity of the option. This is defined as the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. 3.3.21 The CSR SEC (CTP) curvature risk factors are defined along one dimension: the relevant underlying credit spread curves (bond and CDS) without term structure decomposition. For instance, the bond-inferred spread curve of a given name within an iTraxx series and the CDS-inferred spread curve of that given underlying would be considered a single spread curve. For the calculation of sensitivities, all the tenors are to be shifted in parallel. Risk factor definitions: equity risk 3.3.22 The equity delta risk factors are all the equity spot prices and all the equity repurchase agreement rates (equity repo rates). 3.3.23 The equity vega risk factors are the implied volatilities of options that reference the equity spot prices as underlyings as defined along the maturity of the option.

40 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 This is defined as the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. There is no vega risk capital charge for equity repo rates. 3.3.24 The equity curvature risk factors are all the equity spot prices. There is no curvature risk charge for equity repo rates. Risk factor definitions: commodity risk 3.3.25 The commodity delta risk factors are all the commodity spot prices. However for some commodities such as electricity (which is defined to fall within bucket 3 (energy – electricity and carbon trading) in paragraph 3.4.35) the relevant risk factor can either be the spot or the forward price. Commodity delta risk factors are defined along two dimensions: (i) legal terms with respect to the delivery location26 of the commodity and (ii) time to maturity of the traded instrument at the following tenors: 0 years, 0.25 years, 0.5 years, 1 year, 2 years, 3 years, 5 years, 10 years, 15 years, 20 years and 30 years.27 3.3.26 The commodity vega risk factors are the implied volatilities of options that reference commodity spot prices as underlyings. No differentiation between commodity spot prices by the maturity of the underlying or delivery location is required. The commodity vega risk factors are further defined along the maturity of the option. The implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. 26 For example, a contract that can be delivered in five ports can be considered having the same delivery location as another contract if and only if it can be delivered in the same five ports. However, it cannot be considered having the same delivery location as another contract that can be delivered in only four (or less) of those five ports. 27 Commodity delta risk factors should be allocated to the relevant tenor based on the tenor of the futures and forward contract and given that spot commodity price positions should be slotted into the first tenor (0 years). The current prices for futures and forward contracts should be used to compute the commodity delta risk sensitivities.

41 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.3.27 The commodity curvature risk factors are defined along only one dimension: the constructed curve without term structure decomposition per commodity spot prices. For the calculation of sensitivities, all tenors (as defined for delta commodity) are to be shifted in parallel. Risk factor definitions: foreign exchange risk 3.3.28 The foreign exchange delta risk factors are all the exchange rates between the currency in which an instrument is denominated and the reporting currency (i.e. HKD). For transactions that reference an exchange rate between a pair of non-reporting currencies, the foreign exchange delta risk factors are all the exchange rates between (i) HKD and (ii) both the currency in which an instrument is denominated and any other currencies referenced by the instrument. 28 3.3.29 Subject to supervisory approval, AIs may choose to use the FX base currency approach. In this case, FX risk may alternatively be calculated relative to a selected base currency instead of HKD. In such case the AI should account for (i) the FX risk against the base currency; and (ii) the FX risk between HKD and the base currency (i.e. translation risk). The resulting FX risk calculated relative to the base currency is converted to the capital charge in HKD using the spot HKD / base currency exchange rate reflecting the FX risk between the base currency and HKD.29 3.3.30 The FX base currency approach can be allowed under the following conditions: (i) an AI can only consider a single currency as its base currency; and (ii) the AI should demonstrate to the HKMA that calculating FX risk relative to its proposed base currency provides an appropriate risk representation for their portfolio (for example, by demonstrating that it does not 28 For example, for an FX forward referencing EUR/JPY, the relevant risk factors for a HKD-reporting AI to consider are the exchange rates EUR/HKD and JPY/HKD. 29 Following the example in footnote 28, if the AI calculates FX risk relative to USD as a base currency, it would consider separate deltas for JPY/USD, EUR/USD and HKD/USD and then translate the resulting capital charge to HKD at the USD/HKD spot exchange rate.

42 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 inappropriately reduce capital charges relative to those that would be calculated without the base currency approach) and that the translation risk between the base currency and HKD is taken into account. 3.3.31 The foreign exchange vega risk factors are the implied volatilities of options that reference exchange rates between currency pairs; further defined along the maturity of the option. The implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. 3.3.32 The foreign exchange curvature risk factors are all the exchange rates between the currency in which an instrument is denominated and the reporting currency (i.e. HKD). For transactions that reference an exchange rate between a pair of non-reporting currencies, the FX risk factors are all the exchange rates between (i) HKD and (ii) both the currency in which an instrument is denominated and any other currencies referenced by the instrument. 3.3.33 Where supervisory approval for the base currency approach has been granted for delta risks, foreign exchange curvature risks shall also be calculated relative to a base currency instead of HKD, and then converted to the capital charge in HKD using the spot HKD / base currency exchange rate. 3.3.34 An AI using the FX base currency approach should also be able to calculate its regulatory capital charge for FX risk relative to HKD at the demand of the HKMA. 3.3.35 No distinction is required between onshore and offshore variants of a currency for all foreign exchange delta, vega and curvature risk factors. Similarly, no distinction is required between deliverable and non￾deliverable variants of a currency. Sensitivity definitions 3.3.36 An AI should use the prescribed formulations as set in paragraphs 3.3.40 to 3.3.42 to calculate the sensitivities for each risk class respectively. The AI

43 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 may make use of alternative formulations of sensitivities based on pricing models that the AI’s independent risk control unit uses to report market risk exposure or actual profits and losses to senior management. 3.3.37 Regardless of whether the prescribed or alternative formulations are used, the pricing models that are used for deriving the sensitivities should be validated by an appropriately qualified and experienced external or internal party to ensure the accuracy of the sensitivities for the calculation of the market risk capital charge. The party responsible for validation should be independent of the risk-taking functions and the party who develops or implements the relevant pricing models. If an AI makes use of alternative formulations of sensitivities, it should also demonstrate to the satisfaction of the HKMA that the alternative formulations of sensitivities adopted are conceptually sound and yield results very close to the prescribed formulations. 3.3.38 An AI should calculate sensitivities for each risk class in terms of HKD. 3.3.39 For each risk factor defined in paragraphs 3.3.1 to 3.3.35, sensitivities are calculated as the change in the market value of the instrument as a result of applying a specified shift to each risk factor, assuming all the other relevant risk factors are held at the current level. Delta risk sensitivities 3.3.40 An AI should calculate the delta risk sensitivities of (i) GIRR, (ii) CSR non-SEC, (iii) CSR SEC (non-CTP), (iv) CSR SEC (CTP) and (v) equity (repo rate) risk factors in accordance with the following formula: 𝑠𝑘 = 𝑉𝑖 (𝑅𝐹𝑘 + 0.0001) − 𝑉𝑖 (𝑅𝐹𝑘 ) 0.0001 where:  𝑠𝑘 is the delta sensitivity of risk factor k;  𝑅𝐹𝑘 is the risk factor k; and

44 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  Vi(.) is the market value of the instrument i as a function of the risk factor k. 3.3.41 An AI should calculate the delta risk sensitivities of (i) equity (spot rate), (ii) commodity and (iii) foreign exchange risk factors in accordance with the following formula: 𝑠𝑘 = 𝑉𝑖 (1.01𝑅𝐹𝑘 ) − 𝑉𝑖 (𝑅𝐹𝑘 ) 0.01 Vega risk sensitivities 3.3.42 The option-level vega risk sensitivity to a given risk factor30 is the mathematical product of the vega and the implied volatility of the option in accordance with the following formula: 𝑠𝑘 = 𝑣𝑒𝑔𝑎 × 𝑖𝑚𝑝𝑙𝑖𝑒𝑑 𝑣𝑜𝑙𝑎𝑡𝑖𝑙𝑖𝑡𝑦 where:  vega, 𝜕𝑉𝑖 𝜕𝜎𝑖 , is defined as the change in the market value of the option 𝑉𝑖 as a result of a small amount of change to the implied volatility 𝜎𝑖 ; and  the instrument’s vega and implied volatility should be sourced from pricing models used by the independent risk control function of the AI. 3.3.43 The following sets out how vega risk sensitivities are to be derived in specific cases:  options that do not have a maturity are assigned to the longest prescribed maturity tenor, and these options are also assigned to the residual risks add-on;  options that do not have a strike or barrier and options that have multiple strikes or barriers, are mapped to strikes and maturity used internally to price the option, and these options are assigned to the residual risks add-on; and 30 The implied volatility of the option must be mapped to one or more maturity tenors.

45 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  CTP securitisation tranches which do not have an implied volatility, are not subject to vega risk capital charge. Such instruments may not, however, be exempt from delta and curvature risk capital charges. Other requirements on sensitivity computations 3.3.44 When computing the first-order sensitivity for instruments with vega risk, an AI should assume that the implied volatility either remains constant, consistent with the sticky strike approach, or follows a sticky delta approach such that implied volatility does not vary with respect to a given level of delta. 3.3.45 When computing a vega GIRR or CSR sensitivity, an AI may assume that the underlying follows either a lognormal or normal distribution in the pricing models from which sensitivities are derived. An AI may choose a mix of lognormal and normal distribution assumption for different currencies. When computing a vega equity, commodity or foreign exchange sensitivity, an AI should assume that the underlying follows a lognormal distribution in the pricing models from which sensitivities are derived.31 3.3.46 If, for internal risk management, an AI computes vega sensitivities using definitions different from those proposed in this paper, the AI may transform the sensitivities computed for internal risk management to deduce the sensitivities to be used for the calculation of the vega risk measure, subject to the process mentioned in paragraph 3.3.37. 3.3.47 All sensitivities should be computed ignoring CVA impacts. 31 Since the vega (𝜕𝑉 𝜕𝜎𝑖 ) on an instrument is multiplied by its implied volatility (𝜎𝑖 ), the vega risk sensitivity for that instrument will be the same under the lognormal distribution assumption and the normal distribution assumption. As a consequence, an AI may use a lognormal or normal distribution assumption for GIRR and CSR (in recognition of the trade-offs between constrained specification and computational burden for the STM approach). For the other risk classes, an AI should only use a lognormal distribution assumption.

46 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Instruments with multiple constituents 3.3.48 In the delta and curvature risk context: for index instruments and multi-underlying options, a look￾through approach should be used. However, an AI may opt not to apply the look-through approach for instruments referencing any listed and widely recognised and accepted equity or credit index, where: (i) it is possible to look-through the index (i.e. the constituents and their respective weightings are known); (ii) the index contains at least 20 constituents; (iii) no single constituent contained within the index represents more than 25% of the total index; (iv) the largest 10% of constituents represents less than 60% of the total index; and (v) the total market capitalisation of all the constituents of the index is no less than HKD 312 billion. 3.3.49 For a given instrument, irrespective of whether a look￾through approach is adopted or not, the sensitivity inputs used for the delta and curvature risk calculation should be consistent. 3.3.50 Where an AI opts not to apply the look-through approach in accordance to paragraph 3.3.48, a single sensitivity shall be calculated with respect to each widely recognised and accepted index that an instrument references. The sensitivity to the index should be assigned to the relevant delta risk bucket defined in paragraphs 3.4.9 and 3.4.24 as follows.  Where more than 75% of constituents in that index (taking into account the weightings of that index) would be mapped to a specific sector bucket (i.e. bucket 1 to bucket 11 for equity risk, or bucket 1 to bucket 16 for CSR), the sensitivity to the index shall be mapped to that single specific sector bucket and treated like any other single-name sensitivity in that bucket.

47 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  In all other cases, the sensitivity may be mapped to an “index” bucket (i.e. bucket 12 or bucket 13 for equity risk; or bucket 17 or bucket 18 for CSR). The same principle as above applies when allocating sensitivities to specific index buckets. – For equity risk, an equity index should be mapped to the large market capitalisation and advanced economy indices bucket (i.e. bucket 12) if at least 75% of the constituents in that index (taking into account the weightings of that index) are both large market capitalisation and advanced economy equities. Otherwise, it should be mapped to the other equity indices bucket (i.e. bucket 13). – For CSR, a credit index should be mapped to the investment grade indices bucket (i.e. bucket 17) if at least 75% of the constituents in that index (taking into account the weightings of that index) are investment grade. Otherwise, it should be mapped to the non-investment grade indices bucket (i.e. bucket 18). 3.3.51 An AI should always use the look-through approach for indices that do not meet the criteria set out in paragraph 3.3.48(ii) to (v), and for any multi-underlying instruments that reference a bespoke set of equities or credit positions.  Where a look-through approach is adopted, for index instruments and multi-underlying options other than the CTP, the sensitivities to constituent risk factors from those instruments or options are allowed to net with sensitivities to single-name instruments without restriction.  Index CTP instruments cannot be broken down into its constituents (i.e. the index CTP should be considered a risk factor as a whole) and the above-mentioned netting at the issuer level does not apply either.  Where a look-through approach is adopted, it

48 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 shall be applied consistently through time32, and shall be used for all identical instruments that reference the same index. 3.3.52 For equity investments in funds that can be looked through as set out in paragraph 2.1.8, an AI should apply a look-through approach and treat the underlying positions of the fund as if the positions were held directly by the AI (taking into account the AI’s share of the equity of the fund, and any leverage in the fund structure), except for the funds that meet the following conditions:  For funds that hold an index instrument that meets the criteria set out under paragraph 3.3.48, an AI should still apply a look-through and treat the underlying positions of the fund as if the positions were held directly by the AI, but the AI may then choose to apply the “no look-through” approach for the index holdings of the fund as set out in paragraph 3.3.50.  For funds that track an index benchmark, an AI may opt not to apply the look-through approach and opt to measure the risk assuming the fund is a position in the tracked index only where: (i) the fund has an absolute value of a tracking difference (ignoring fees and commissions) of less than 1%; and (ii) the tracking difference is checked at least annually and is defined as the annualised return difference between the fund and its tracked benchmark over the last 12 months of available data (or a shorter period in the absence of a full 12 months of data). 3.3.53 For equity investments in funds that cannot be looked through, but that an AI has access to daily price quotes and knowledge of the mandate of the fund as set out in 32 In other words, an AI can initially not apply a look-through approach, and later decide to apply a look￾through approach. But once it applies a look-through approach (for a certain type of instrument referencing a particular index), the AI will require supervisory approval to revert to a “no look-through” approach.

49 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 paragraph 2.1.8, the AI may calculate capital charges for the fund in one of three ways:  If the fund tracks an index benchmark and meets the requirement set out in paragraph 3.3.52, the AI may assume that the fund is a position in the tracked index, and may assign the sensitivity to the fund to relevant sector specific buckets or index buckets as set out in paragraph 3.3.50.  Subject to supervisory approval, the AI may consider the fund as a hypothetical portfolio in which the fund invests to the maximum extent allowed under the fund’s mandate in those assets attracting the highest capital charge under the sensitivities-based method, and then progressively in those other assets implying lower capital charge. If more than one risk weight can be applied to a given exposure under the sensitivities-based method, the maximum risk weight applicable should be used. – This hypothetical portfolio should be subject to market risk capital charges on a standalone basis for all positions in that fund, separate from any other positions subject to market risk capital charges. – The counterparty credit and CVA risks of the derivatives of this hypothetical portfolio should be calculated in accordance with the corresponding treatment of equity investments in funds in the banking book.  An AI may treat their equity investment in the fund as an unrated equity exposure to be allocated to the “other sector” bucket (bucket 11). In applying this treatment, the AI should also consider whether, given the mandate of the fund, the default risk capital risk weight prescribed to the fund is sufficiently prudent (as set out in paragraph 3.8.9), and whether the residual risk add-on should apply (as set out in paragraph 3.7.8).

50 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.3.54 Net long equity investments in a given fund in which the AI cannot look through or does not meet the requirements of paragraph 2.1.8 should be assigned to the banking book. Net short positions in funds, where the AI cannot look through or does not meet the requirements of paragraph 2.1.8, should be excluded from any trading book capital charges under the market risk framework, with the net position instead subjected to a 100% capital charge. 3.3.55 In the vega risk context:  Multi-underlying options (including index options) are usually priced based on the implied volatility of the option, rather than the implied volatility of its underlying constituents and a look through approach may not need to be applied, regardless of the approach applied to the delta and curvature risk calculation as set out above.33  For indices, the vega risk with respect to the implied volatility of the multi-underlying options will be calculated using a sector-specific bucket or an index bucket defined in paragraphs 3.4.9 and 3.4.24 as follows: – Where more than 75% of constituents in that index (taking into account the weightings of that index) would be mapped to a single specific sector bucket (i.e. bucket 1 to bucket 11 for equity risk; or bucket 1 to bucket 16 for CSR), the sensitivity to the index shall be mapped to that single specific sector bucket and treated like any other single-name sensitivity in that bucket. – In all other cases, the sensitivity may be mapped to an “index” bucket (i.e. bucket 12 or bucket 13 for equity risk or bucket 17 or bucket 18 for CSR). 33 The implied volatility of an option must be mapped to one or more maturity tenors.

51 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.4 SBM: delta risk weights and correlations 3.4.1 An AI should calculate the risk-weighted sensitivity in accordance with the prescribed risk weights and correlations in this section which have been calibrated to the liquidity-adjusted time horizon related to each risk class. GIRR 3.4.2 Each bucket represents an individual currency exposure to GIRR, so all risk factors in risk-free yield curves for the same currency in which interest rate￾sensitive instruments are denominated are grouped into the same bucket. The risk weights are set as follows: Tenor 0.25 years 0.5 years 1 year 2 years 3 years Risk weight (percentage points) 1.7% 1.7% 1.6% 1.3% 1.2% Tenor 5 years 10 years 15 years 20 years 30 years Risk weight (percentage points) 1.1% 1.1% 1.1% 1.1% 1.1%  A risk weight of 1.6% is set for all the inflation risk factors and the cross-currency basis risk factors, respectively; and  For the currencies HKD, AUD, CAD, EUR, GBP, JPY, SEK and USD the above risk weights may, at the discretion of an AI, be divided by the square root of 2.34

3.4.3 For aggregating GIRR risk positions within a bucket, the correlation parameter 𝜌𝑘𝑙 is set at 99.9% between weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket (i.e. same currency), with the same assigned tenor but corresponding to different yield curves. In aggregating delta risk positions for cross-currency basis risk for onshore and offshore curves, which 34 This list of currencies could be subject to update. AIs should build their market risk capital calculation systems with sufficient flexibility to account for this potential periodic update.

52 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 should be considered two different curves as set out in paragraph 3.3.4, an AI may choose to aggregate all cross-currency basis risk for a currency XYZ (i.e. “XYZ/USD” or “XYZ/EUR”) for both onshore and offshore curves by a simple sum of weighted sensitivities. 3.4.4 The delta risk correlation 𝜌𝑘𝑙 between weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket (i.e. same currency), with different tenor and corresponding to the same yield curve is set in the following table.35 Delta GIRR correlations (kl) within the same bucket, with different tenor (in years) and same curve Tenor (in years) 0.25 0.5 1 2 3 5 10 15 20 30 0.25 100.0% 97.0% 91.4% 81.1% 71.9% 56.6% 40.0% 40.0% 40.0% 40.0% 0.5 97.0% 100.0% 97.0% 91.4% 86.1% 76.3% 56.6% 41.9% 40.0% 40.0% 1 91.4% 97.0% 100.0% 97.0% 94.2% 88.7% 76.3% 65.7% 56.6% 41.9% 2 81.1% 91.4% 97.0% 100.0% 98.5% 95.6% 88.7% 82.3% 76.3% 65.7% 3 71.9% 86.1% 94.2% 98.5% 100.0% 98.0% 93.2% 88.7% 84.4% 76.3% 5 56.6% 76.3% 88.7% 95.6% 98.0% 100.0% 97.0% 94.2% 91.4% 86.1% 10 40.0% 56.6% 76.3% 88.7% 93.2% 97.0% 100.0% 98.5% 97.0% 94.2% 15 40.0% 41.9% 65.7% 82.3% 88.7% 94.2% 98.5% 100.0% 99.0% 97.0% 20 40.0% 40.0% 56.6% 76.3% 84.4% 91.4% 97.0% 99.0% 100.0% 98.5% 30 40.0% 40.0% 41.9% 65.7% 76.3% 86.1% 94.2% 97.0% 98.5% 100.0% 3.4.5 The delta risk correlation 𝜌𝑘𝑙 between weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket (i.e. same currency), with different tenor and corresponding to different yield curves is set at the correlation 35 The delta GIRR correlation parameters (𝜌𝑘𝑙) are determined by 𝑚𝑎𝑥 [𝑒 (−𝜃∙ |𝑇𝑘−𝑇𝑙 | 𝑚𝑖𝑛{𝑇𝑘; 𝑇𝑙 } ) ; 40%], where 𝑇𝑘 (respectively 𝑇𝑙 ) is the tenor that relates to 𝑊𝑆𝑘 (respectively 𝑊𝑆𝑙 ); and 𝜃 set at 3%. For example, the correlation between a sensitivity to the 1-year tenor of the HKD 3-month swap curve and a sensitivity to the 5-year tenor of the HKD 3-month swap curve in the same currency is 𝑚𝑎𝑥 [𝑒 (−3% ∙ |1−5| 𝑚𝑖𝑛{1;5} ) ; 40%] = 88.69%.

53 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 parameter specified in paragraph 3.4.4 multiplied by 99.9%.36 3.4.6 The delta risk correlation 𝜌𝑘𝑙 between a weighted sensitivity 𝑊𝑆𝑘 to the inflation curve and a weighted sensitivity 𝑊𝑆𝑙 to a given tenor of the relevant yield curve is 40%. 3.4.7 The delta risk correlation 𝜌𝑘𝑙 between a weighted sensitivity 𝑊𝑆𝑘 to a cross-currency basis curve and a weighted sensitivity 𝑊𝑆𝑙 to either (i) a given tenor of the relevant yield curve, (ii) the inflation curve or (iii) another cross-currency basis curve (if relevant) is 0%. 3.4.8 The parameter γbc of 50% should be used for aggregating across different buckets (i.e. different currencies). CSR non-SEC 3.4.9 The risk weights for each of the buckets 1 to 18 are set out in the following table. Risk weights are the same for all tenors (i.e. 0.5 years, 1 year, 3 years, 5 years and 10 years) within each bucket. To assign a risk exposure to a credit quality based on the ECAI issuer ratings:  where there are two ECAI issuer ratings that map into different risk weights, the higher risk weight should be applied;  where there are three or more ECAI issuer ratings, the two ratings that correspond to the lowest risk weights should be referred to. If these give rise to the same risk weight, that risk weight should be applied. If different, the higher of the two risk weights should be applied; and  where there is no ECAI issuer rating, AIs that use the IRB approach to calculate their credit risk may, subject to an HKMA approval, map the internal rating to one of the ECAI issuer ratings in order to 36 For example, the correlation between a sensitivity to the 1-year tenor of the HKD 1-month swap curve and a sensitivity to the 5-year tenor of the HKD 3-month swap curve in the same currency is (88.69%) ⋅ (0.999) = 88.60%.

54 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 determine the risk weight. Otherwise, the risk weights for unrated counterparties should be applied. This principle applies throughout section 3.

55 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Bucket number Credit quality Sector Risk weight (%) 1 Investment grade37 Sovereigns including central banks, multilateral development banks 0.5% 2 Local government, government-backed non-financials, education, public administration 1.0% 3 Financials including government-backed financials 5.0% 4 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 3.0% 5 Consumer goods and services, transportation and storage, administrative and support service activities 3.0% 6 Technology and telecommunications 2.0% 7 Health care, utilities, professional and technical activities 1.5% 8 Qualifying covered bonds38 2.5%39 9 Non￾investment grade or unrated Sovereigns including central banks, multilateral development banks 2.0% 10 Local government, government-backed non-financials, education, public administration 4.0% 11 Financials including government-backed financials 12.0% 12 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 7.0% 13 Consumer goods and services, transportation and storage, administrative and support service activities 8.5% 14 Technology and telecommunications 5.5% 15 Health care, utilities, professional and technical activities 5.0% 16 Other sector40 12.0% 17 Investment grade indices 1.5% 18 Non-investment grade indices 5.0% 3.4.10 To assign a risk exposure to a sector, an AI should rely on a classification that is commonly used in the market for grouping issuers by industry sector. The AI should 37 Unless otherwise specified, “investment grade” has the same meaning as specified in section 281 of the Rules. 38 Unless otherwise specified, “qualifying covered bonds” has the same meaning as specified in section 281 of the Rules. 39 For qualifying covered bonds that are rated AA‒ or higher, the applicable risk weight may at the discretion of the AI be 1.5%. 40 Credit quality is not a differentiating consideration for this bucket.

56 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 assign each issuer to one and only one of the sector buckets in the table under paragraph 3.4.9. Risk positions from any issuer that an AI cannot assign to a sector in this fashion should be assigned to the other sector bucket (i.e. bucket 16). 3.4.11 For buckets 1 to 15, for aggregating delta CSR non￾securitisations risk positions within a bucket, the correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket is set as follows: 𝜌𝑘𝑙 = 𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) ⋅ 𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) ⋅ 𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) where:  𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) is equal to 1 if the two names of sensitivities k and l are identical, and 35% otherwise;  𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) is equal to 1 if the two tenors of the sensitivities k and l are identical, and 65% otherwise; and  𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) is equal to 1 if the two sensitivities are related to same curves, and 99.9% otherwise. For example, the correlation between a sensitivity to the 5-year Apple bond curve and a sensitivity to the 10- year Alphabet CDS curve would be 35% ⋅ 65% ⋅ 99.9% = 22.73%. 3.4.12 For buckets 17 and 18, for aggregating delta CSR non￾securitisations risk positions within a bucket, the correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket is set as follows: 𝜌𝑘𝑙 = 𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) ⋅ 𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) ⋅ 𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) where:  𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) is equal to 1 if the two names of sensitivities k and l are identical, and 80%

57 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 otherwise;  𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) is equal to 1 if the two tenors of the sensitivities k and l are identical, and to 65% otherwise; and  𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) is equal to 1 if the two sensitivities are related to same curves, and 99.9% otherwise. 3.4.13 The correlations mentioned above do not apply to the other sector bucket. The aggregation of delta and vega CSR non-securitisation risk positions within the other sector bucket would be equal to the simple sum of the absolute values of the net weighted sensitivities allocated to this bucket. For delta and vega: 𝐾𝑏(𝑜𝑡ℎ𝑒𝑟 𝑏𝑢𝑐𝑘𝑒𝑡) = ∑ |𝑊𝑆𝑘 | 𝑘 The aggregation of curvature CSR non-securitisation risk positions within the other sector bucket would be calculated by the formula below. For curvature: 𝐾𝑏(𝑜𝑡ℎ𝑒𝑟 𝑏𝑢𝑐𝑘𝑒𝑡) = max(∑ 𝑚𝑎𝑥(𝐶𝑉𝑅𝑘 +, 0) 𝑘 , ∑ 𝑚𝑎𝑥(𝐶𝑉𝑅𝑘 −, 0) 𝑘 ) 3.4.14 For aggregating delta CSR non-securitisation risk positions across buckets 1 to 18, the correlation parameter γbc is set as follows: 𝛾𝑏𝑐 = 𝛾𝑏𝑐 (𝑟𝑎𝑡𝑖𝑛𝑔) ⋅ 𝛾𝑏𝑐 (𝑠𝑒𝑐𝑡𝑜𝑟) where:  𝛾𝑏𝑐 (𝑟𝑎𝑡𝑖𝑛𝑔) is equal to 50% where the two buckets b and c are both in buckets 1 to 15 and have the different credit quality category (investment grade/non-investment grade or unrated), and 1 otherwise; and  𝛾𝑏𝑐 (𝑠𝑒𝑐𝑡𝑜𝑟) is equal to 1 if the two buckets belong to the same sector category, and to the following percentages otherwise:

58 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Bucket 1/9 2/10 3/11 4/12 5/13 6/14 7/15 8 16 17 18 1/9 75% 10% 20% 25% 20% 15% 10% 0% 45% 45% 2/10 5% 15% 20% 15% 10% 10% 0% 45% 45% 3/11 5% 15% 20% 5% 20% 0% 45% 45% 4/12 20% 25% 5% 5% 0% 45% 45% 5/13 25% 5% 15% 0% 45% 45% 6/14 5% 20% 0% 45% 45% 7/15 5% 0% 45% 45% 8 0% 45% 45% 16 0% 0% 17 75% 18 CSR SEC (CTP) 3.4.15 Sensitivities to CSR SEC (CTP) and its related hedges are treated as a separate risk class. This risk class applies the same bucket structure and correlation structure as those for the CSR non-SEC framework with an exception of index buckets (i.e. buckets 17 and 18). The risk weights and correlations of the delta CSR non-SEC are also modified to reflect longer liquidity horizons and larger basis risk. Risk weights are the same for all tenors (i.e. 0.5 years, 1 year, 3 years, 5 years and 10 years) within each bucket:

59 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Bucket number Credit quality Sector Risk weight (%) 1 Investment grade Sovereigns including central banks, multilateral development banks 4.0% 2 Local government, government-backed non-financials, education, public administration 4.0% 3 Financials including government-backed financials 8.0% 4 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 5.0% 5 Consumer goods and services, transportation and storage, administrative and support service activities 4.0% 6 Technology and telecommunications 3.0% 7 Health care, utilities, professional and technical activities 2.0% 8 Qualifying covered bonds 6.0% 9 Non￾investment grade or unrated Sovereigns including central banks, multilateral development banks 13.0% 10 Local government, government-backed non-financials, education, public administration 13.0% 11 Financials including government-backed financials 16.0% 12 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 10.0% 13 Consumer goods and services, transportation and storage, administrative and support service activities 12.0% 14 Technology and telecommunications 12.0% 15 Health care, utilities, professional and technical activities 12.0% 16 Other sector41 13.0% 3.4.16 For aggregating delta CSR securitisations (CTP) risk positions within a bucket, the delta risk correlation kl is derived the same way as in paragraph 3.4.11, except that 𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) is now equal to 1 if the two sensitivities are related to same curves, and 99% otherwise. 41 Credit quality is not a differentiating consideration for this bucket. The delta CSR securitisations (CTP) sensitivity of an index CTP instrument should be assigned to a single specific delta sector bucket (i.e. buckets 1 to 15) consistent with the characteristics of, at least, 75% of the index constituents (taking into account the weightings of that index). If this is not possible, then the index should be assigned to the “Other sector” bucket. The sensitivity to that index CTP instrument should be considered and treated like any other single-name sensitivity assigned to that same sector bucket.

60 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.4.17 For aggregating delta CSR securitisations (CTP) risk positions across buckets, the delta risk correlation γbc are derived the same way as in paragraph 3.4.14. CSR SEC (non-CTP) 3.4.18 The risk weights for each of the buckets 1 to 25 are set out in the following table.

61 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Bucket number Credit quality Sector Risk weight 1 Senior investment grade RMBS – Prime 0.9% 2 RMBS – Mid-prime 1.5% 3 RMBS – Sub-prime 2.0% 4 Commercial mortgage-backed securities (CMBS) 2.0% 5 Asset-backed securities (ABS) – Student loans 0.8% 6 ABS – Credit cards 1.2% 7 ABS – Auto 1.2% 8 CLO non-CTP 1.4% 9 Non-senior investment grade RMBS – Prime 1.125% 10 RMBS – Mid-prime 1.875% 11 RMBS – Sub-prime 2.5% 12 CMBS 2.5% 13 ABS – Student loans 1% 14 ABS – Credit cards 1.5% 15 ABS – Auto 1.5% 16 CLO non-CTP 1.75% 17 Non-investment grade or unrated RMBS – Prime 1.575% 18 RMBS – Mid-prime 2.625% 19 RMBS – Sub-prime 3.5% 20 CMBS 3.5% 21 ABS – Student loans 1.4% 22 ABS – Credit cards 2.1% 23 ABS – Auto 2.1% 24 CLO non-CTP 2.45% 25 Other sector42 3.5% 3.4.19 To assign a risk exposure to a sector, an AI should rely on a classification that is commonly used in the market for grouping tranches by type. The AI should assign each tranche to one of the sector buckets in the table in paragraph 3.4.18. Risk positions from any tranche that the AI cannot assign to a sector in this fashion 42 Credit quality is not a differentiating consideration for this bucket.

62 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 should be assigned to the other sector bucket (i.e. bucket 25). 3.4.20 For aggregating delta CSR securitisations (non-CTP) risk positions within a bucket, the correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket is set as follows: 𝜌𝑘𝑙 = 𝜌𝑘𝑙 (𝑡𝑟𝑎𝑛𝑐ℎ𝑒) ⋅ 𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) ⋅ 𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) where:  𝜌𝑘𝑙 (𝑡𝑟𝑎𝑛𝑐ℎ𝑒) is equal to 1 if the two names of sensitivities k and l are within the same bucket and related to the same securitisation tranche (more than 80% overlap in notional terms), and 40% otherwise;  𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) is equal to 1 if the two tenors of the sensitivities k and l are identical, and to 80% otherwise; and  𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) is equal to 1 if the two sensitivities are related to same curves, and 99.9% otherwise. 3.4.21 The correlations mentioned in paragraph 3.4.20 do not apply to the other sector bucket. The aggregation of delta and vega CSR securitisations (non-CTP) risk positions within the other sector bucket would be equal to the simple sum of the absolute values of the net weighted sensitivities allocated to this bucket. For delta and vega: 𝐾𝑏(𝑜𝑡ℎ𝑒𝑟 𝑏𝑢𝑐𝑘𝑒𝑡) = ∑ |𝑊𝑆𝑘 | 𝑘 The aggregation of curvature CSR securitisations (non-CTP) risk positions within the other sector bucket would be calculated by the formula below. For curvature: 𝐾𝑏(𝑜𝑡ℎ𝑒𝑟 𝑏𝑢𝑐𝑘𝑒𝑡) = max(∑ 𝑚𝑎𝑥(𝐶𝑉𝑅𝑘 +, 0) 𝑘 , ∑ 𝑚𝑎𝑥(𝐶𝑉𝑅𝑘 −, 0) 𝑘 ) 3.4.22 For aggregating delta CSR securitisations (non-CTP) risk positions across buckets 1 to 24, the correlation parameter γbc is set at 0%.

63 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.4.23 For aggregating delta CSR securitisations (non-CTP) risk positions between the other sector bucket (i.e. bucket 25) and buckets 1 to 24, (i) the aggregated delta CSR securitisations (non-CTP) risk positions across buckets 1 to 24 and (ii) the delta CSR securitisations (non-CTP) risk position of bucket 25 should be added up. Equity risk 3.4.24 The risk weights for the sensitivities to equity spot price and equity repo rate for buckets 1 to 13 are set out in the following table:

64 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Bucket number Market capitalisation Economy Sector Risk weight for equity spot price Risk weight for equity repo rate 1 Large Emerging market economy Consumer goods and services, transportation and storage, administrative and support service activities, healthcare, utilities 55% 0.55% 2 Telecommunications, industrials 60% 0.60% 3 Basic materials, energy, agriculture, manufacturing, mining and quarrying 45% 0.45% 4 Financials including government￾backed financials, real estate activities, technology 55% 0.55% 5 Advanced economy Consumer goods and services, transportation and storage, administrative and support service activities, healthcare, utilities 30% 0.30% 6 Telecommunications, industrials 35% 0.35% 7 Basic materials, energy, agriculture, manufacturing, mining and quarrying 40% 0.40% 8 Financials including government￾backed financials, real estate activities, technology 50% 0.50% 9 Small Emerging market economy All sectors described under bucket numbers 1, 2, 3 and 4 70% 0.70% 10 Advanced economy All sectors described under bucket numbers 5, 6, 7 and 8 50% 0.50% 11 Other sector43 70% 0.70% 12 Large market capitalisation, advanced economy equity indices (non-sector specific) 15% 0.15% 13 Other equity indices (non-sector specific) 25% 0.25% 3.4.25 Market capitalisation for the purpose of paragraphs 3.4.24 to 3.4.34 refers to the sum of the market capitalisations based on the market value of the total outstanding shares issued by the same legal entity across all stock markets globally. Under no 43 Market capitalisation or economy (i.e. advanced or emerging market) is not a differentiating consideration for this bucket.

65 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 circumstances should the sum of the market capitalisations of multiple related listed entities be used to determine whether a listed entity is “large market capitalisation” or “small market capitalisation”. 3.4.26 Large market capitalisation is defined as a market capitalisation equal to or greater than HKD 15.6bn and small market capitalisation is defined as a market capitalisation of less than HKD 15.6bn. The determination of market capitalisation should be updated in a regular interval, at least on a monthly basis, and at the end of every month. 3.4.27 The advanced economies are the euro area, the non￾euro area western European countries (Denmark, Norway, Sweden, Switzerland and the United Kingdom), Oceania (Australia and New Zealand), Canada, Japan, Mexico, Singapore, the United States and Hong Kong. 44 3.4.28 To assign a risk exposure to a sector, an AI should rely on a classification that is commonly used in the market for grouping issuers by industry sector. The AI should assign each issuer to one of the sector buckets in the table under paragraph 3.4.24 and it should assign all issuers from the same industry to the same sector. Risk positions from any issuer that the AI cannot assign to a sector in this fashion should be assigned to the other sector bucket (i.e. bucket 11). For multinational multi-sector equity issuers, the allocation to a particular bucket should be done according to the most material region and sector in which the issuer operates. 3.4.29 For aggregating delta equity risk positions within a bucket, the correlation parameter 𝜌𝑘𝑙 is set at 99.9% between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket where one is a sensitivity to an equity spot price and the other is a sensitivity to an equity repo rate, where both are related to the same equity issuer name. 44 This list of advanced economies could be subject to update. AIs should build their market risk capital calculation systems with sufficient flexibility to account for this potential periodic update.

66 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.4.30 Otherwise, the correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 to equity spot price within the same bucket is defined as:  15% between two sensitivities within the same bucket that fall under large market capitalisation, emerging market economy (bucket number 1, 2, 3 or 4);  25% between two sensitivities within the same bucket that fall under large market capitalisation, advanced economy (bucket number 5, 6, 7 or 8);  7.5% between two sensitivities within the same bucket that fall under small market capitalisation, emerging market economy (bucket number 9);  12.5% between two sensitivities within the same bucket that fall under small market capitalisation, advanced economy (bucket number 10); and  80% between two sensitivities within the same bucket that fall under either index bucket (bucket number 12 or 13). 3.4.31 The correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 to equity repo rate within the same bucket is also defined according to paragraph 3.4.30. 3.4.32 Between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket where one is a sensitivity to an equity spot price and the other a sensitivity to an equity repo rate and both sensitivities relate to a different equity issuer name, the correlation parameter 𝜌𝑘𝑙 is set at the correlations specified in paragraph 3.4.30 multiplied by 99.9%. 3.4.33 The correlations above do not apply to the other sector bucket (i.e. bucket 11). The capital charge for the delta and vega risk within the other sector bucket would be equal to the simple sum of the absolute values of the net weighted sensitivities allocated to this bucket. For delta and vega: 𝐾𝑏(𝑜𝑡ℎ𝑒𝑟 𝑏𝑢𝑐𝑘𝑒𝑡) = ∑ |𝑊𝑆𝑘 | 𝑘

67 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 The capital charge for the curvature risk within the other sector bucket would be calculated by the formula below. For curvature: 𝐾𝑏(𝑜𝑡ℎ𝑒𝑟 𝑏𝑢𝑐𝑘𝑒𝑡) = max(∑ 𝑚𝑎𝑥(𝐶𝑉𝑅𝑘 +, 0) 𝑘 , ∑ 𝑚𝑎𝑥(𝐶𝑉𝑅𝑘 −, 0) 𝑘 ) 3.4.34 For aggregating delta equity risk positions across buckets, the correlation parameter γbc is set at:  15% if bucket b and bucket c fall within bucket numbers 1 to 10;  0% if either bucket b or bucket c is bucket 11;  75% if bucket b and bucket c are bucket numbers 12 and 13 (i.e. one is bucket 12 and the other one is bucket 13); and  45% otherwise. Commodity risk 3.4.35 The risk weights depend on the eleven buckets, in which several commodities with common characteristics are grouped, are set out in the following table:

68 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Bucket Commodity bucket Examples of commodities allocated to each commodity bucket (non-exhaustive) Risk weight (percentage points) 1 Energy - Solid combustibles Coal, charcoal, wood pellets, uranium 30% 2 Energy - Liquid combustibles Light-sweet crude oil, heavy crude oil, WTI crude oil and Brent crude oil, etc. (i.e. various types of crude oil); Bioethanol, biodiesel, etc. (i.e. various biofuels); Propane, ethane, gasoline, methanol, butane, etc. (i.e. various petrochemicals); Jet fuel, kerosene, gasoil, fuel oil, naphtha, heating oil, diesel, etc. (i.e. various refined fuels) 35% 3 Energy - Electricity and carbon trading Spot electricity, day-ahead electricity, peak electricity and off-peak electricity (i.e. various electricity types); Certified emissions reductions, in-delivery month EU allowance, RGGI CO2 allowance, renewable energy certificates, etc. (i.e. various carbon emissions trading) 60% 4 Freight Capesize, panamex, handysize, supramax, etc. (i.e. various types of dry-bulk route); Suezmax, Aframax, very large crude carriers, etc. (i.e. various types of liquid-bulk/gas shipping route) 80% 5 Metals – non￾precious Aluminium, copper, lead, nickel, tin, zinc, etc. (various base metals); Steel billet, steel wire, steel coil, steel scrap, steel rebar, iron ore, tungsten, vanadium, titanium, tantalum, etc. (i.e. various steel raw materials); Cobalt, manganese, molybdenum, etc. (i.e. various minor metals) 40% 6 Gaseous combustibles Natural gas; liquefied natural gas 45% 7 Precious metals (including gold) Gold; silver; platinum; palladium 20% 8 Grains & oilseed Rice; corn; wheat; soybean seed; soybean oil; soybean meal; oats; palm oil; canola; barley; rapeseed seed; rapeseed oil; rapeseed meal; red bean; sorghum; coconut oil; olive oil; peanut oil; sunflower oil 35% 9 Livestock & dairy Live cattle; feeder cattle; hog; poultry; lamb; fish; shrimp; milk, whey, eggs, butter; cheese 25% 10 Softs and other agriculturals Cocoa; Arabica coffee; Robusta coffee; tea; citrus and orange juice; potatoes; sugar; cotton; wool; lumber and pulp; rubber 35% 11 Other commodity Potash, fertilizer, phosphate rocks, etc. (i.e. various industrial minerals); Rare earths; terephthalic acid; flat glass 50%

69 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.4.36 For the purpose of correlation recognition, any two commodities are considered distinct commodities if there exists in the market two contracts differentiated only by the underlying commodity to be delivered against each contract. For example, in bucket 2 (Energy – Liquid Combustibles) WTI and Brent would typically be treated as distinct commodities. 3.4.37 The correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 within the same bucket is set as follows: 𝜌𝑘𝑙 = 𝜌𝑘𝑙 (𝑐𝑡𝑦) ⋅ 𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) ⋅ 𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠)45 where:  𝜌𝑘𝑙 (𝑐𝑡𝑦) is equal to 1 where the two commodities of sensitivities k and l are identical, and to the intra￾bucket correlations in the table below otherwise;  𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) is equal to 1 is the two tenors of the sensitivities k and l are identical, and to 99% otherwise;  𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) is equal to 1 if the two sensitivities are identical in delivery location of a commodity, and 99.9% otherwise. 45 For example, the correlation between the sensitivity to Brent, one-year tenor, for delivery in Le Havre and the sensitivity to WTI, five-year tenor, for delivery in Oklahoma is 95%⋅99%⋅99.9% = 93.96%.

70 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Bucket Commodity category Correlation (𝜌𝑘𝑙 (𝑐𝑡𝑦) ) 1 Energy - Solid combustibles 55% 2 Energy - Liquid combustibles 95% 3 Energy - Electricity and carbon trading 40% 4 Freight 80% 5 Metals – non-precious 60% 6 Gaseous combustibles 65% 7 Precious metals (including gold) 55% 8 Grains & oilseed 45% 9 Livestock & dairy 15% 10 Softs and other agriculturals 40% 11 Other commodity 15% 3.4.38 The correlation parameters γbc that applies to the aggregation of delta commodity risk positions across buckets is set at:  20% if bucket b and bucket c fall within bucket numbers 1 to 10; and  0% if either bucket b or bucket c is bucket number 11. 3.4.39 For determining the commodity correlation parameter ( 𝜌𝑘𝑙 (𝑐𝑡𝑦) ) as set out in paragraph 3.4.37, further definitions related to delivery time and location are as follows:  For bucket 3 (energy – electricity and carbon trading), each time interval (i) at which the electricity can be delivered and (ii) that is specified in a contract that is made on a financial market is considered a distinct electricity commodity (e.g. peak and off-peak). Electricity produced in a specific region should also be considered distinct electricity commodities.  For bucket 4 (freight), each combination of freight type, route and each week at which a good has to be delivered is a distinct commodity.

71 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Foreign exchange risk 3.4.40 A foreign exchange risk bucket is set for each exchange rate between HKD and the currency in which an instrument is denominated. 3.4.41 A risk weight of 15% applies to risk sensitivities of all the currency pairs except USD/HKD and the currency pairs in the footnote46 below. 3.4.42 The risk weight of USD/HKD is set at 1.3% on the rationale that this risk weight captures the fluctuation of USD/HKD within the Convertibility Undertaking range (i.e. 7.75 to 7.85) under the Linked Exchange Rate System. However, AIs using the FX base currency approach as set out in paragraph 3.3.29 with USD as the selected base currency, will not be allowed to make use of this preferential risk weight and should apply a risk weight of 15% divided by the square root of 2 to USD/HKD. 3.4.43 The risk weight of the currency pairs mentioned in footnote 46 is set at 15% divided by the square root of 2. 3.4.44 A uniform correlation parameter γbc that applies to the aggregation of delta foreign exchange risk positions is set at 60%. 3.5 SBM: vega risk weights and correlations 3.5.1 The delta buckets are replicated in the vega context, unless specified otherwise in the subsections 3.3 and 3.4. 3.5.2 The risk of market illiquidity is incorporated into the determination of vega risk by assigning different liquidity horizons for each risk class. The liquidity 46 Selected currency pairs are: USD/AUD, USD/BRL, USD/CAD, USD/CHF, USD/CNY, USD/EUR, USD/GBP, USD/INR, USD/JPY, USD/KRW, USD/MXN, USD/NOK, USD/NZD, USD/RUB, USD/SEK, USD/SGD, USD/TRY, USD/ZAR, their first-order cross-currency pairs between each other, and their first-order cross-currency pairs with USD/HKD. For example, EUR/HKD is not among the selected currency pairs, but is a first-order cross of USD/EUR and USD/HKD. The selected currency pairs could be subject to update. AIs should build their market risk capital calculation systems with sufficient flexibility to account for this potential periodic update.

72 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 horizon and the respective risk weight for each risk class47 is set out as follows. Risk class 𝐿𝐻𝑟𝑖𝑠𝑘 𝑐𝑙𝑎𝑠𝑠(days) Risk weights GIRR 60 100% CSR non-SEC 120 100% CSR SEC (CTP) 120 100% CSR SEC (non-CTP) 120 100% Equity (large cap and indices, i.e. buckets 1 to 8, 12 and 13) 20 77.78% Equity (small cap and other sector, i.e. buckets 9, 10 and 11) 60 100% Commodity 120 100% FX 40 100% 3.5.3 The correlation parameter 𝜌𝑘𝑙 between vega risk positions within the same bucket of the GIRR risk class is set as follows: 𝜌𝑘𝑙 = 𝑚𝑖𝑛 [𝜌𝑘𝑙 (𝑜𝑝𝑡𝑖𝑜𝑛 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) ∙ 𝜌𝑘𝑙 (𝑢𝑛𝑑𝑒𝑟𝑙𝑦𝑖𝑛𝑔 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) ; 1] where:  𝜌𝑘𝑙 (𝑜𝑝𝑡𝑖𝑜𝑛 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) is equal to 𝑒 −𝛼 ∙ |𝑇𝑘−𝑇𝑙 | 𝑚𝑖𝑛{𝑇𝑘 ;𝑇𝑙 } where 𝛼 is set at 1%, 𝑇𝑘 (respectively 𝑇𝑙 ) is the maturity of the option from which the vega risk sensitivity 𝑉𝑅𝑘 (𝑉𝑅𝑙 ) is derived, expressed in years;  𝜌𝑘𝑙 (𝑢𝑛𝑑𝑒𝑟𝑙𝑦𝑖𝑛𝑔 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) is equal to 𝑒 −𝛼 ∙ |𝑇𝑘 𝑈−𝑇𝑙 𝑈| 𝑚𝑖𝑛{𝑇𝑘 𝑈;𝑇𝑙 𝑈} , where 𝛼 is set at 1%, 𝑇𝑘 𝑈 (respectively 𝑇𝑙 𝑈 ) is the maturity of the underlying of the option from which the sensitivity 𝑉𝑅𝑘 (𝑉𝑅𝑙 ) is derived, expressed in years after the maturity of the option. 47 The risk weight for a given vega risk factor 𝑘 (𝑅𝑊𝑘) is determined by the following function: 𝑅𝑊𝑘 = 𝑚𝑖𝑛 [𝑅𝑊𝜎 ∙ √𝐿𝐻𝑟𝑖𝑠𝑘 𝑐𝑙𝑎𝑠𝑠 √10 ; 100%] , where 𝑅𝑊𝜎 is set at 55%; and 𝐿𝐻𝑟𝑖𝑠𝑘 𝑐𝑙𝑎𝑠𝑠 is the regulatory liquidity horizon to be prescribed in the paragraph 3.5.2.

73 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.5.4 The correlation parameter 𝜌𝑘𝑙 between vega risk positions within a bucket of the other risk classes (i.e. non-GIRR) is set as follows: 𝜌𝑘𝑙 = 𝑚𝑖𝑛[𝜌𝑘𝑙 (𝐷𝐸𝐿𝑇𝐴) ∙ 𝜌𝑘𝑙 (𝑜𝑝𝑡𝑖𝑜𝑛 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) ; 1] where:  𝜌𝑘𝑙 (𝐷𝐸𝐿𝑇𝐴) is equal to the correlation that applies between the delta risk factors that correspond to vega risk factors k and l. For instance, if k is the vega risk factor from equity option X and l is the vega risk factor from equity option Y then 𝜌𝑘𝑙 (𝐷𝐸𝐿𝑇𝐴) is the delta correlation applicable between X and Y. For CSR and commodity risks, if the vega risk factors are defined for a smaller number of dimensions than for delta risk factors, only the dimensions that are defined both as a vega risk factor dimension and as a delta risk factor dimension for the relevant risk class need to be considered as a correlation based on delta risk factors ( 𝜌𝑘𝑙 (𝐷𝐸𝐿𝑇𝐴) ) in the calculation of vega risk48; and  𝜌𝑘𝑙 (𝑜𝑝𝑡𝑖𝑜𝑛 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) is defined as in paragraph 3.5.3. 3.5.5 With regard to vega risk positions between buckets within a risk class (GIRR and non-GIRR), the same correlation parameters for γbc, as specified for delta correlations for each risk class in subsection 3.4, are to be used in the vega risk context (e.g. γbc = 50% is to be used for aggregation of vega risk positions across different GIRR buckets). 48 This means that the following dimensions are considered: • for CSR non-SEC: option maturity 𝜌𝑘𝑙 (𝑜𝑝𝑡𝑖𝑜𝑛 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) and underlying name 𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) ; • for CSR SEC (CTP): option maturity 𝜌𝑘𝑙 (𝑜𝑝𝑡𝑖𝑜𝑛 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) and underlying name 𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) ; • for CSR SEC (non-CTP): option maturity 𝜌𝑘𝑙 (𝑜𝑝𝑡𝑖𝑜𝑛 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) and securitisation tranche 𝜌𝑘𝑙 (𝑡𝑟𝑎𝑛𝑐ℎ𝑒) ; and • for commodity risk: option maturity 𝜌𝑘𝑙 (𝑜𝑝𝑡𝑖𝑜𝑛 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) and commodity 𝜌𝑘𝑙 (𝑐𝑡𝑦) .

74 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.5.6 There is no diversification or hedging benefit recognised in the STM approach between vega and delta risk factors. Vega and delta risk charges are aggregated by simple summation. 3.6 SBM: curvature risk weights and correlations 3.6.1 The delta buckets are replicated in the curvature context, unless specified otherwise in the preceding paragraphs. 3.6.2 For foreign exchange and equity curvature risk factors, the curvature risk weight is the relative shift (shock) to a given risk factor, which is equal to the respective delta risk weight. 3.6.3 For foreign exchange curvature risk, for options that do not reference HKD (or base currency as set out in paragraph 3.3.29) as an underlying, net curvature risk charges (𝐶𝑉𝑅𝑘

• and 𝐶𝑉𝑅𝑘 − ) may be divided by a scalar of 1.5. Alternatively, and subject to supervisory approval, an AI may apply the scalar of 1.5 consistently to all FX instruments provided curvature sensitivities are calculated for all currencies, including sensitivities determined by shocking HKD (or base currency where used) relative to all other currencies. 3.6.4 For GIRR and CSR curvature risk factors, the curvature risk weight is the parallel shift of all the tenors for each curve based on the highest prescribed delta risk weight for each bucket. For example, in the case of GIRR for a given currency (i.e. bucket), the risk weight assigned to the 0.25-year tenor (i.e. the most punitive tenor risk weight) is applied to all the tenors simultaneously for each risk-free yield curve (consistent with a “translation”, or “parallel shift” risk calculation). For commodity risk factors, the curvature risk weight is a relative shift of all the tenors for each curve based on the delta risk weight of the commodity. 3.6.5 For aggregating curvature risk positions within a bucket, the curvature risk correlation parameters 𝜌𝑘𝑙 should be determined by squaring the corresponding delta correlation parameters kl except for GIRR, CSR non-securitisations, CSR securitisations (CTP), CSR

75 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 securitisations (non-CTP) and commodities. In applying the high and low correlations scenario set out in paragraph 3.2.15, the curvature risk charge is calculated by applying the curvature correlation parameters 𝜌𝑘𝑙 determined in this paragraph. 3.6.6 For CSR non-securitisations, CSR securitisations (CTP), CSR securitisations (non-CTP) and commodities, the correlation parameter 𝜌𝑘𝑙 as defined in paragraphs 3.4.11, 3.4.12, 3.4.20 and 3.4.37 is not applicable to the curvature risk.  For GIRR, no correlation parameter 𝜌𝑘𝑙 is required since all tenors of all the curves within a given currency (e.g. HKD 1-month swap curve, HKD 3-month swap curve) should be shifted at the same time in order to compute the curvature risk charge for a given currency (i.e. for a given GIRR bucket).  For CSR non-securitisations, CSR securitisations (CTP) and CSR securitisations (non-CTP), the curvature correlation parameter is determined by whether the two names of weighted sensitivities are the same. In paragraphs 3.4.11, 3.4.12 and 3.4.20, the correlation parameters 𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) and 𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) need not apply and only 𝜌𝑘𝑙 (𝑛𝑎𝑚𝑒) (for paragraphs 3.4.11 and 3.4.12) or 𝜌𝑘𝑙 (𝑡𝑟𝑎𝑛𝑐ℎ𝑒) (for paragraph 3.4.20) applies between two weighted sensitivities within the same bucket. This correlation parameter should be squared.  For commodities, the curvature correlation parameter is determined by whether the two commodities of weighted sensitivities are the same. In paragraphs 3.4.37, the correlation parameters 𝜌𝑘𝑙 (𝑏𝑎𝑠𝑖𝑠) and 𝜌𝑘𝑙 (𝑡𝑒𝑛𝑜𝑟) need not apply and only 𝜌𝑘𝑙 (𝑐𝑡𝑦) applies between two weighted sensitivities within the same bucket. This correlation parameter should be squared. In applying the high and low correlations scenario set out in paragraph 3.2.15, the curvature risk charge is

76 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 calculated by applying the curvature correlation parameters 𝜌𝑘𝑙 determined in this paragraph. 3.6.7 For aggregating curvature risk positions across buckets, the curvature risk correlation parameters 𝛾𝑏𝑐 are determined by squaring the corresponding delta correlation parameters 𝛾𝑏𝑐 . For instance, between 𝐶𝑉𝑅𝐸𝑈𝑅 and 𝐶𝑉𝑅𝑈𝑆𝐷 in the GIRR context, the correlation should be 50%2 = 25%. In applying the high and low correlations scenario set out in paragraph 3.2.15, the curvature risk charge is calculated by applying the curvature correlation parameters 𝛾𝑏𝑐 determined in this paragraph. 3.7 Residual risk add-on 3.7.1 As not all market risks can be captured through the SBM or SA-DRC, an AI should calculate a RRAO for all instruments bearing residual risk separately and in addition to other components of the capital charge under the STM approach. Instruments subject to the RRAO 3.7.2 All instruments with an exotic underlying and instruments bearing other residual risks are subject to the RRAO. 3.7.3 Instruments with an exotic underlying are instruments with an underlying exposure whose risk profile is not captured by the sensitivities-based method or default risk charge in the STM approach. 49 3.7.4 Instruments bearing other residual risks are those that meet either of the following criteria:  instruments subject to vega or curvature risk capital charges in the trading book and with pay￾offs that cannot be written or perfectly replicated as a finite linear combination of vanilla options with a single underlying equity price, commodity price, exchange rate, bond price, CDS price or 49 Examples of exotic underlying exposures include: longevity risk, weather, natural disasters, future realised volatility (as an underlying exposure for a swap).

77 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 interest rate swap; or  instruments which fall under the definition of the CTP, except for those instruments that are recognised in the market risk framework as eligible hedges of risks within the CTP. 3.7.5 A non-exhaustive list of other residual risks types and instruments that may fall in the scope of RRAO includes:  Gap risk: risk of a significant change in vega parameters in options due to small movements in the underlying, which results in hedge slippage. Relevant instruments subject to gap risk include all path-dependent options, such as barrier options, and Asian options, as well as all digital options.  Correlation risk: risk of a change in a correlation parameter necessary for determining the value of an instrument with multiple underlyings. Relevant instruments subject to correlation risk include all basket options, best-of-options, spread options, basis options, Bermudan options and quanto options.  Behavioural risk: risk of a change in exercise/prepayment outcomes such as those that arise in fixed rate mortgage products where retail clients may make decisions motivated by factors other than pure financial gain (e.g. demographical features and/or and other social factors). A callable bond may only be seen as possibly having behavioural risk if the right to call lies with a retail client. 3.7.6 An AI is not required to calculate the RRAO to an instrument that exactly offsets the market risk of a third￾party transaction in the trading book (i.e. a back-to￾back transaction50 , in which case both transactions should be excluded from the RRAO). Other than that, 50 In a back-to-back transaction, an instrument perfectly offsets the market risk of another position in the trading book.

78 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 an instrument is not considered bearing other residual risks if it meets the following conditions (however, the instrument may still be subject to the RRAO if it is with an exotic underlying):  The instrument is listed on an exchange; or  The instrument is eligible for central clearing. 3.7.7 When an instrument is subject to one or more of the following risk types, this by itself will not cause the instrument to be subject to the RRAO:  risk from a cheapest-to-deliver option;  smile risk: the risk of a change in an implied volatility parameter necessary for determining the value of an instrument with optionality relative to the implied volatility of other instruments with the same underlying and maturity, but different moneyness;  correlation risk arising from multi-underlying European or American plain vanilla options, and from any options that can be written as a linear combination of such options. This exemption applies in particular to the relevant index options; and  dividend risk arising from a derivative instrument whose underlying does not consist solely of dividend payments. 3.7.8 Index instruments and multi-underlying options of which treatment for delta, vega or curvature risk are set out in paragraphs 3.3.48 to 3.3.55. These are subject to the RRAO if they fall within the definitions set out in this subsection. For funds that are treated as an unrated “other sector” equity as set out in paragraph 3.3.53, an AI shall assume the fund is exposed to exotic underlying exposures, and to other residual risks, to the maximum possible extent allowed under the fund’s mandate.

79 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Calculation of the RRAO 3.7.9 An AI should calculate the RRAO in addition to any other capital charges within the STM approach. 3.7.10 The scope of instruments that are subject to the RRAO should not have an impact in terms of increasing or decreasing the scope of risk factors subject to (i) the delta, vega and curvature or (ii) default risk capital treatments in the STM approach. 3.7.11 An AI should calculate the capital charge for the RRAO51 as the simple sum of gross notional amounts of the instruments bearing residual risks multiplied by the following risk weights:  1.0% for instruments with an exotic underlying; and  0.1% for instruments bearing other residual risks. 3.8 Standardised default risk charge 3.8.1 The SA-DRC is intended to capture JTD risk for equity and credit instruments. 3.8.2 An AI should calculate the SA-DRC to capture the JTD risk in three components (i) non-securitisation, (ii) securitisations (non-CTP) and (iii) securitisations (CTP). The final default risk charge under the STM approach is the simple sum of the three components. 3.8.3 An AI should apply the following step-by-step approach to determine the SA-DRC for each component:  determine the gross JTD risk amount for each instrument subject to default risk separately;  determine the net JTD risk amount with respect to each obligor by offsetting the gross JTD risk amount of long and short exposures with respect to the same obligor (where permissible); 51 Where an AI cannot satisfy the HKMA that the residual risk add-on provides a sufficiently prudent capital charge, the HKMA would address any potentially under-capitalised risks by imposing a conservative additional capital charge under Pillar 2.

80 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  determine the risk-weighted net JTD risk amount by prescribed risk weights and allocate them into different buckets (taking into account the hedging benefit ratio within the bucket) for the calculation of bucket level DRC; and  determine the overall SA-DRC based on the bucket level DRC. 3.8.4 There should be no diversification benefit between the SA-DRC for (i) non-securitisation, (ii) securitisations (non-CTP) and (iii) securitisations (CTP). 3.8.5 For traded non-securitisation credit and equity derivatives, JTD risk amounts for each individual constituent issuer legal entity should be determined by applying a look-through approach. 3.8.6 When decomposing multiple underlying positions of a single instrument, the JTD equivalent is defined as the difference between the value of the instrument assuming that each single name referenced by the instrument, separately from the others, defaults (with zero recovery) and the value of the security or product assuming that none of the names referenced by the security or product default. 3.8.7 For the CTP, the capital charge includes the SA-DRC for securitisation exposures and for non-securitisation hedges. These hedges are to be removed from the default risk non-securitisation calculations. 3.8.8 Exposures to sovereigns, public sector entities and multilateral development banks which would be allocated a 0% risk weight under the STC approach according to sections 55, 56, 57 or 58 of the Rules should also be subject to a 0% risk weight for the purpose of the SA-DRC. 3.8.9 For exposures in an equity investment in a fund that is treated as an unrated “other sector” equity as set out in paragraph 3.3.53, an AI should treat the equity investment in the fund as an unrated equity instrument. Where the mandate of that fund allows the fund to invest in primarily high-yield or distressed names, the AI should apply the maximum risk weight as set out in

81 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 paragraph 3.9.16 that is achievable under the fund’s mandate (by calculating the effective average risk weight of the fund when assuming that the fund invests first in defaulted instruments to the maximum possible extent allowed under its mandate, and then in CCC￾rated names to the maximum possible extent, and then B-rated, and then BB-rated). Neither offsetting nor diversification between these generated exposures and other exposures is allowed. 3.8.10 For a hybrid instrument (e.g. holding a convertible bond), an AI should consider the P&L of the equity optionality embedded when calculating the SA-DRC and may decompose it into a long plain vanilla bond and a long equity call option. 3.9 SA-DRC for non-securitisations Gross JTD risk amount 3.9.1 An AI should calculate gross JTD risk position for each instrument subject to default risk as follows, except instruments mentioned in paragraph 3.9.5: For a long exposure, 𝐽𝑇𝐷𝐿𝑜𝑛𝑔= 𝑚𝑎𝑥(Notional ⋅ LGD + P&L, 0 ) For a short exposure, 𝐽𝑇𝐷𝑆ℎ𝑜𝑟𝑡= 𝑚𝑖𝑛(Notional ⋅ LGD + P&L, 0 ) where  the notional of an instrument that gives rise to a long exposure is recorded as a positive value and to a short exposure is recorded as a negative value;  P&L captures the cumulative mark-to-market loss (or gain) over the principal already taken on the exposure. The P&L loss (gain) is recorded as a negative (positive) value;  if the contractual/legal terms of the derivative

82 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 allow for the unwinding of the instrument with no exposure to default risk, then the JTD is equal to zero; and  a long exposure results from an instrument for which the default of the underlying obligor results in a loss. A short exposure results from an instrument for which the default of the underlying obligor results in a gain. 3.9.2 The gross JTD risk amount captures the loss at default, generally representing the difference between the market value and the notional amount recovered at default. 3.9.3 An AI should apply the following LGD for the calculation of the gross JTD in paragraph 3.9.1:  equity instruments and non-senior debt instruments are assigned an LGD of 100%;  senior debt instruments are assigned an LGD of 75%;  qualifying covered bonds are assigned an LGD of 25%; and  when the price of the instrument is not linked to the recovery rate of the defaulter, there should be no multiplication of the notional by the LGD. 3.9.4 The notional amount of a bond is the face value, while for credit derivatives the notional amount of a CDS contract or a put option on a bond is the notional amount of the derivative contract. In the case of a call option on a bond, however, the notional amount to be used in the JTD equation is zero (since, in the event of default, the call option will not be exercised). In this case, a jump-to-default would extinguish the call option’s value and this loss would be captured through the P&L term in the JTD equation. 3.9.5 The gross JTD risk amount for a spot equity position is the market value of the equity. 3.9.6 The SA-DRC is intended to capture stress events in the tail of the default distribution which may not be

83 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 captured by credit spread shocks in mark-to-market risk. Therefore, the representation of positions uses notional amount and market values for the capitalisation of JTD risk. 3.9.7 The table below provides an illustration to calculate the terms notional amount and P&L in paragraph 3.9.1 for credit instruments. Examples of components in the JTD equation for credit instruments Position JTD exposure Notional P&L Long bond Long Face value of bond Market value of bond – Face value of bond Short bond Short − Face value of bond Face value of bond –Market value of bond Long CDS52 Short − Notional of CDS MtM value of CDS position Short CDS52 Long Notional of CDS −MtM value of CDS position Long call option on a bond Long 0 MtM value of option Short call option on a bond Short 0 −MtM value of option Long put option on a bond Short − Notional of option (Notional of option + MtM value of option) – Strike Short put option on a bond Long Notional of option (Strike −MtM value of option) – Notional of option 3.9.8 The table below provides an illustration to calculate the terms notional amount and P&L in paragraph 3.9.1 for equity instruments. Examples of components in the JTD equation for equity instruments Position JTD exposure Notional P&L Long call option on an equity Long 0 MtM value of option Short call option on an equity Short 0 −MtM value of option Long put option on an equity Short 0 MtM value of option− Strike Short put option on an equity Long 0 Strike −MtM value of option Net JTD risk amount 3.9.9 An AI should calculate the net JTD by offsetting the gross JTD risk amounts of long and short exposures to 52 This refers to CDS with upfront payments only.

84 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 the same obligor where the short exposure has the same or lower seniority relative to the long exposure. For example, a short exposure in equity may offset a long exposure in a bond while a short exposure in a bond cannot offset a long exposure in the equity. Exposures of different maturities that meet this offsetting criterion may be offset as follows:  all exposures with maturities longer than the capital horizon (one year) may be fully offset; and  all or either one of the exposures with a maturity less than one year, in which the size of the gross JTD risk amount of that exposure should be scaled down by the ratio of the exposure’s maturity relative to one year before offsetting. No scaling is applied to the JTD risk amount for exposures of one year or greater.53 3.9.10 Cash equity positions are assigned to a maturity of either more than one year or three months, at an AI’s discretion. 3.9.11 For derivative exposures, the maturity of the derivative contract is considered in determining the offsetting criterion, not the maturity of the underlying instrument. 3.9.12 The maturity weighting applied to the gross JTD for any sort of product with maturity less than 3 months (such as short-term lending) is floored at a weighting factor of 0.25. 3.9.13 For the purposes of determining whether a guaranteed bond is an exposure to the underlying obligor or an exposure to the guarantor, the credit risk mitigation (CRM) requirements as set out in section 98 of the Rules apply. SA-DRC 3.9.14 The weighted net JTD amounts are then allocated to the following buckets: corporates, sovereigns and local governments/municipalities. 53 This paragraph refers to the scaling of gross JTD (i.e. not net JTD).

85 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 3.9.15 An AI should calculate the overall capital charge for each bucket as follows: SA_DRCb = 𝑚𝑎𝑥 [(∑ RWi ⋅ net JTDi i ∈ Long ) ‒ HBR⋅ (∑ RWi ⋅|net JTDi | i ∈ Short ) , 0 ] where  i refers to an instrument belonging to bucket b;  𝐻𝐵𝑅 is the hedge benefit ratio, which recognises the hedging relationship between long and short positions within a bucket, and is equal to ∑ net JTDlong ∑ net JTDlong + ∑|net JTDshort| ;  ∑ net JTDlong is a simple sum of the net (not risk￾weighted) long JTD risk amounts; and  ∑|net JTDshort| is a simple sum of the net (not risk-weighted) short JTD risk amounts. 3.9.16 An AI should calculate the weighted net JTD by multiplying each net JTD with the corresponding default risk weight in accordance with its credit quality as follows. An AI should also follow the guidance provided in paragraph 3.4.9 in cases where there is more than one ECAI issuer rating or when there is no ECAI issuer rating. Credit quality category Default risk weight AAA 0.5% AA 2% A 3% BBB 6% BB 15% B 30% CCC 50% Unrated 15% Defaulted 100% 3.9.17 An AI should calculate the total capital charge for default risk non-securitisation as a simple sum of the

86 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 bucket-level capital charge, i.e. no hedging is recognised between different buckets of corporates, sovereigns as well as local governments and municipalities. 3.10 SA-DRC for securitisations (non-CTP) Gross JTD risk amount 3.10.1 An AI should follow the same approach as described for non-securitisations in order to compute the gross JTD risk amounts for securitisations (non-CTP), except that an LGD ratio is not applied to the exposure. The reason for this is that the LGD is already included in the default risk weights for securitisations to be applied to the securitisation exposure. 3.10.2 For the purposes of offsetting and hedging recognition for securitisations (non-CTP), positions in underlying names or a non-tranched index position may be decomposed proportionately into the equivalent replicating tranches that span the entire tranche structure. When underlying names are used in this way, they should be removed from the non￾securitisation default risk treatment. Net JTD risk amount 3.10.3 Offsetting should be limited to securitisation exposures with the same underlying asset pool and belonging to the same tranche, unless otherwise specified in paragraphs 3.10.2 and 3.10.5. This means that:  no offsetting is permitted across securitisation exposures with different underlying securitised portfolio (i.e. underlying asset pools), even if the attachment and detachment points are the same; and  no offsetting is permitted across securitisation exposures arising from different tranches with the same securitised portfolio. 3.10.4 Securitisation exposures that are otherwise identical except for maturity may be offset, subject to the same

87 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 restriction as for positions of less than one year described in paragraphs 3.9.10 and 3.9.12 for non￾securitisation. 3.10.5 Offsetting within a specific securitisation exposure is allowed as follows.  Securitisation exposures that can be perfectly replicated through decomposition may be offset. Specifically, if a collection of long securitisation exposures can be replicated by a collection of short securitisation exposures, then the securitisation exposures may be offset.  Furthermore, when a long securitisation exposure can be replicated by a collection of short securitisation exposures with different securitised portfolios, then the securitisation exposure with the “mixed” securitisation portfolio may be offset by the combination of replicated securitisation exposures.  After the decomposition, the offsetting rules would apply as in any other case. As in the case of SA-DRC for non-securitisation, a long securitisation exposure means that the default of the underlying obligor in the securitisation leads to a loss for an AI while a short securitisation exposure means that the default of the underlying obligor in the securitisation leads to a gain for an AI. SA-DRC 3.10.6 The weighted net JTD for default risk (securitisations: non-CTP) are allocated to the following buckets:  one unique bucket for all corporates (excluding small and medium enterprises), regardless of their region; and  the other 44 buckets are defined along the two dimensions asset class and region. The 11 asset classes are asset-backed commercial Paper (ABCP), auto loans/leases, residential mortgage￾backed securities (RMBS), credit cards,

88 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 commercial mortgage-backed securities (CMBS), collateralised loan obligations, CDO-squared, small and medium enterprises, student loans, other retail, other wholesale. The 4 regions are Asia, Europe, North America, and/or other regions. 3.10.7 In order to assign a securitisation exposure to a bucket, an AI should rely on a classification that is commonly used in the market for grouping securitisation exposures by type and region of underlying. The AI should assign each securitisation exposure to one and only one of the buckets above and it should assign all securitisations with the same type and region of underlying to the same bucket. Any securitisation exposure that an AI cannot assign to a type or region of underlying in this fashion should be assigned to the buckets other retail, other wholesale or other regions respectively. 3.10.8 Within buckets, the SA-DRC (securitisations: non￾CTP) is determined in a similar approach to that for non-securitisation. The hedge benefit ratio (“HBR”), as defined in paragraph 3.9.15, is applied to net short securitisation exposures in that bucket, and the capital charge is calculated as in paragraph 3.9.15. 3.10.9 For calculating the weighted net JTD, the risk weights of securitisation exposures are defined by tranche instead of credit quality. 3.10.10 The default risk weights for securitisation exposures are based on the risk weights in the corresponding treatment for the banking book, which is available in Part 7 of the Rules. To avoid double-counting of risks in the maturity adjustment (of the banking book approach) since migration risk in the trading book will be captured in the credit spread charge, a maturity of one year is assumed in the securitisation internal ratings-based approach (SEC-IRBA), the securitisation external ratings-based approach (SEC-ERBA) and the securitisation standardised approach (SEC-SA). Following the corresponding treatment in the banking book, the hierarchy of approaches in determining the risk weights should be applied at the tranche level. The

89 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 SA capital charge for an individual cash securitisation position can be capped at the fair value of the transaction. 3.10.11 An AI should calculate the total SA-DRC (securitisations: non-CTP) as a simple sum of the bucket-level capital charge, i.e. no hedging is recognised between different buckets. 3.11 SA-DRC for securitisations (CTP) Gross JTD risk amount 3.11.1 An AI should follow the same approach as described in paragraph 3.10.1 for securitisations (non-CTP) in order to compute the gross JTD risk amounts for securitisations (CTP). 3.11.2 The gross JTD for non-securitisation in the CTP (i.e. single-name and index hedges) positions is defined as their market value. 3.11.3 Nth-to-default products should be treated as tranched products with attachment and detachment points defined as:  attachment point = (N – 1) / Total Names; and  detachment point = N / Total Names, where “Total Names” is the total number of names in the underlying basket or pool. Net JTD risk amount 3.11.4 An AI should calculate the net JTD by offsetting long and short gross JTD risk amounts. Exposures that are otherwise identical except for maturity may be offset, subject to the specifications for exposures of less than one year described in paragraphs 3.9.10 and 3.9.12 for non-securitisations. 3.11.5 For index products, offsetting is possible across maturities among the identical index family (e.g. CDX NA IG), series (e.g. series 18) and tranche (e.g. 0–3%)

90 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 subject to offsetting allowance as set out in paragraph 3.11.4. 3.11.6 Long and short exposures that are perfect replications through decomposition may be offset through decomposition into single name equivalent exposures using a valuation model as follows:  decomposition with a valuation model means that a single name equivalent constituent of a securitisation (e.g. tranched position) is valued as the difference between the unconditional value of the securitisation and the conditional value of the securitisation assuming that the single name defaults with zero recovery. In such cases, the decomposition into single-name equivalent exposures should account for the effect of marginal defaults of the single names in the securitisation, where in particular the sum of the decomposed single name amounts should be equivalent to the value of the securitisation before decomposition; and  decomposition is restricted to “vanilla” securitisations (e.g. vanilla CDOs, index tranches or bespokes) while the decomposition of “exotic” securitisations (e.g. CDO-squared, resecuritisation) is prohibited. 3.11.7 Moreover, for long and short positions in index tranches and indices (non-tranched), offsetting is allowed across maturities among the exact same series of the index by replication or decomposition. For instance, a long securitisation exposure in a 10–15% tranche vs. combined short securitisation exposures in 10–12% and 12–15% tranches on the same index/series can be offset against each other. Similarly, long securitisation exposures in the various tranches that, when combined perfectly, replicate a position in the index series (non-tranched) can be offset against a short securitisation exposure in the index series if all the positions are to the exact same index and series (e.g. CDX NA IG series 18). Long and short positions in indices and single-name constituents in the index may also be offset by decomposition. For instance,

91 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 single-name long securitisation exposures that perfectly replicate an index may be offset against a short securitisation exposure in the index. 3.11.8 In case if a perfect replication is not possible, offsetting is not allowed except as indicated in this paragraph: where the long and short securitisation exposures are otherwise equivalent except for a residual component, offsetting is allowed and the net JTD risk amount should reflect the residual exposure. For instance, a long securitisation exposure in an index of 125 names, and short securitisation exposures of the appropriate replicating amounts in 124 of the names, would result in a net long securitisation exposure in the missing 125th name of the index. 3.11.9 Different tranches of the same index or series, different series of the same index and different index families cannot be offset. SA-DRC 3.11.10 The weighted net JTD for securitisations (CTP) are allocated to buckets that correspond to an index. A non-exhaustive list of indices includes: CDX North America IG, iTraxx Europe IG, CDX HY, iTraxx XO, LCDX (loan index), iTraxx LevX (loan index), Asia Corp, Latin America Corp, Other Regions Corp, Major Sovereign (G7 and Western Europe), Other Sovereign. 3.11.11 Bespoke securitisation exposures should be allocated to the index bucket of the index they are a bespoke tranche of. For instance, the bespoke tranche 5–8% of a given index should be allocated to the bucket of that index. 3.11.12 An AI should calculate the weighted net JTD by multiplying each net JTD with the corresponding default risk weights as follows:  for non-tranched products, the default risk weights corresponding to their credit quality as specified in paragraph 3.9.16; and  for tranched products, the default risk weights using the banking book treatment as specified in

92 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 paragraph 3.10.10. 3.11.13 Within a bucket (i.e. for each index), the SA-DRC (CTP) is determined in a similar approach to that for non-securitisations. The HBR, as defined in paragraph 3.9.15, is applied to net short positions in that bucket as in the equation below. In this case, however, the HBR is determined using the combined long and short positions across all indices in the CTP (i.e. not only the long and short positions of the bucket by itself). A deviation from the approach used for non￾securitisations is that no floor at 0 is made at bucket level, and as a consequence, the SA-DRC at index level (SA-DRCb) can be negative: SA-DRCb = (∑ 𝑅𝑊𝑖 𝑖∈𝐿𝑜𝑛𝑔 ⋅ 𝑛𝑒𝑡 𝐽𝑇𝐷𝑖) − 𝐻𝐵𝑅𝑐𝑡𝑝 ⋅ (∑ 𝑅𝑊𝑖 ⋅ |𝑛𝑒𝑡 𝐽𝑇𝐷𝑖 | 𝑖∈𝑆ℎ𝑜𝑟𝑡 ) The summation of risk-weighted amounts in the equation spans all exposures relating to the index (i.e. index tranche, bespoke, non-tranche index, or single name). The subscript ctp for the term HBRctp indicates that the hedge benefit ratio is calculated using the combined long and short positions across the entire CTP and not just the positions in the particular bucket. 3.11.14 The total SA-DRC for securitisations (CTP) is calculated by aggregating bucket level capital amounts as follows. SA-DRCctp= 𝑚𝑎𝑥{∑𝑏(𝑚𝑎𝑥(𝐷𝑅𝐶𝑏, 0) + 0.5 ⋅ 𝑚𝑖𝑛(𝐷𝑅𝐶𝑏, 0)), 0} For instance, if the SA-DRC for the index CDX North America IG is +100 and the SA-DRC for the index Major Sovereign (G7 and Western Europe) is −100, the total SA-DRC for the correlation trading portfolio is 100 − 0.5 ⋅ 100 = 50. 54 54 The procedure for the SA-DRCb and SA-DRCctp terms accounts for the basis risk in cross-index hedges, as the hedge benefit from cross-index short positions is discounted twice, first by the hedge benefit ratio HBR in SA-DRCb, and again by the term 0.5 in the SA-DRCctp equation.

93 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 4. Internal models approach 4.1 General provisions Modular concept of IMA use 4.1.1 AIs with sophisticated risk management systems are allowed to use the IMA to determine their market risk capital charges, subject to an explicit approval from the HKMA. With the HKMA approval, an AI should calculate and report the capital charge under the IMA to the HKMA on a monthly basis. 4.1.2 The approval will refer to individual trading desks which over time may disqualify and requalify for the use of an IMA. 4.1.3 AIs with an IMA approval should be required to calculate their market risk capital charges additionally based on the STM approach for all of their trading book exposures. This will ensure that (i) AIs can immediately switch to a standardised calculation if a trading desk should lose model eligibility and (ii) they can calculate the threshold for the Basel III output floor. General criteria 4.1.4 In order to obtain an IMA approval for trading desks to be nominated by an AI, the AI should demonstrate to the satisfaction of the HKMA that it is in full compliance with all the requirements related to using an IMA as specified in Section 4. 4.1.5 An AI should not calculate the market risk capital charge using the IMA for (i) securitisation exposures and (ii) equity investments in funds that cannot be looked through but are assigned to the trading book in accordance to the conditions set out in paragraph 2.1.8. 4.1.6 An AI is required, at the minimum, to meet the following general criteria for adopting internal models to calculate the capital charges for its market risk exposures:  the AI’s market risk management system should

94 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 be conceptually sound and implemented with integrity;  the AI should have a sufficient number of staff who are qualified and trained to use models in the AI’s trading area, risk control, audit and back office functions;  the AI’s internal models should have a proven track record of reasonable accuracy in measuring risk;  the AI should regularly conduct stress tests along the lines set out in paragraphs 4.1.28 to 4.1.37; and  the AI’s positions included in the internal models should be held in trading desks that have obtained an explicit HKMA model approval and that have passed the required tests described in paragraph 4.1.26. 4.1.7 An AI is expected to go through a period of initial monitoring and live testing of its internal models before they can be used for regulatory capital adequacy purposes. Any AI which intends to use internal models to calculate its capital charges should be prepared to participate in any such testing exercise to facilitate the HKMA’s assessment of the accuracy and reliability of such models. 4.1.8 The IMA allows for a modular model approval process based on a set of individual trading desks. The scope of these trading desks is defined based on a three￾prong approach as set out in paragraphs 4.1.9 to 4.1.11. 4.1.9 An AI should satisfy the HKMA that both its organisational infrastructure (including the definition and structure of trading desks) and its firm-wide internal models meet all of the qualitative evaluation criteria, as set out in paragraphs 4.1.12 to 4.1.25. 4.1.10 An AI should nominate individual trading desks, as defined in subsection 2.3, for which the AI seeks model approval in order to use the IMA.

95 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  The AI should nominate trading desks that it intends to be in scope and trading desks that are out of scope for the IMA use. The AI should specify in writing the basis for these nominations.  The AI should not nominate a trading desk to be out of scope for model approval on the ground that its capital charge determined using the STM approach being lower than that determined using the IMA.  The AI should use the STM approach to determine the market risk capital charges for trading desks that are out of scope for model approval. The positions in these out-of-scope trading desks are to be combined with all other positions that are subject to the STM approach in order to determine the AI’s STM approach capital charge.  Trading desks that the AI does not nominate for model approval will be ineligible to use the IMA for a period of at least one year from the date of the latest model approval. 4.1.11 Following the approval of regulatory trading desks, this step determines, (i) which trading desks are eligible to use the IMA and (ii) which risk factors within those trading desks are eligible to be included in the AI’s internal ES models to determine market risk capital charges as set out in subsection 4.5.  Each trading desk should satisfy profit and loss attribution tests (“PLAT”) on an ongoing basis to be eligible to use the IMA for regulatory capital purpose. In order to conduct the PLAT, the AI should identify the set of risk factors to be used to determine its market risk capital charges.  Each trading desk should in addition satisfy backtesting requirements on an ongoing basis to be eligible to use the IMA as set out in paragraphs 4.4.4 to 4.4.18.  The AI should conduct PLAT and backtesting on a quarterly basis to update the eligibility and

96 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 classification in PLAT for each trading desk to use the IMA.  The AI should determine the market risk capital charges for risk factors that satisfy the risk factor eligibility test as set out in subsection 4.3 by ES models as specified in subsection 4.5.  The AI should determine the market risk capital charges for risk factors that do not satisfy the risk factor eligibility test by stressed expected shortfall (“SES”) models as specified in subsection 4.6. Qualitative standards 4.1.12 An AI should meet the qualitative criteria set out below on an ongoing basis. The HKMA needs to be satisfied that the AI has met the qualitative criteria before granting an IMA approval. 4.1.13 An AI should have a risk control unit which is functionally independent of the AI’s staff and management responsible for originating and trading market risk exposures (i.e. trading units) and reports directly to the AI’s senior management. This unit should generally be responsible for:  the design, testing and implementation of the AI’s market risk management system;  the oversight of the effectiveness of the AI's market risk management system;  the production and analysis of daily management reports based on the output of the AI’s internal models (including an evaluation of the relationship between measures of market risk exposures and trading limits);  the ongoing review of, and changes to, the AI's market risk management system; and  the conduct of regular backtesting and PLAT to verify the accuracy and reliability of the AI’s internal models. Both of these exercises should be conducted at the trading desk level, while regular backtesting should also be conducted at

97 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 the firm-wide level. 4.1.14 An AI should have a distinct unit, separated from the risk control unit, to conduct the initial and ongoing validation of all internal models for capital adequacy purpose. Internal models should be validated on at least an annual basis. 4.1.15 The Board of Directors and senior management of an AI should be actively involved in the market risk control process and should devote appropriate resources to risk control as an essential aspect of the business. In particular, the daily reports prepared by the independent risk control unit should be reviewed by a level of management with sufficient seniority and authority to enforce both reductions of positions taken by individual traders and reductions in the AI’s overall risk exposure. 4.1.16 Internal models used for regulatory purpose may to some extent differ from those used for internal risk management purpose by an AI in its day-to-day risk management activities. Nevertheless, the core design elements of both the regulatory models and the ones used for internal risk management should be identical.  Valuation models that are a feature of both models should be consistent. These valuation models should be an integral part of the internal identification, measurement, management and internal reporting of price risks within the AI’s trading desks.  Internal risk management models should, at a minimum, be used to assess the risk of the positions that are subject to market risk capital charges, although they may assess a broader set of positions.  The construction of the AI’s regulatory models should be based on the methodologies used in the AI’s internal risk management models with regard to risk factor identification, parameter estimation and proxy concepts and deviate only if this is appropriate due to regulatory requirements.

98 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 It is expected that the same risk factors are covered in the regulatory internal models as in the internal risk management models for all in-scope desks. 4.1.17 An AI should have a routine and rigorous programme for conducting regular stress tests to supplement the AI’s risk analyses based on the output of its internal models.55 The stress testing results should be:  reviewed at least monthly by the AI’s senior management and periodically communicated to the AI’s Board of Directors;  used in the AI’s internal assessment of capital adequacy; and  reflected in the policies and limits set by the AI’s senior management and the AI’s Board of Directors. 4.1.18 Where stress tests reveal particular vulnerability to a given set of circumstances, an AI should take prompt action to mitigate those risks appropriately (e.g. by hedging against that outcome, reducing the size of exposures or increasing capital). 4.1.19 An AI should maintain a protocol for compliance with a documented set of internal manuals, policies, procedures and controls concerning the operation of the internal market risk management models. Such documentation should include a comprehensive risk management manual that describes the basic principles of the AI’s risk management models and that provides a detailed explanation of the empirical techniques used to measure market risk. 4.1.20 Internal models should be comprehensively documented. Such documentation should consist of two components: (i) the core model documentation and (ii) a set of non-core model documentation modules. 4.1.21 The core model documentation should cover all the key components of the internal models. Key components 55 An AI should also fulfil the requirements on stress testing as set out in paragraphs 4.1.28 to 4.1.37.

99 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 will typically include the methodology as well as important aspects of model governance and validation. 56 All model changes that impact the core model documentation need to be explicitly approved by the HKMA. 4.1.22 Non-core model documentation modules should cover a comprehensive range of specified detailed aspects of the internal models. All updates of these modules require a notification to the HKMA. 4.1.23 Both the core documentation and the non-core documentation modules should be systematically organised with version numbers and dates indicating when each specific version was in force. There should be no differences between (i) the documentation and (ii) the actually used internal models and their implementation. 4.1.24 The internal models for capital adequacy purpose should address the full set of positions that are in the scope of application of the models. All models’ measurements of risk should be based on a sound theoretical basis, calculated correctly, and reported accurately. 4.1.25 The internal audit and validation functions or external auditor of an AI should conduct an independent review of its market risk measurement system on an annual basis. Such a review should include the activities of both the AI’s trading units and the independent risk control unit. The independent review should be sufficiently detailed to determine which trading desks are impacted by any failings. At a minimum, the scope of the independent review should include the following:  the organisation of the risk control unit;  the adequacy of the documentation of the risk management models and processes;  the accuracy and appropriateness of the market risk management models (including any 56 Examples include: scope of application, methodology, assumptions, limitations, data sources, instructions for model users and procedures of model validation.

100 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 significant changes);  the verification of the consistency, timeliness and reliability of data sources used to run the internal models, including the independence of such data sources;  the approval process for pricing models and valuation systems used by the front- and back￾office units;  the scope of market risks reflected in the AI’s internal models at the trading desk level;  the integrity of the AI’s management information system;  the accuracy and completeness of position data;  the accuracy and appropriateness of volatility and correlation assumptions;  the accuracy of valuation and risk transformation calculations;  the verification of accuracy of the AI’s internal models at the trading desk level through regular backtesting and PLAT; and  the general alignment between the regulatory internal models and the internal risk management models the AI uses in its day-to-day internal management functions. Model validation standards 4.1.26 An AI should maintain a process to ensure that its internal models have been adequately validated by suitably qualified parties independent of the model development and implementation process to ensure that each model is conceptually sound and adequately reflects all material risks. Model validation should be conducted both when the model is initially developed and when any significant changes are made to the model. The AI should revalidate its models periodically, particularly when there have been significant structural changes in the markets or changes to the composition

101 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 of the AI’s portfolio that might lead to the models no longer being adequate. Model validation should include backtesting and PLAT, and should, at a minimum, also include the following:  The AI should perform tests to demonstrate that any assumptions made within internal models are appropriate and do not underestimate risk. This may include reviewing the appropriateness of distribution assumptions and any pricing models.  Further to the regulatory backtesting programmes, model validation should assess the hypothetical P&L (“HPL”) calculation methodology.  The AI should use hypothetical portfolios to ensure that internal models are able to account for particular structural features that may arise. For example, where the data history for a particular instrument does not meet the quantitative standards in subsection 4.5 and the AI maps these positions to proxies, the AI should ensure that the proxies produce conservative results under relevant market scenarios, with sufficient consideration given to ensuring: – that material basis risks are adequately reflected (including mismatches between long and short positions by maturity or by issuer); and – that the models reflect concentration risk that may arise in an undiversified portfolio. External validation 4.1.27 In reviewing an AI’s internal model, the HKMA and external auditors will require assurance that:  verification that the internal validation processes described in paragraph 4.1.26 are operating in a satisfactory manner;  confirmation that the formulae used in the calculation process, as well as for the pricing of options and other complex instruments, are

102 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 validated by a qualified unit, which in all cases should be independent from the AI’s trading area;  confirmation that the structure of internal models is adequate with respect to the AI’s activities and geographical coverage;  review of the results of both the AI’s backtesting of its internal models (i.e. comparison of VaR with actual P&L (“APL”) and HPL) and its PLAT to ensure that the models provide a reliable measure of potential losses over time. On request, the AI should make available to the HKMA and/or to its external auditors the results as well as the underlying inputs to ES calculations and details of the PLAT; and  confirmation that data flows and processes associated with the risk measurement system are transparent and accessible. On request, the AI should provide the HKMA and its external auditors access to the models’ specifications and parameters. Stress testing 4.1.28 An AI that uses the IMA for determining its market risk capital charges should have in place a rigorous and comprehensive stress testing programme both at the trading desk level and at the firm-wide level. 4.1.29 Stress testing serves to identify events or influences that could significantly impact the AI’s financial soundness and forms a key component of the AI’s internal assessment of capital adequacy. 4.1.30 An AI should adopt stress scenarios which cover a range of factors that (i) can create extraordinary losses or gains in trading portfolios, or (ii) make the control of risk in those portfolios very difficult. These factors include low-probability events in all major types of risk, including the various components of market, credit and

103 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 operational risks. 57 The AI should design stress scenarios to assess the impact of such factors on positions that feature both linear and non-linear price characteristics (i.e. options and instruments that have option-like characteristics). 4.1.31 An AI’s stress tests should be of a quantitative and qualitative nature, incorporating both market risk and liquidity risk aspects of market disturbances.  Quantitative elements should identify plausible stress scenarios to which the AI could be exposed.  Qualitatively, the AI’s stress testing programme should evaluate the capacity of the AI’s capital to absorb potential significant losses and identify steps the AI can take to reduce its risk and conserve capital. 4.1.32 Results of stress testing should be reviewed at least monthly by an AI’s senior management and should be periodically communicated to the AI’s Board of Directors. 4.1.33 An AI should combine the use of supervisory stress scenarios with stress tests developed by the AI itself to reflect its specific risk characteristics. In particular, the HKMA would require the AI to provide information relating to its stress testing results in three broad areas as discussed below. Supervisory scenarios requiring no simulations by an AI 4.1.34 An AI should provide the HKMA with information on its five largest daily losses experienced at the firm-wide and trading desk level respectively during each calendar quarter. This loss information can be compared to the level of the AI’s capital charges that would result from the AI’s internal models. For example, the AI may be required to provide the HKMA 57 An AI should consider material climate-related risk drivers in its stress-testing programme to assess the potential impact on market risk positions, including the impact of a sudden shock to the value of financial instruments, the correlations between risk factors, and the pricing and availability of hedges.

104 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 with an assessment of how many days of peak day losses would have been covered by a given ES estimate. Scenarios requiring a simulation by an AI 4.1.35 An AI should subject its portfolios to a series of simulated stress scenarios and provide the HKMA with the results on a quarterly basis. These scenarios could include testing the current portfolio against past periods of significant market disturbance. 4.1.36 A second type of scenario would evaluate the sensitivity of an AI’s market risk exposure to changes in the assumptions about volatilities and correlations. Applying this test would require an evaluation of the historical range of variation for volatilities and correlations and evaluation of the AI’s current positions against the extreme values of the historical range. AI-specific stress scenarios 4.1.37 An AI should also develop its own specific stress tests that it identifies as most adverse based on the characteristics of its portfolio (e.g. problems in a key region of the world combined with a sharp move in oil prices). The AI should provide the HKMA with a description of the methodology used to determine the scenarios as well as with a description of the results derived from these scenarios. 4.2 Specification of risk factors 4.2.1 Internal models for an AI’s trading desk should specify an appropriate set of market risk factors, i.e. the market rates and prices that affect the value of the AI’s market risk exposures. They should be sufficient to represent the risks inherent in the AI’s portfolio of on- and off￾balance sheet trading positions. Although an AI may have some discretion in specifying the risk factors for its internal models, the following requirements should be fulfilled.

105 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 4.2.2 An AI should include all risk factors that are used for pricing. Where a risk factor is incorporated in a pricing model but not in the internal models, the AI should justify this omission to the satisfaction of the HKMA. 4.2.3 An AI’s internal models should include all risk factors that are specified in the STM approach for the corresponding risk class, as set out in section 3. Where an STM approach risk factor is not included in the internal models, the AI should demonstrate to the HKMA that the internal models are able to capture the risk in a more appropriate way. 4.2.4 For securitised products, AIs are prohibited from using internal models to determine the market risk capital charges. AIs, except for those that are allowed to use the SSTM approach as set out in section 5 or qualify for the de-minimis exemption as set out in paragraph 1.4.3, should use the STM approach as set out in section 3 instead. Accordingly, an AI should not specify risk factors for securitisations as defined in paragraphs 3.3.14 to 3.3.21 for its internal models. 4.2.5 An AI should address non-linearities for options and other relevant products, as well as correlation risk and relevant basis risks (e.g. basis risks between CDS and bonds) in its internal model and any stress scenarios calculated for non-modellable risk factors (“NMRF”). 4.2.6 An AI may use proxies for which there is an appropriate track record for their representation of a position (e.g. an equity index used as a proxy for a position in an individual stock). In the event the AI uses proxies, the AI should support its use to the satisfaction of the HKMA. For interest rate risk 4.2.7 An AI should use a set of risk factors corresponding to interest rates in each currency in which the AI has interest rate-sensitive on- or off-balance sheet trading positions. 4.2.8 An AI’s internal models should model a yield curve using one of a number of generally accepted

106 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 approaches, e.g. estimating forward rates of zero coupon yields. The yield curve should be divided into several maturity buckets in order to capture variations in the volatility of interest rates along the yield curve. 4.2.9 For material exposures to interest rate movements in the most relevant currencies and markets, an AI should model the yield curve using a minimum of six risk factors. The number of risk factors used should ultimately be driven by the nature of the AI’s trading strategies. For instance, if an AI engages in complex arbitrage strategies or if an AI’s portfolio of exposures comprises various types of securities across many points of the yield curve, the AI’s internal models should include a greater number of risk factors in order to capture its interest rate risk more accurately. For credit spread risk 4.2.10 An AI should incorporate separate risk factors to capture credit spread risk (e.g. between bonds and swaps). A variety of approaches may be used to reflect the credit spread risk arising from less-than-perfectly correlated movements between the interest rates of sovereign and other fixed-income instruments, such as specifying a completely separate yield curve for non￾sovereign fixed-income instruments (e.g. swaps or municipal securities) or estimating the spread over sovereign interest rates at various points along the yield curve. For foreign exchange risk 4.2.11 An AI should incorporate risk factors corresponding to individual foreign currencies in which its positions are denominated. As the output of the AI’s risk measurement system will be expressed in HKD, any net position denominated in other currencies will introduce foreign exchange risk. The AI should utilise risk factors that correspond to the exchange rate between HKD and each foreign currency in which it has an exposure except exposure as set out in paragraphs 1.3.3 and 1.3.4.

107 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 For equity risk 4.2.12 An AI should incorporate risk factors corresponding to each of the equity markets in which the AI holds positions. 4.2.13 At a minimum, an AI should utilise risk factors that reflect market-wide movements in equity prices (e.g. a market index). Positions in individual securities or in sector indices may be expressed in beta-equivalents relative to a market-wide index. 4.2.14 An AI may utilise risk factors corresponding to various sectors of the overall equity market (e.g. industry sectors or cyclical and non-cyclical sectors). Positions in individual equities within each sector may be expressed in beta-equivalents relative to a sector index. 4.2.15 An AI should also utilise risk factors corresponding to the volatility of individual equities. 4.2.16 The sophistication and nature of the modelling technique for a given equity market should correspond to an AI’s overall exposures to the market as well as its concentration in individual equities in that market. For commodity risk 4.2.17 An AI should incorporate risk factors corresponding to each of the commodity markets in which the AI holds positions. 4.2.18 When an AI holds relatively limited exposures in commodities, it may utilise a straightforward specification of risk factors. Such a specification would likely entail one risk factor for each commodity price to which the AI is exposed (including different risk factors for different geographical locations where relevant). 4.2.19 When an AI has active trading in commodities, the internal models should account for variation in the

108 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 convenience yield 58 between derivatives positions such as forwards and swaps and cash positions in the commodity. For the risks associated with equity investments in funds 4.2.20 For funds with look-through possibility as set out in paragraph 2.1.8, an AI should consider the risks of the fund, and of any associated hedges, as if the fund’s positions were held directly by the AI (taking into account the AI’s share of the equity of the fund, and any leverage in the fund structure). The AI should assign these positions to the trading desk to which the fund is assigned. 4.2.21 For funds without look-through possibility but with daily prices and knowledge of the fund’s mandate as set out in paragraph 2.1.8, an AI should use the STM approach to calculate capital charges for the fund. 4.3 Model eligibility of risk factors 4.3.1 An AI should determine which risk factors within its trading desks that have received approval to use the IMA are eligible to be included in the ES model for regulatory capital charges. A necessary condition for a risk factor to be classified as modellable is that it passes the risk factor eligibility test (“RFET”). The RFET requires the identification of a sufficient number of real prices that are representative of the risk factor. Collateral reconciliations or valuations, or any prices or quotes generated for the sole purpose of obtaining real prices are not considered as real prices to meet the RFET. A price will be considered real if it meets at least one of the following criteria:  it is a price at which the AI has conducted a transaction;  it is a verifiable price for an actual transaction 58 The convenience yield reflects the benefits from direct ownership of the physical commodity (e.g. the ability to profit from temporary market shortages). The convenience yield is affected both by market conditions and by factors such as physical storage costs.

109 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 between other arm’s-length parties;  it is a price obtained from a committed quote made by (i) the AI itself or (ii) another party. The committed quote: – is a price from an arm’s-length provider at which the provider of the quote must buy or sell the financial instrument; and – should be collected and verified through a third-party vendor, a trading platform or an exchange; or  it is a price that is obtained from a third-party vendor, where: – the transaction or committed quote has been processed through the vendor; – the vendor agrees to provide evidence of the transaction or committed quote to the HKMA upon the AI’s request; and – the price meets any of the three criteria listed in the first three bullet points of this paragraph.59 4.3.2 To pass the RFET, a risk factor that an AI uses in an internal model should meet either of the following criteria on a quarterly basis. Any real price that is observed for a transaction could be counted as an observation for all of the risk factors for which it is representative.60  The AI should identify for the risk factor at least 24 real price observations per year (measured over the period used to calibrate the current ES 59 In the context of this paragraph, orderly transactions and eligible committed quotes with a non-negligible volume, as compared to usual transaction sizes for the AI, reflective of normal market conditions can be generally accepted as valid. 60 When conducting the RFET for a new benchmark rate, an AI can count both: (i) real price observations of the old benchmark rate (that has been replaced by the new benchmark rate) from before the discontinuation of the old benchmark rate; and (ii) real price observations of the new benchmark rate, until one year after the discontinuation of the old benchmark rate. In this context, discontinuation includes cessation of the old benchmark rate or an event whereby the old benchmark rate is deemed by the relevant regulator to no longer be representative of the underlying market.

110 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 model, with no more than one real price observation per day 61 to be included in this count).62 Moreover, over the previous 12 months there should not be any 90-day period in which fewer than four real price observations are identified for the risk factor (with no more than one real price observation per day to be included in this count). The above criteria should be monitored on a monthly basis; or  The AI should identify for the risk factor at least 100 real price observations over the previous 12 months (with no more than one real price observation per day63 to be included in this count). 4.3.3 When an AI uses data for real price observations from an external source, and those observations are provided with a time lag (e.g. data provided for a particular day is only made available a number of weeks later), the period used for the RFET may differ from the period used to calibrate the current ES model. The difference in periods used for the RFET and calibration of the ES model should not be greater than one month, i.e. the AI could use, for each risk factor, a one-year time period finishing up to one month before the RFET assessment instead of the period used to calibrate the current ES model. 4.3.4 In order for a risk factor to pass the RFET, an AI may also count real price observations based on information collected from a third-party vendor provided all of the following criteria are met:  The vendor communicates to the AI the number of corresponding real price observations and the dates at which they have been observed.  The vendor provides, individually, a minimum 61 In the context of this paragraph, a day is defined as a calendar day in Hong Kong or, if consistently applied over time for the whole portfolio, an alternative location as chosen by the AI. 62 In particular, an AI may add modellable risk factors, and replace NMRF by a basis between these additional modellable risk factors and these NMRF. This basis will then be considered an NMRF. A combination between modellable and NMRF will be an NMRF. 63 In the context of this paragraph, a day is defined as a calendar day in Hong Kong or, if consistently applied over time for the whole portfolio, an alternative location as chosen by the AI.

111 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 necessary set of identifier information to enable the AI to map real price observations to risk factors.  The vendor is subject to an external audit regarding the validity of its pricing information on at least an annual basis. The results and reports of this audit must be made available to the HKMA and AIs as a precondition for the AI to be allowed to use real price observations collected by the third-party vendor.  The HKMA has not explicitly disallowed the AI from using the data for the RFET. 4.3.5 A real price is representative for a risk factor of an AI, if the AI is able to extract the value of the risk factor from the real price as of its observation date. The AI should have policies and procedures that describe its mapping of real price observations to risk factors. The AI should provide sufficient information to the HKMA in order to determine if its methodologies are appropriate. Bucketing approach for RFET 4.3.6 Where a risk factor is a point on a curve or a surface (or other higher dimensional objects such as cubes), in order to count real price observations for the RFET, an AI may choose from the following two bucketing approaches:  The own bucketing approach: the AI should define its own buckets and meet the following requirements: – Each bucket should include only one risk factor, and all risk factors should correspond to the risk factors that are used to derive the risk￾theoretical profit and loss (“RTPL”) for the purpose of the PLAT.64

64 The requirement to use the same buckets or segmentation of risk factors for the PLAT and the RFET recognises the trade-off in determining buckets for an ES model. The use of more granular buckets may facilitate a trading desk to pass the PLAT, but additional granularity may challenge an AI’s ability to source a sufficient number of real price observations for each bucket to satisfy the RFET. AIs should consider this trade-off when designing their ES models.

112 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 – The buckets should be non-overlapping.  The regulatory bucketing approach: the AI should use the following sets of standard buckets. Bucket set A set B set C set D 1 0y ≤ t < 0.75y 0y ≤ t < 0.75y 0y ≤ t < 1.5y 0 ≤ δ < 0.05 2 0.75y ≤ t < 1.5y 0.75y ≤ t < 4y 1.5y ≤ t < 3.5y 0.05 ≤ δ < 0.3 3 1.5y ≤ t < 4y 4y ≤ t < 10y 3.5y ≤ t < 7.5y 0.3 ≤ δ < 0.7 4 4y ≤ t < 7y 10y ≤ t < 18y 7.5y ≤ t < 15y 0.7 ≤ δ < 0.95 5 7y ≤ t < 12y 18y ≤ t < 30y t ≥ 15y 0.95 ≤ δ ≤ 1.00 6 12y ≤ t < 18y t ≥ 30y 7 18y ≤ t < 25y 8 25y ≤ t < 35y 9 t ≥ 35y – For interest rate, foreign exchange and commodity risk factors (excluding implied volatilities) with one maturity dimension t, the bucket set A should be used. – For interest rate, foreign exchange and commodity risk factors (excluding implied volatilities) with several maturity dimensions t, the bucket set B should be used for each maturity dimension. – Credit spread and equity risk factors (excluding implied volatilities) with one or several maturity dimensions t, the bucket set C should be used for each maturity dimension. – For any risk factors with one or several strike dimensions δ, where δ represents the probability that an option is “in the money” at maturity, the bucket set D should be used for each strike dimension.65 – For expiry and strike dimensions of implied 65 For options markets where alternative definitions of moneyness are standard, AIs shall convert the regulatory delta buckets to the market-standard convention using their own approved pricing models.

113 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 volatility risk factors (excluding those of interest rate swaptions), the bucket set C for the expiry dimension and D for the strike dimension should be used. – For maturity, expiry and strike dimensions of implied volatility risk factors from interest rate swaptions, only the bucket set B for the maturity dimension, C for the expiry dimension and D for the strike dimension should be used. 4.3.7 An AI may count all real price observations allocated to a bucket to assess whether it passes the RFET for any risk factors that belong to the bucket. A real price observation should be allocated to a bucket for which it is representative of any risk factors that belong to the bucket. 4.3.8 As debt instruments mature, real price observations for those products that have been identified within the prior 12 months are usually still counted in the maturity bucket which they were initially allocated to as set out in paragraph 4.3.7. When an AI no longer needs to model a credit spread risk factor belonging to a given maturity bucket, the AI is allowed to re-allocate the real price observations of this bucket to the adjacent (shorter) maturity bucket.66 A real price observation may only be counted in a single maturity bucket for the purposes of the RFET. 4.3.9 Where an AI uses a parametric function to represent a curve, surface or a higher dimensional object and defines the function’s parameters as the risk factors, the RFET should be assessed at the level of the market data used to calibrate the function’s parameters and not be assessed directly at the level of these risk factor parameters (due to the fact that real price observations that are directly representative of these parameters may not exist). In other words, a parametric function is 66 For example, if a bond with an original maturity of four years had a real price observation on its issuance date eight months ago, AIs can opt to allocate this real price observation to the bucket associated with a maturity between 1.5 and 3.5 years instead of to the bucket associated with a maturity between 3.5 and 7.5 years to which it would normally be allocated.

114 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 only considered modellable if all the data points used for its calibration pass the RFET. 4.3.10 An AI may use systematic credit or equity risk factors within its models that are designed to capture market￾wide movements for a given economy, region or sector, but not the idiosyncratic risk of a specific issuer (the idiosyncratic risk of a specific issuer would be an NMRF unless there are sufficient real price observations of that issuer). Real price observations of market indices or instruments of individual issuers may be considered representative for a systematic risk factor as long as they share the same attributes as the systematic risk factor. 4.3.11 In addition to the approach set out in paragraph 4.3.10, where systematic risk factors of credit or equity risk factors include a maturity dimension (e.g. a credit spread curve), one of the bucketing approaches set out above must be used for this maturity dimension to count real price observations for the RFET. 4.3.12 Once a risk factor has passed the RFET, an AI should choose the most appropriate data to calibrate its model. The data used for calibration of the model does not need to be the same data used to pass the RFET. 4.3.13 Once a risk factor has passed the RFET, an AI should demonstrate that the data used to calibrate its ES model are appropriate based on the principles set out in paragraphs 4.3.15 to 4.3.23. Where the AI has not met these principles to the satisfaction of the HKMA for a particular risk factor, the HKMA may choose to deem the data unsuitable to calibrate the model and, in such case, the risk factor should be excluded from the ES model and subject to capital charges as an NMRF. 4.3.14 There may, on very rare occasions, be a valid reason why a significant number of modellable risk factors across different AIs may become non-modellable due to a widespread reduction in trading activities (for instance, during periods of significant cross-border financial market stress affecting several AIs or when financial markets are subjected to a major regime shift). One possible supervisory response in this

115 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 instance could be to consider a risk factor that no longer passes the RFET as modellable. However, such a response should not facilitate a decrease in capital charges. The HKMA will only pursue such a response under the most extraordinary, systemic circumstances. Modellability of risk factors passing the RFET 4.3.15 An AI may use various types of models to determine the risks resulting from its trading book positions. The data requirements for each model may be different. For any given model, the AI may use different sources or types of data for risk factors. The AI should not rely solely on the number of real price observations to determine whether a risk factor is modellable. The accuracy of the source of real price observations should also be considered. 4.3.16 In addition to the requirements specified above, an AI should follow the principles set out in paragraphs 4.3.17 to 4.3.23 to determine whether a risk factor that passed the RFET can be modelled using the ES model or should be subject to capital charges as an NMRF. The AI is required to demonstrate to the HKMA that these principles are being followed. The HKMA may determine a given risk factor to be non-modellable in the event the AI does not follow these principles for the risk factor. 4.3.17 Principle one: The data used to price instruments may include combinations of modellable risk factors. In general, risk factors derived solely from a combination of modellable risk factors are modellable. For example, risk factors derived through multifactor beta models for which inputs and calibrations are based solely on modellable risk factors can be classified as modellable. However, a risk factor derived from a combination of modellable risk factors that are mapped to distinct buckets of a given curve/surface is modellable only if this risk factor also passes the RFET. 4.3.18 Principle two: The data should allow the internal models to capture both general market and idiosyncratic risk. If the data used in the model do not

116 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 reflect either idiosyncratic or general market risk, an AI should apply an NMRF charge for those aspects that are not adequately captured in its models. 4.3.19 Principle three: The data should allow the model to reflect volatility and correlation of the risk positions. An AI should ensure that it does not understate the volatility of an asset (e.g. by using inappropriate averaging of data or proxies) and accurately reflects the correlation arising between risk factors. 4.3.20 Principle four: The data should be reflective of prices observed and/or quoted in the market. Where data are not derived from real price observations, an AI should demonstrate that the data are reasonably representative of real price observations. The AI should periodically reconcile price data used in its internal model with front and back office prices. The AI should also document its approaches to deriving risk factors from market prices. 4.3.21 Principle five: The data should be updated at a sufficient frequency (at a minimum on a monthly basis but preferably daily) in order to account for frequent turnover of positions in the trading portfolio and changing market conditions. Furthermore, where an AI uses parametric functions, e.g. regressions, to estimate risk factor parameters, these should be regularly re-estimated at a minimum on a bi-weekly basis. Calibration of pricing models in the internal models should also not be less frequent than the calibration of front office pricing models. The AI should have clear policies and sound processes for backfilling and/or gap-filling missing data. 4.3.22 Principle six: The data used to determine stressed expected shortfall (ESR,S) should be reflective of market prices observed and/or quoted in the period of stress. The data for the ESR,S model should be sourced directly from the relevant historical period whenever possible. There may be cases where the characteristics of current instruments in the market differ from those in the stress period. Nevertheless, an AI should empirically justify any instances where the market prices used for the stress period in its internal

117 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 models are different from the market prices actually observed during that period. Further, in cases where instruments that are currently traded did not exist during a period of significant financial stress, the AI should demonstrate that the prices used match changes in prices or spreads of similar instruments during the stress period. 4.3.23 Principle seven: An AI should limit the use of proxies, and proxies used should have sufficiently similar characteristics to the transactions they represent. Proxies should be appropriate for the region, quality and type of instrument they are intended to represent. The HKMA will assess whether methods for combining risk factors are conceptually and empirically sound. 4.3.24 For examples of the application of the principles for risk factor modellability, AIs may refer to MAR99.22 of the Basel Framework for further guidance. 4.4 Backtesting and PLAT 4.4.1 As set out in paragraph 4.1.11, an AI that intends to use the IMA to determine market risk capital charges for a trading desk should conduct and successfully pass (i) backtesting at the firm-wide level and (ii) backtesting and PLAT at the trading desk level. 4.4.2 For an AI to remain eligible to use the IMA, a minimum of 10% of its aggregate market risk capital charges should be based on positions held in trading desks that qualify for the use of internal models by satisfying the backtesting and PLAT as set out in this subsection. This 10% criterion should be assessed by the AI on a quarterly basis when calculating the aggregate capital charges for market risk according to subsection 4.8. 4.4.3 The implementation of backtesting and the PLAT should begin on the same date that the internal models are starting to be used for the calculation of the capital requirements.  For the HKMA approval process of an internal model, the AI should provide a one-year backtesting and PLAT report to confirm the

118 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 quality of the model.  The HKMA will determine any necessary supervisory response to backtesting results based on the number of backtesting exceptions over the course of the most recent 250 trading days generated by the AI’s internal model. – Based on the assessment on the significance of backtesting exceptions, the HKMA may initiate a dialogue with the AI to determine if there is a problem with its internal model. – In the most serious cases, the HKMA will impose an additional add-on to the AI’s capital charges or disallow the use of the internal model. Backtesting requirements 4.4.4 Backtesting requirements compare the VaR measure calibrated to a one-day holding period against each of the APL and HPL data points over the prior 250 trading days.  Specific requirements to be applied at the firm￾wide level and trading desk level are set out below.  Volatility scaling of returns for VaR calculation at the discretion of an AI that results in a shorter observation period being used is not allowed. An AI may scale up the volatility of all observations for a selected (group of) risk factor(s) to reflect a recent stress period. The AI may use this scaled data to calculate future VaR and expected shortfall estimates only after ex-ante notification of such a scaling to the HKMA.  An AI should also refer to MAR99.1 to MAR99.21 of the Basel Framework for additional application guidance for backtesting requirements.

119 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Backtesting at the firm-wide level 4.4.5 An AI should perform backtesting at the firm-wide level in accordance with a VaR measure calibrated at a one￾tailed 99th percentile confidence level.  A backtesting exception occurs when either the AI’s actual loss or the hypothetical loss of the firm￾wide trading book registered in a day of the backtesting period exceeds the corresponding daily VaR resulting from the internal model. Exceptions for actual losses are counted separately from exceptions for hypothetical losses; and the overall number of exceptions is the greater of these two amounts.  In the event either the P&L or the daily VaR measure is not available or impossible to compute, it will count as a backtesting exception. 4.4.6 In the event a backtesting exception can be shown by an AI to relate to an NMRF, and the capital charges for that NMRF exceed the AI’s actual or hypothetical loss for that day, it may be disregarded for the purpose of the overall backtesting process if the HKMA is notified accordingly and does not object to this treatment. In these cases, the AI should document the historical movements of the value of the relevant NMRF and have supporting evidence that the NMRF has caused the relevant loss.67 4.4.7 The scope of the portfolio subject to firm-wide backtesting should be updated quarterly based on the results of the latest trading desk-level backtesting, RFET and PLAT. 4.4.8 The framework for the supervisory interpretation of backtesting results for the firm-wide internal model encompasses a range of possible supervisory responses, depending on the strength of the signal generated from the backtesting. These responses are classified into three backtesting zones:  Green zone: This corresponds to a number of 67 This treatment is also applicable for the backtesting at trading desk level.

120 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 backtesting exceptions not suggesting a problem with the quality of an internal model.  Yellow zone: This encompasses results that do raise questions regarding the quality of an internal model without allowing firm conclusions.  Red zone: This corresponds to a backtesting result that indicates a high probability of a problem with an internal model. 4.4.9 These zones are defined according to the number of backtesting exceptions. The table below sets out boundaries for these zones and the presumptive supervisory response for each backtesting outcome. Where the backtesting results indicate issues with an internal model, the minimum multiplier of 1.5 will be increased by an add-on factor. Zone Number of backtesting exceptions out of 250 observations Backtesting add-on factor Green zone ≤4 0.00 Yellow zone 5 0.20 6 0.26 7 0.33 8 0.38 9 0.42 Red zone ≥10 0.50 4.4.10 Results in the green zone would generally not lead to any backtesting add-ons. 4.4.11 Results in the yellow zone allow no firm conclusion on the quality of an internal model. However, they are generally deemed to indicate issues with an internal model’s accuracy. Within the yellow zone, the HKMA will therefore impose an add-on to the AI’s multiplier which increases with the number of backtesting exceptions. 4.4.12 An AI should also document all of the exceptions generated from its ongoing backtesting programme,

121 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 including an explanation on the factors driving the observed backtesting exceptions. 4.4.13 Independent of any outcomes that place an AI in the yellow zone, in the case of severe problems with the basic integrity of the model, the HKMA may disallow the AI to use the internal models for market risk capital charge purposes at any time. 4.4.14 If an internal model falls into the red zone, the HKMA will automatically increase the multiplication factor applicable to the model or may disallow use of the model. Backtesting at trading desk level 4.4.15 In addition to the firm-wide backtesting, the performance of the internal models will also be tested at the trading desk level through backtesting. 4.4.16 This backtesting assessment is considered to be complementary to the PLAT when determining the eligibility of a trading desk for the IMA. 4.4.17 At the trading desk level, backtesting should compare each desk’s one-day VaR measure (calibrated to the most recent 250 trading days’ data, equally weighted) at both a one-tailed 97.5th percentile and a one-tailed 99th percentile confidence level, using at least the most recent 250 one-day P&L data points of the desk.  A trading desk backtesting exception occurs when either the desk’s actual or hypothetical loss registered in a day of the backtesting period exceeds the corresponding daily VaR measure resulting from the trading desk’s internal model. Exceptions for actual losses are counted separately from exceptions for hypothetical losses; and the overall number of exceptions is the greater of these two numbers.  In the event either the P&L or the risk measure is not available or impossible to compute, it will count as a trading desk backtesting exception.

122 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 4.4.18 If any given trading desk experiences either (i) more than 12 backtesting exceptions at the 99th percentile confidence level or (ii) 30 backtesting exceptions at the 97.5th percentile confidence level in the most recent 250 trading day period, the capital charges for all of the positions in the trading desk should be determined using the STM approach. 68 PLAT requirements 4.4.19 The PLAT compares the daily RTPL with the daily HPL for each trading desk. It intends to:  measure the materiality of simplifications in the internal models used for determining market risk capital charges driven by missing risk factors and differences in the way positions are valued compared with an AI’s front office systems; and  prevent AIs from using their internal models for capital adequacy purposes when such simplifications are considered material. 4.4.20 The PLAT should be performed on a standalone basis for each trading desk in scope for the use of the IMA. Definitions of P&L 4.4.21 The RTPL is the daily trading desk-level P&L that is produced by the valuation engine of the trading desk’s internal model.  The RTPL should take into account all risk factors, i.e. both the modellable risk factors that are included in the ES model and the NMRFs.  The RTPL should not take into account any risk factors that an AI does not include in its trading desk’s internal model. 68 Desks with exposure to issuer default risk should pass a two-stage approval process. First, the market risk model must pass backtesting and PLAT. Conditional on approval of the market risk model, the desk should then apply for approval to model default risk. Desks that fail either test should be capitalised under the STM approach.

123 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 4.4.22 Movements in all risk factors contained in the internal model should be included, even if the forecasting component of the internal model uses data that incorporate additional residual risk. 4.4.23 The PLAT compares a trading desk’s RTPL with its HPL. The HPL used for the PLAT should be identical to the HPL used for backtesting purposes. This comparison determines whether the risk factors included and the valuation engines used in the internal models capture the material drivers of an AI’s reported daily P&L by assessing if there is a significant degree of association between the two P&L measures observed over a suitable time period. The RTPL can differ from the HPL for a number of reasons. However, the internal models should provide a reasonably accurate assessment of the risks of a trading desk to be deemed eligible for the IMA. 4.4.24 The HPL should be calculated by revaluing the positions held at the end of the previous day using the market data of the present day (i.e. using static positions). The HPL measures changes in portfolio value that would occur by assuming end-of-day positions remain unchanged. It should therefore not take into account intraday trading nor new or modified deals, in contrast to the APL. Both APL and HPL include foreign denominated positions and commodities included in the banking book. 4.4.25 Both the APL and HPL should not include (i) fees and commissions, (ii) valuation adjustments for which separate regulatory capital approaches have been otherwise specified as part of the rules (e.g. credit valuation adjustments and its associated eligible hedges) and (iii) valuation adjustments that are deducted from Common Equity Tier 1 capital (e.g. the impact on the debt valuation adjustment component of the fair value of financial instruments should be excluded from these P&Ls). 4.4.26 The APL should include any other market risk-related valuation adjustments, irrespective of the frequency by which they are updated while the HPL must only include valuation adjustments updated daily, unless an

124 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 AI has received specific approval from the HKMA not to include them. Smoothing of valuation adjustments that are not calculated daily is not allowed. APL should take into account P&L resulting from the passage of time. 69 HPL should reflect P&L resulting from the passage of time, consistently with the methodology used in the RTPL. 4.4.27 Valuation adjustments that an AI is unable to calculate at the trading desk level (e.g. because they are assessed in terms of the AI’s overall positions/risks or because of other constraints around the assessment process) are not required to be included in the HPL and APL for backtesting at the trading desk level, but should be included for firm-wide backtesting. The AI should provide evidence to the HKMA for valuation adjustments that are not computed at the trading desk level. 4.4.28 Both APL and HPL should be computed based on the same pricing models (e.g. same pricing functions, pricing configurations, model parametrisation, market data and systems) as the ones used to produce the reported daily P&L. PLAT data input alignment 4.4.29 For the sole purpose of the PLAT, an AI is allowed to align RTPL input data for its risk factors with the data used in HPL if these alignments are documented, justified to the HKMA and the requirements set out below are fulfilled:  The AI should demonstrate that HPL input data can be appropriately used for RTPL purposes, and that no risk factor differences or valuation engine differences are omitted when transforming HPL input data into a format which can be applied to the risk factors used in the RTPL calculation.  Any adjustment of RTPL input data should be 69 Time effects can include various elements such as: the sensitivity to time, or theta effect (i.e. using mathematical terminology, the first-order derivative of the price relative to time), and carry or costs of funding.

125 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 properly documented, validated and justified to the HKMA.  The AI should have procedures in place to identify changes with regard to the adjustments of RTPL input data. The AI should notify the HKMA of any such changes.  The AI should provide assessments on the effect these input data alignments would have on the RTPL and the PLAT. To do so, the AI should compare RTPL based on HPL-aligned market data with the RTPL based on market data without alignment. This comparison should be performed when designing or changing the input data alignment process and upon request of the HKMA. 4.4.30 Adjustments to RTPL input data is allowed when the input data for a given risk factor that are included in both the RTPL and the HPL differ due to (i) different providers of market data sources, (ii) time fixing of market data sources or (iii) transformations of market data into input data suitable for the risk factors of the underlying pricing models. These adjustments can be done either:  by direct replacement of the RTPL input data (e.g. par rate tenor x, provider a) with the HPL input data (e.g. par rate tenor x, provider b); or  by using the HPL input data (e.g. par rate tenor x, provider b) as a basis to calculate the risk factor data needed in calculating the RTPL (e.g. zero rate tenor x).70 4.4.31 If the HPL uses market data in a different manner to RTPL to calculate risk parameters that are essential to the valuation engine, these differences should be reflected in the PLAT and as a result in the calculation of HPL and RTPL. In this regard, HPL and RTPL are allowed to use the same market data only as a basis, 70 AIs are allowed to align the snapshot time used for the calculation of the RTPL of a desk to the snapshot time used for deviation of its HPL.

126 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 but should use their respective methods (which can differ) to calculate the respective valuation engine parameters. This would be the case, for example, where market data are transformed as part of the valuation process used to calculate RTPL. In that instance, an AI may align market data between RTPL and HPL pre-transformation but not post￾transformation. 4.4.32 An AI is not permitted to align HPL input data for risk factors with input data used in RTPL. Adjustments to RTPL or HPL to address residual operational noise are also not permitted. Residual operational noise arises from computing HPL and RTPL in two different systems at two different points in time. It may originate from transitioning large portions of data across systems, and potential data aggregations may result in minor reconciliation gaps below tolerance levels for intervention; or from small differences in static/reference data and configuration. PLAT metrics 4.4.33 For the P&L attribution, an AI should calculate the following two P&L test metrics based on the data from the most recent 250 trading days for each trading desk:  the Spearman correlation metric to assess the correlation between RTPL and HPL; and  the Kolmogorov-Smirnov (“KS”) test metric to assess similarity of the distributions of RTPL and HPL. 4.4.34 An AI should calculate the Spearman correlation metric as follows.  Step 1: For a time series of HPL, a corresponding time series of ranks based on the size (𝑅𝐻𝑃𝐿 ) should be produced. That is, the lowest value in the HPL time series receives a rank of 1, the next lowest value receives a rank of 2 and so on.  Step 2: Similarly, for a time series of RTPL, a corresponding time series of ranks based on size (𝑅𝑅𝑇𝑃𝐿) should be produced.

127 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  Step 3: The Spearman correlation coefficient (𝑟𝑆 ) of the two time series of rank values of 𝑅𝑅𝑇𝑃𝐿 and 𝑅𝐻𝑃𝐿 based on size should be calculated by using the following formula: 𝑟𝑆 = 𝑐𝑜𝑣(𝑅𝐻𝑃𝐿, 𝑅𝑅𝑇𝑃𝐿) 𝜎𝑅𝐻𝑃𝐿⋅ 𝜎𝑅𝑅𝑇𝑃𝐿 where 𝜎𝑅𝐻𝑃𝐿 and 𝜎𝑅𝑅𝑇𝑃𝐿 are the standard deviations of 𝑅𝐻𝑃𝐿 and 𝑅𝑅𝑇𝑃𝐿. 4.4.35 An AI should calculate the KS test metric as follows.  Step 1: The empirical cumulative distribution function of RTPL should be calculated. For any value of RTPL, the empirical cumulative distribution is the mathematical product of 0.004 and the number of RTPL observations that are less than or equal to the specified RTPL.  Step 2: The empirical cumulative distribution function of HPL should be calculated. For any value of HPL, the empirical cumulative distribution is the mathematical product of 0.004 and number of HPL observations that are less than or equal to the specified HPL.  Step 3: The KS test metric is the largest absolute difference observed between these two empirical cumulative distribution functions at any P&L value. 4.4.36 An AI should allocate a trading desk into either a green, yellow or red zone based on the outcome of the metrics as set out as below.

128 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Zone Conditions Green zone If both • the correlation metric is above 0.80; and • the KS distributional test metric is below 0.09 (p-value is above 0.264). Yellow zone If it is allocated neither to the green nor to the red zone. Red zone If • the correlation metric is less than 0.7; or • the KS distributional test metric is above 0.12 (p-value is below 0.055). 4.4.37 If a trading desk is in the PLAT red zone, it is ineligible to use the IMA to determine its market risk capital charges and should use the STM approach.  Risk exposures held by these ineligible trading desks should be included with the out-of-scope trading desks for the purpose of determining the market risk capital charges under the STM approach.  A trading desk deemed ineligible to use the IMA should remain out-of-scope to use the IMA until: – the trading desk produces outcomes in the PLAT green zone; and – the trading desk has satisfied the backtesting exceptions requirements over the past 12 months. 4.4.38 If a trading desk is in the PLAT yellow zone, it is not considered an out-of-scope trading desk for the use of IMA.  If a trading desk is in the PLAT yellow zone, it cannot return to the PLAT green zone until: – the trading desk produces outcomes in the PLAT green zone; and – the trading desk has satisfied its backtesting exceptions requirements over the prior 12 months.

129 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  Trading desks in the PLAT yellow zone are subject to a capital surcharge as specified in paragraph 4.8.6. Treatment for exceptional situations 4.4.39 There may, on very rare occasions, be a valid reason for an accurate model to produce many backtesting exceptions or inadequately track the P&L produced by the front office pricing model (for instance, during periods of significant cross-border financial market stress affecting several AIs or when financial markets are subjected to a major regime shift). One possible supervisory response in this instance would be to permit the relevant trading desks to continue to use the IMA but require the internal model of each trading desk to take into account the regime shift or significant market stress as quickly as practicable while maintaining the integrity of its procedures for updating the model. The HKMA would only pursue such a response under the most extraordinary circumstances with systemic relevance. Transitional arrangements 4.4.40 AIs are required to conduct the PLAT beginning from 1 January 2025. The outcomes of the PLAT will be used for Pillar 2 purposes starting from this date. The Pillar 1 capital requirement consequences of assigning trading desks to the PLAT yellow zone or PLAT red zone, will apply starting from 1 January 2026. 4.5 Capital charges under the IMA Expected shortfall for modellable risk factors 4.5.1 The new IMA replaces VaR and stressed VaR with a single ES metric. Unlike VaR which ignores risks in the tail of the statistical distribution, ES measures provide indications on both the likelihood and the size of losses above a certain confidence level. AIs should however be aware that such measures do not represent an exact quantification of the actual risk but only provide

130 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 estimates based on a limited set of available historical input data. 4.5.2 The HKMA does not prescribe any particular type of ES model for calculating market risk capital charges. All such models should however meet the following minimum standards: 4.5.3 ES should be computed on a daily basis for the firm￾wide internal models. It should also be computed on a daily basis for each trading desk that uses the IMA. 4.5.4 An AI should calculate ES measures as follows:  it should use a one-tailed 97.5th percentile confidence level; and  the liquidity horizons described in paragraph 4.5.13 should be reflected by scaling an ES calculated at a base liquidity horizon of 10 days. 𝐸𝑆 = √(𝐸𝑆𝑇 (𝑃)) 2

• ∑(𝐸𝑆𝑇 (𝑃,𝑗)⋅√ (𝐿𝐻𝑗 − 𝐿𝐻𝑗−1) 𝑇 ) 2 𝑗≥2 where  ES is the regulatory liquidity-adjusted ES;  T is the length of the base horizon, i.e. 10 days;  EST(P) is the ES at horizon T of a portfolio with positions P = (pi) with respect to shocks to all risk factors that the positions P are exposed to;  EST(P, j) is the ES at horizon T of a portfolio with positions P = (pi) with respect to shocks for each position pi in the subset of risk factors Q(pi, j), with all other risk factors held constant;  the ES at horizon T, EST(P) should be calculated for changes in the risk factors, and EST(P, j) should be calculated for changes in the relevant subset Q(pi, j) of risk factors, over the time interval T without scaling from a shorter horizon;  Q(pi, j) is the subset of risk factors for which liquidity horizons, as specified in paragraph

131 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 4.5.13, for the desk where pi is booked are at least as long as LHj according to the table below. For example, Q(pi, 4) is the set of risk factors with a 60-day horizon and a 120-day liquidity horizon. Note that Q(pi, j) is a subset of Q(pi, j–1);  the time series of changes in risk factors over the base time interval T may be determined by overlapping observations; and  LHj is the liquidity horizon j, with lengths in the following table: j LHj (days) 1 10 2 20 3 40 4 60 5 120 4.5.5 An AI should calibrate the ES measure to a period of stress. Specifically, the measure should replicate an ES outcome that would be generated on the AI’s current portfolio if the relevant risk factors were experiencing a period of stress. This is a joint assessment across all relevant risk factors, which will capture stressed correlation measures. 4.5.6 This calibration is to be based on an indirect approach using a reduced set of risk factors. An AI should specify a reduced set of risk factors that are relevant for its portfolio and for which there is a sufficiently long history of observations.  This reduced set of risk factors is subject to approval by the HKMA and should meet the data quality requirements for a modellable risk factor as outlined in subsection 4.3.  The identified reduced set of risk factors should be able to explain a minimum of 75% of the variation of the full ES model, i.e. the ES of the reduced set of risk factors should be at least

132 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 equal to 75% of the fully specified ES model on average measured over the preceding 12-week period.71 4.5.7 An AI should calculate the ES measures using the reduced set of risk factors, i.e. 𝐸𝑆𝑅,𝑆 , calibrated to historical data from the most severe 12-month period of stress available over the observation horizon. That value is then scaled up by the ratio of (i) the current ES using the full set of risk factors, 𝐸𝑆𝐹,𝐶, to (ii) the current ES measure using the reduced set of factors, 𝐸𝑆𝑅,𝐶. The ratio is floored at 1, i.e. 𝐸𝑆 = 𝐸𝑆𝑅,𝑆 ⋅ 𝑚𝑎𝑥 ( 𝐸𝑆𝐹,𝐶 𝐸𝑆𝑅,𝐶 , 1) 4.5.8 For ES measures based on stressed observations (𝐸𝑆𝑅,𝑆 ), an AI should identify the 12-month period of stress over the observation horizon for which the portfolio experiences the largest loss, i.e. the 12-month period that maximises the aggregate capital requirements for modellable risk factors (IMCC set out in paragraph 4.5.16). The observation horizon for determining the most stressful 12 months should, at a minimum, span back to 1 January 2007. Observations within this period should be equally weighted. AIs should update their 12-month stressed period at least quarterly, or whenever there are material changes in the compositions of the portfolio or in the time series of the relevant risk factors. Whenever the AI updates its 12-month stressed period it should also update the reduced set of risk factors (as the basis for the calculations of 𝐸𝑆𝑅,𝐶 and 𝐸𝑆𝑅,𝑆 ) accordingly.72 71 An AI may demonstrate this requirement by showing that the average of the measurements of the ratio (ES using reduced set of risk factors and current period (𝐸𝑆𝑅,𝐶) to ES using full set of risk factors and current period (𝐸𝑆𝐹,𝐶)) over the preceding 12-week period is not lower than 75%. 72 If a new benchmark rate is a modellable risk factor but was not available during the stress period, an AI may use: • for the current period, the new benchmark rate in the full set of risk factors (𝐸𝑆𝐹,𝐶) and in the reduced set of risk factors (𝐸𝑆𝑅,𝐶); and • for the stress period, the old benchmark rate in the reduced set of risk factors (𝐸𝑆𝑅,𝑆 ).

133 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 4.5.9 For measures based on current observations (𝐸𝑆𝐹,𝐶 and 𝐸𝑆𝑅,𝐶), an AI should update its data sets no less frequently than once every three months and should also reassess data sets whenever market prices are subject to material changes.  This updating process should be flexible enough to allow for more frequent updates.  For shorter-term periods of high volatility, the HKMA may also require an AI to calculate its ES using an observation period of less than one year but not less than six months. 4.5.10 No particular type of ES model is prescribed. Provided that each internal model used captures all the material risks run by an AI, as confirmed through the backtesting and PLAT, and conforms to each of the requirements set out in this subsection, the AI may use models based on either historical simulation, Monte Carlo simulation, or other appropriate analytical methods. 4.5.11 An AI may recognise empirical correlations of factors affecting market risk within broad regulatory risk factor classes. Empirical correlations across broad risk classes will be constrained by the supervisory aggregation scheme, as described in paragraphs 4.5.15 and 4.5.16, and should be calculated and used in a manner consistent with the applicable liquidity horizons, clearly documented and able to be justified to the HKMA on request. 4.5.12 An AI’s ES models should accurately capture the risks associated with options within each of the risk classes. The following criteria apply to the measurement of options risk. In particular,  the AI’s internal models should be able to capture the non-linear price characteristics of options positions;  the AI’s internal models should include a set of risk factors that captures the volatilities of the rates and prices of underlyings of the AI’s option positions, i.e. vega risk; and

134 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  if the AI’s portfolio of options is relatively large or complex, there should be detailed specifications of the relevant volatilities. This means that the AI should model the volatility surface across both strike prices and tenors. 4.5.13 As set out in paragraph 4.5.4, an AI should calculate a scaled ES based on the liquidity horizon n determined as follows:  the AI should map each risk factor on to one of the risk factor sub-classes shown below using consistent and clearly documented procedures.  the mapping of risk factors should be set out in writing, validated by the AI’s risk management, made available to the HKMA; and subject to the AI’s internal audit review.  n is determined for each risk factor sub-class as set out in the table below. However, on a desk￾by-desk basis, n can be increased relative to the values in the table below (i.e. the liquidity horizon specified below can be treated as a floor). Where n is increased, the increased horizon should be 20, 40, 60 or 120 days and the rationale should be documented and be subject to approval by the HKMA.  liquidity horizons should be capped at the maturity of the related instrument. Where the maturity of the instrument is shorter than the respective liquidity horizon of the risk factor, the next longer liquidity horizon length (out of the lengths of 10, 20, 40, 60 or 120 days) compared with the maturity of the instrument itself should be used.  the liquidity horizon of multi-sector credit and equity indices should be determined by the weighted average of liquidity horizons of the instruments contained in the index, i.e. by multiplying the liquidity horizon of each individual instrument by its weight in the index and summing across all instruments. The liquidity horizon of the

135 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 index is the shortest liquidity horizon (out of 10, 20, 40, 60 and 120 days) that is equal to or longer than the weighted average liquidity horizon. Risk class Risk factor sub-class Liquidly horizon (days) Interest rate Specified currencies – HKD, AUD, CAD, EUR, GBP, JPY, SEK and USD73 10 Unspecified currencies 20 Volatility 60 Other types 60 Credit spread Sovereign (investment grade) 20 Sovereign (high yield) 40 Corporate (investment grade) 40 Corporate (high yield) 60 Volatility 120 Other types 120 Equity Equity price (large cap) 10 Equity price (small cap), equity repo rate (large cap), dividend risk factors (large cap) 20 Volatility (large cap) 20 Volatility (small cap) 60 Other types 60 FX Specified currency pairs 74 10 Other currency pairs 20 Volatility 40 Other types 40 Commodity Energy and carbon emissions trading price 20 73 The liquidity horizons of cross-currency basis and inflation rate should be consistent with liquidity horizons for interest rate risk factors for their particular currency or currency pair. 74 USD/EUR, USD/JPY, USD/GBP, USD/AUD, USD/CAD, USD/CHF, USD/MXN, USD/CNY, USD/NZD, USD/RUB, USD/HKD, USD/SGD, USD/TRY, USD/KRW, USD/SEK, USD/ZAR, USD/INR, USD/NOK, USD/BRL, EUR/JPY, EUR/GBP, EUR/CHF, JPY/AUD and first-order crosses of these currency pairs.

136 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Risk class Risk factor sub-class Liquidly horizon (days) Precious metals and non-ferrous metals price 20 Other commodities price 60 Energy and carbon emissions trading volatility 60 Precious metals and non-ferrous metals volatility 60 Other commodity volatility 120 Other types 120 4.5.14 For those trading desks that are permitted to use the IMA, all risk factors that are deemed to be modellable should be included in an AI’s firm-wide ES model. The AI should calculate its internally modelled capital charges at the firm-wide level using this model, with no supervisory constraints on cross-risk class correlations (IMCC(C)). 4.5.15 An AI should calculate a series of partial ES capital charges (i.e. all other risk factors should be held constant) for the range of all risk classes (interest rate risk, credit spread risk, equity risk, foreign exchange risk and commodity risk). These partial, non￾diversifiable (constrained) ES (IMCC(Ci)) will then be summed to provide an aggregated risk class ES capital charge. 4.5.16 The aggregate capital charge for modellable risk factors (IMCC) is based on the weighted average of the constrained and unconstrained ES capital charges as follows, 𝐼𝑀𝐶𝐶 = 0.5⋅ (𝐼𝑀𝐶𝐶(𝐶)) + 0.5⋅ (∑𝐼𝑀𝐶𝐶(𝐶𝑖 ) 5 𝑖=1 ) where:  𝐼𝑀𝐶𝐶(𝐶) = 𝐸𝑆𝑅,𝑆 ⋅ max ( 𝐸𝑆𝐹,𝐶 𝐸𝑆𝑅,𝐶 , 1) and

137 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 𝐼𝑀𝐶𝐶(𝐶𝑖 ) = 𝐸𝑆𝑅,𝑆,𝑖 ⋅ max ( 𝐸𝑆𝐹,𝐶,𝑖 𝐸𝑆𝑅,𝐶,𝑖 , 1)  the stress period used in the risk class level 𝐸𝑆𝑅,𝑆,𝑖 should be the same as that used to calculate the portfolio-wide 𝐸𝑆𝑅,𝑆 . 4.6 Capital charges for non-modellable risk factors 4.6.1 An AI should capitalise each non-modellable risk factor (“NMRF”) using a stress scenario that is calibrated to be at least as prudent as the ES calibration used for modellable risk factors (i.e. a loss calibrated to a 97.5th percentile over a period of stress). In determining that period of stress, the AI should determine a common 12-month period of stress across all NMRFs in the same risk class. Subject to approval by the HKMA, an AI may be permitted to calculate stress scenario capital charges at the bucket level (i.e. using the same buckets that the AI uses in the RFET, as set out in 4.3.6) for risk factors that belong to curves, surfaces or cubes (i.e. a single stress scenario capital charge for all the NMRFs that belong to the same bucket). 4.6.2 For each NMRF, the liquidity horizon of the stress scenario should be the greater of the liquidity horizon assigned to the risk factor in paragraph 4.5.13 and 20 days. The HKMA may require a higher liquidity horizon. 4.6.3 For NMRFs arising from idiosyncratic credit spread risk, an AI may apply a common 12-month stress period. Likewise, for NMRFs arising from idiosyncratic equity risk arising from spot, futures and forward prices, equity repo rates, dividends and volatilities, the AI may apply a common 12-month stress scenario. Additionally, a zero correlation assumption may be used when aggregating gains and losses provided the AI conducts analysis to demonstrate to the HKMA that

138 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 this is appropriate. 75 Correlation or diversification effects between other non-idiosyncratic NMRFs are recognised through the formula set out in paragraph 4.6.4. In the event that an AI cannot provide a stress scenario which is acceptable for the HKMA, the AI will have to use the maximum possible loss as the stress scenario. 4.6.4 The aggregate regulatory capital measure for I (non￾modellable idiosyncratic credit spread risk factors that have been demonstrated to be appropriate to aggregate with zero correlation), J (non-modellable idiosyncratic equity risk factors that have been demonstrated to be appropriate to aggregate with zero correlation) and the remaining K (risk factors in model￾eligible trading desks that are non-modellable) is calculated as follows: 𝑆𝐸𝑆 = √∑𝐼𝑆𝐸𝑆𝑁𝑀,𝑖 2 𝐼 𝑖=1

• √∑𝐼𝑆𝐸𝑆𝑁𝑀,𝑗 2 𝐽 𝑗=1
• √(0.6 ⋅ ∑𝑆𝐸𝑆𝑁𝑀,𝑘 𝐾 𝑘=1 ) 2
• 0.64⋅ ∑𝑆𝐸𝑆𝑁𝑀,𝑘 2 𝐾 𝑘=1 where:  𝐼𝑆𝐸𝑆𝑁𝑀,𝑖 is the stress scenario capital charge for idiosyncratic credit spread non-modellable risk i from the l risk factors aggregated with zero correlation;  𝐼𝑆𝐸𝑆𝑁𝑀,𝑗 is the stress scenario capital charge for idiosyncratic equity non-modellable risk j from the J risk factors aggregated with zero correlation; and 75 The tests are generally done on the residuals of panel regressions where the dependent variable is the change in issuer spread while the independent variables can be either a change in a market factor or a dummy variable for sector and/or region. The assumption is that the data on the names used to estimate the model suitably proxies the names in the portfolio and the idiosyncratic residual component captures the multifactor-name basis. If the model is missing systematic explanatory factors or the data suffers from measurement error, then the residuals would exhibit heteroscedasticity and/or serial correlation and/or cross-sectional correlation (clustering).

139 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  𝑆𝐸𝑆𝑁𝑀,𝑘 is the stress scenario capital charge for non-modellable risk k from K risk factors. 4.7 IMA default risk charge 4.7.1 An AI should have a separate internal model to measure the default risk of trading book positions. The general criteria in paragraphs 4.1.4 to 4.1.11 and the qualitative standards in paragraphs 4.1.12 to 4.1.25 also apply to the default risk model. 4.7.2 Default risk is the risk of direct loss due to an obligor’s default as well as the potential for indirect losses that may arise from a default event. 4.7.3 An AI should measure the IMA default risk charge (IMA-DRC) by using a VaR model.  The AI should use a default simulation model with two types of systematic risk factors.  Default correlations should be based on credit spreads or on listed equity prices. Correlations should be based on data covering a period of 10 years that includes a period of stress as defined in paragraph 4.5.5 and based on a one￾year liquidity horizon.  The AI should have clear policies and procedures that describe the correlation calibration process, documenting in particular in which cases credit spreads or equity prices are used.  The AI has the discretion to apply a minimum liquidity horizon of 60 days to the determination of the default risk capital charge for equity sub￾portfolios.  The VaR calculation should be conducted weekly and be based on a one-year time horizon at a one-tailed 99.9th percentile. 4.7.4 All positions subject to market risk capital charges that include default risk as defined in paragraph 4.7.2, with the exception of those positions subject to the STM approach, are subject to the IMA-DRC model.

140 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  All sovereign exposures (independent of their denomination currency), equity positions and defaulted debt positions should be included in the model.  For equity positions, the default of an issuer should be modelled as resulting in the equity price dropping to zero. 4.7.5 The IMA-DRC is the greater of:  the average of the IMA-DRC measures over the previous 12 weeks; or  the most recent IMA-DRC measure. 4.7.6 An AI should assume constant positions over the one￾year horizon, or 60 days in the context of designated equity sub-portfolios. 4.7.7 Default risk should be measured for each obligor.  Market-implied probabilities of default (PDs) are not acceptable unless they are corrected to obtain an objective PD.  PDs are subject to a floor of 0.03%. 4.7.8 An AI may reflect netting of long and short exposures to the same obligor in its IMA-DRC model. If such exposures span different instruments with exposure to the same obligor, the effect of the netting should account for different losses in different instruments (e.g. differences in seniority). 4.7.9 The basis risk between long and short exposures of different obligors should be modelled explicitly. The potential for offsetting default risk among long and short exposures across different obligors should be included through the modelling of defaults. The pre￾netting of positions before input into the model other than as described in paragraph 4.7.8 is not allowed. 4.7.10 An AI’s IMA-DRC model should recognise the impact of correlations between defaults among obligors, including the effect on correlations of periods of stress as described below.

141 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  These correlations should be based on objective data and not chosen in an opportunistic way (depending on the mix of long and short exposures).  The AI should validate that its modelling approach for these correlations is appropriate for its portfolio, including the choice and weights of its systematic risk factors. The AI should document its modelling approach and the period of time used to calibrate the model.  These correlations should be measured over a liquidity horizon of one year.76  These correlations should be calibrated over a period of at least 10 years.  The AI should reflect all significant basis risks in recognising these correlations, including, for example, maturity mismatches, internal or external ratings etc. 4.7.11 An AI’s IMA-DRC model should capture any material mismatch between a position and its hedge. With respect to default risk within the one-year capital horizon, the model should account for the risk in the timing of defaults to capture the relative risk from the maturity mismatch of long and short positions of less￾than-one-year maturity. 4.7.12 The IMA-DRC model should reflect the effect of issuer and market concentrations, as well as concentrations that can arise within and across product classes during stressed conditions. 4.7.13 As part of the IMA-DRC model, an AI should calculate, for each and every position subjected to the model, an incremental loss amount relative to the current 76 For equity sub-portfolios, an AI is permitted to calibrate correlations to liquidity horizons of 60 days in the case that a separate calculation is performed for the equity sub-portfolios and these desks deal predominately in equity exposures. In the case of a desk with both equity and bond exposures, for which a joint calculation for default risk of equities and bonds needs to be performed, the correlations need to be calibrated to a liquidity horizon of one year. In this case, the AI is permitted to consistently use a 60- day PD for equities and a one-year PD for bonds.

142 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 valuation that the AI would incur in the event that the obligor of the position defaults. 4.7.14 Loss estimates should reflect the economic cycle; for example, the model should incorporate the dependence of the recovery on the systemic risk factors. 4.7.15 The IMA-DRC model should reflect the non-linear impact of options and other positions with material non￾linear behaviour with respect to default. In the case of equity derivatives positions with multiple underlyings, subject to approval by the HKMA, simplified modelling approaches (e.g. modelling approaches that rely solely on individual jump-to-default sensitivities to estimate losses when multiple underlyings default) may be applied. 4.7.16 Default risk should be assessed from the perspective of the incremental loss from default in excess of the mark-to-market losses already taken into account in the current valuation. 4.7.17 Owing to the high confidence level and long capital horizon of the IMA-DRC, robust direct validation of the IMA-DRC model through standard backtesting methods will not be possible.  Accordingly, validation of an IMA-DRC model necessarily should rely more heavily on indirect methods, including but not limited to stress tests, sensitivity analyses and scenario analyses, to assess its qualitative and quantitative reasonableness, particularly with regard to the treatment of concentrations.  Such tests should not be limited to the range of events experienced historically in order to ensure the soundness of the IMA-DRC model.  The validation of an IMA-DRC model represents an ongoing process in which an AI and the HKMA jointly determine the exact set of validation procedures to be employed.

143 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 4.7.18 An AI should strive to develop relevant internal modelling benchmarks to assess the overall accuracy of its IMA-DRC model. 4.7.19 Due to the unique relationship between credit spread and default risk, an AI should seek approval from the HKMA for each trading desk with exposure to these risks, both for credit spread risk and default risk. Trading desks which do not receive approval will be deemed ineligible for internal modelling standards and be subject to the STM approach. 4.7.20 Where an AI has approved PD estimates as part of the internal ratings-based (“IRB”) approach, these data should be used. Where such estimates do not exist, PDs should be computed using a methodology consistent with the IRB methodology and satisfy the following conditions.  The AI should not use risk-neutral PDs as estimates of observed (historical) PDs.  The AI should measure PDs based on historical default data including both formal default events and price declines equivalent to default losses. Where possible, these data should be based on publicly traded securities over a complete economic cycle. The minimum historical observation period for calibration purposes is five years.  The AI should estimate PDs based on historical data of default frequency over a one-year period. The PD may also be calculated on a theoretical basis (e.g. geometric scaling) provided that the AI is able to demonstrate that such theoretical derivations are in line with historical default experience (e.g. by using proxies).  The AI may also use PDs provided by external sources as long as they are relevant to its portfolio.

144 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 4.7.21 Where an AI has approved loss-given-default (LGD)77 estimates as part of its IRB approach, these data should be used. Where such estimates do not exist, LGDs should be computed using a methodology consistent with the IRB methodology and satisfy the following conditions.  The AI should determine LGDs from a market perspective, based on a position’s current market value minus the position’s expected market value subsequent to default. The LGD should reflect the type and seniority of the position and cannot be less than zero.  LGDs should be based on an amount of historical data that is sufficient to derive robust, accurate estimates.  An AI may also use LGDs provided by external sources as long as they are relevant to its portfolio. 4.7.22 An AI should establish a hierarchy ranking its preferred sources for PDs and LGDs, in order to avoid the cherry￾picking of parameters. 4.8 Aggregation of capital charge 4.8.1 The regulatory capital charge associated with trading desks that are either out-of-scope for model approval or that have been deemed ineligible to use an internal model (Cu) is to be calculated by aggregating all such risks and applying the STM approach. 4.8.2 The aggregate (non-DRC) capital charge for those trading desks approved and eligible for the IMA (i.e. trading desks that pass the backtesting requirements and that have been assigned to the PLAT green or yellow zone (CY) in paragraphs 4.4.36 to 4.4.38) is equal to the maximum of the most recent observation and a weighted average of the previous 60 days scaled by a multiplier and is calculated as follows where SES is the aggregate regulatory capital measure for the risk 77 LGD should be interpreted in this context as 1 – recovery rate.

145 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 factors in model-eligible trading desks that are non￾modellable. 𝐶𝑌 = 𝑚𝑎𝑥(𝐼𝑀𝐶𝐶𝑡−1 + 𝑆𝐸𝑆𝑡−1, 𝑚𝑐 ∙ 𝐼𝑀𝐶𝐶𝑎𝑣𝑔 + 𝑆𝐸𝑆𝑎𝑣𝑔) 4.8.3 The multiplication factor mc is fixed at 1.5 unless it is set at a higher level by the HKMA to reflect the addition of a qualitative add-on and/or a backtesting add-on in accordance with the following considerations.  The backtesting add-on factor will range from 0 to 0.5 based on the outcome of the backtesting of the AI’s daily VaR at the 99th percentile confidence level based on current observations on the full set of risk factors (VaRFC).  If the backtesting results are satisfactory and the AI meets all of the qualitative standards set out in paragraphs 4.1.12 to 4.1.25, the add-on factor could be zero. Paragraphs 4.4.5 to 4.4.14 present in detail the approach to be applied for backtesting and the add-on factor.  The backtesting add-on factor is determined based on the maximum of the exceptions generated by the backtesting results against APL and HPL as described in paragraphs 4.4.5 to 4.4.14. 4.8.4 The aggregate capital charge for market risk (𝑀𝑅𝑡𝑜𝑡𝑎𝑙) is equal to the aggregate capital charge for approved and eligible trading desks (IMAG,Y = CY + IMA-DRC) plus the STM approach capital charge for trading desks that are either out-of-scope for model approval or that have been deemed ineligible to use the IMA (Cu). If at least one eligible trading desk is in the PLAT yellow zone, a capital surcharge is added. The impact of the capital surcharge is limited by the formula: 𝑀𝑅𝑡𝑜𝑡𝑎𝑙 = 𝑚𝑖𝑛(𝐼𝑀𝐴𝐺,𝑌 + 𝐶𝑎𝑝𝑖𝑡𝑎𝑙 𝑠𝑢𝑟𝑐ℎ𝑎𝑟𝑔𝑒 + 𝐶𝑢 , 𝑆𝐴𝑎𝑙𝑙 𝑑𝑒𝑠𝑘)

• 𝑚𝑎𝑥(0,𝐼𝑀𝐴𝐺,𝑌 − 𝑆𝐴𝐺,𝑌) 4.8.5 For the purposes of calculating the capital charge, the RFET, the PLAT and the trading desk-level backtesting are applied on a quarterly basis to update the

146 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 modellability of risk factors and trading desk classification to the PLAT green, yellow, or red zone. In addition, the stressed period and the reduced set of risk factors (ER,C and ER,S) should be updated on a quarterly basis. The reference dates to perform the tests and to update the stress period and selection of the reduced set of risk factors should be consistent. An AI should reflect updates to the stressed period and to the reduced set of risk factors as well as the test results in calculating capital charges in a timely manner. The averages of the previous 60 days (IMCC, SES) and/or respectively 12 weeks (IMA-DRC) have only to be calculated at the end of the quarter for the purpose of calculating the capital charge.78 4.8.6 The capital surcharge is calculated as the difference between the aggregated standardised capital charges (SAG,Y) and the aggregated internal models-based capital charges (IMAG,Y = CY + DRC) multiplied by a factor k. To determine the aggregated capital charges, positions in all of the trading desks in the PLA green or yellow zone are taken into account. The capital surcharge is floored at zero. 𝐶𝑎𝑝𝑖𝑡𝑎𝑙 𝑠𝑢𝑟𝑐ℎ𝑎𝑟𝑔𝑒 = 𝑘 ∙ 𝑚𝑎𝑥(0, 𝑆𝐴𝐺,𝑌 − 𝐼𝑀𝐴𝐺,𝑌) where:  𝑘 = 0.5 ∙ ∑𝑖∈𝑌 𝑆𝐴𝑖 ∑𝑖∈𝐺,𝑌 𝑆𝐴𝑖 ;  𝑆𝐴𝑖 denotes the standardised capital charge for all the positions of trading desk i;  𝑖 ∈ 𝑌 denotes the indices of all the approved trading desks in the yellow zone; and  𝑖 ∈ 𝐺, 𝑌 denotes the indices of all the approved 78 Risk measures (ES, SES, and IMA-DRC) entering the 60-day (or 12-week) averages used for IMA capital computation at the end of the quarter should be calculated based on a stable set of desks. To calculate those risk measures, the results of the backtesting, PLAT and RFET should be used to update the set of eligible trading desks as well as the reduced set and the stressed period at the beginning of the 60-day (or 12-week) calculation period. To ensure representativeness, AIs should ensure that the dates on which the backtesting and PLAT conclude and the RFET is performed are sufficiently close to the beginning of the 60-day (or 12-week) calculation period (the end of the previous quarter).

147 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 trading desks in the green or yellow zone. 5. Simplified standardised approach 5.1 Eligibility criteria 5.1.1 Some AIs with relatively smaller and simpler market risk exposure may calculate the market risk capital charge using the SSTM approach which corresponds to a recalibrated version of the Basel II standardised approach. However, the use of the SSTM approach is subject to a prior approval of the HKMA and is only limited to AIs fulfilling all of the following quantitative and qualitative eligibility criteria.  the AI’s market risk risk-weighted assets, when using the SSTM approach, must not exceed HKD 1 billion;  the AI’s market risk risk-weighted assets, when using the SSTM approach, must not exceed 2% of its total risk-weighted assets;  the aggregate notional amount of non-centrally cleared derivatives (including both banking book and trading book positions) must not exceed HKD 6 trillion;  the AI must not be a global systemically important bank (G-SIB), a subsidiary of a G-SIB or a domestic systemically important bank (D-SIB); and  the AI must not hold any correlation trading positions. 5.1.2 The HKMA can mandate that an AI with relatively complex or sizeable risks in particular risk classes apply the STM approach instead of the SSTM approach, even if the AI meets all the eligibility criteria stated in paragraph 5.1.1. 5.1.3 When an AI that has been approved to use the SSTM approach can no longer on a permanent basis fulfil all of the eligibility criteria to use the SSTM approach, the AI should give immediate notice in writing to the HKMA.

148 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 The HKMA would require the AI to use the STM approach to calculate its market risk capital charge within a specified period of time. 5.2 Capital charges under the SSTM approach 5.2.1 The capital charge resulting from the SSTM approach equal the simple sum of the recalibrated capital from each of the four risk classes under Basel II Standardised Approach, i.e. interest rate risk, equity risk, FX risk and commodity risk as detailed in the formula below. Capital charge = 𝐾𝐼𝑅𝑅 ∙ 𝑆𝐹𝐼𝑅𝑅 + 𝐾𝐸𝑄 ∙ 𝑆𝐹𝐸𝑄 + 𝐾𝐹𝑋 ∙ 𝑆𝐹𝐹𝑋

• 𝐾𝐶𝑂𝑀𝑀 ∙ 𝑆𝐹𝐶𝑂𝑀𝑀 where:  𝐾𝐼𝑅𝑅 = capital charge for interest rate risk, plus additional requirements for option risks from debt instruments (non-delta risks);  𝐾𝐸𝑄= capital charge for equity risk plus additional requirements for option risks from equity instruments (non-delta risks);  𝐾𝐹𝑋 = capital charge for foreign exchange risk, plus additional requirements for option risks from foreign exchange instruments (non-delta risks);  𝐾𝐶𝑂𝑀𝑀 = capital charge for commodities risk, plus additional requirements for option risks from commodities instruments (non-delta risks);  𝑆𝐹𝐼𝑅𝑅 = scaling factor of 1.30;  𝑆𝐹𝐸𝑄 = scaling factor of 3.50;  𝑆𝐹𝐶𝑂𝑀𝑀 = scaling factor of 1.90; and  𝑆𝐹𝐹𝑋 = scaling factor of 1.20. 5.2.2 An AI should calculate the capital charge of securitisation positions in accordance with the corresponding method for such positions in the banking book as set out in Part 7 of the Rules.

149 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 5.2.3 A partial use of the STM approach and the SSTM approach is not allowed. For AIs that will have obtained the approval of the HKMA to calculate their market risk capital charge under IMA, a partial use of the IMA and the SSTM approach is not allowed.

150 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 6. Cryptoassets exposures 6.1 Treatment of Group 1 cryptoassets79 6.1.1 This section describes how the capital requirements for market risk are to be applied to Group 1 cryptoasset exposures under the SSTM approach, the STM approach, and the IMA.80 SSTM approach 6.1.2 An AI should apply the following specifications when calculating the market risk capital charge under the SSTM approach for Group 1 cryptoassets.  All instruments, including derivatives and off￾balance sheet positions that are affected by changes in Group 1 cryptoassets prices, should be included.  The AI should first express each Group 1 cryptoasset position in terms of its quantity, then convert it at the current spot price into HKD.  The AI should consider for Group 1 cryptoassets the same risk categories as the one used for traditional assets they digitally represent (i.e. interest rate risk, equity risk, FX risk and commodities risk), as defined in Part 8 of the Rules.  The AI should consider for Group 1 cryptoassets the same treatment for options as the one defined for traditional assets they digitally represent (see Division 7 of Part 8 of the Rules). 79 AIs should follow the guidance provided in CRP-1 “Classification of Cryptoassets” to classify a cryptoasset into Group 1a, Group 1b, Group 2a or Group 2b. In relation to the boundary requirements, • a Group 1a cryptoasset exposure should be assigned to the book in a manner consistent with its non-tokenised equivalent traditional asset; • a Group 1b cryptoasset exposure should be assigned to the book in a manner consistent with the traditional assets to which it is referenced; • a Group 2a cryptoasset exposure should be assigned to the trading book; • a Group 2b cryptoasset exposure should be assigned to the banking book; and • any subsequent transfers between books resulting from a cryptoasset reclassification specified in paragraphs 2.1.2 and 2.1.3 of CRP-1 are not subject to the requirements set out in paragraphs 2.1.14 to 2.1.16 of this module. 80 An AI with cryptoasset exposures will not be qualified for the de-minimis exemption for market risk.

151 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  Netting and hedging are recognised between Group 1a cryptoassets and the traditional assets they digitally represent, and both should be mapped to the same risk category.  Netting and hedging are recognised between Group 1b cryptoassets and the traditional assets that the cryptoasset references, and both should be mapped to the same risk category.  If present in a Group 1b cryptoasset, the risk of default of the redeemer and the risks arising when intermediaries perform the redemption function should be treated in line with the capital requirements for credit risk. STM approach 6.1.3 An AI should apply the following specifications when calculating the market risk capital charge under the STM approach for Group 1 cryptoassets. 6.1.4 An AI should map Group 1 cryptoassets to the current risk classes set out in the sensitivities-based method. Specifically:  Each tokenised instrument in Group 1a should be decomposed into the same risk factors as the traditional asset it digitally represents. For the tokenised asset, its sensitivities to the traditional risk factors should be identical to those of the traditional asset it digitally represents within the respective current risk classes.  Each stablecoin instrument in Group 1b should be decomposed into the same risk factors as the traditional assets that it references. Its sensitivities to the traditional risk factors should be identical to those of the traditional assets that it references within the current risk classes. 6.1.5 For SA-DRC, a Group 1 cryptoasset should have its gross JTD risk amount considered as equivalent to those from the traditional asset it digitally represents or references. 6.1.6 If present in a Group 1b cryptoasset, the risk of default

152 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 of the redeemer and the risks arising when intermediaries perform the redemption function should be treated in line with the capital requirements for credit risk. IMA 6.1.7 AIs should apply the following specifications when calculating the market risk capital charge for Group 1 cryptoassets under the IMA. 6.1.8 To determine the aggregate capital charge under the IMA, an AI should calculate the DRC and an aggregate non-DRC capital charge as set out in paragraphs 4.7.5 and 4.8.2 respectively. For the latter, the AI will need to determine an aggregate stressed expected shortfall (SES) capital measure according to paragraph 4.6.4 for the non-modellable risk factors and an aggregate capital charge for modellable risk factors (IMCC) according to paragraph 4.5.16. 6.1.9 The use of the IMA for instruments referencing Group 2 cryptoassets is not permitted. 6.1.10 The market risk capital charge for modellable and non￾modellable risk factors allows mapping of exposures to risk factors as follows:  Each tokenised instrument in Group 1 should be decomposed into the same risk factors as the traditional asset it digitally represents within the respective current risk classes.  Each stablecoin instrument in Group 1 should be decomposed into the same risk factors as the traditional assets that they reference within the respective current risk classes. 6.1.11 For the DRC, tokenised asset and non-tokenised asset are regarded as different instruments to the same obligor. Similarly, traditional assets referenced by a stablecoin and the stablecoin itself are regarded as different instruments to the same obligor. The AI should take into account the different losses in different instruments in accordance with paragraph 4.7.8. Differences in instruments should be reflected in LGD estimates.

153 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Maturity mismatches between tokenised and non￾tokenised assets, and between stablecoins and the traditional assets they reference, should be captured in accordance with paragraph 4.7.11. 6.1.12 If present in a Group 1b cryptoasset, the risk of default of the redeemer and the risks arising when intermediaries perform the redemption function should be treated in line with the capital requirements for credit risk. 6.2 Treatment of Group 2a cryptoassets81 6.2.1 Group 2a cryptoassets are cryptoassets that meet the hedging recognition criteria set out in paragraph 3.1.1 of CRP-1 “Classification of Cryptoassets”. Their exposures must be assigned to the trading book and are subject to modified versions of the SSTM approach or the STM approach set out below. The treatment permits some recognition of hedging. The IMA is not applicable to Group 2a cryptoassets. 6.2.2 An AI should calculate the market risk capital charge for Group 2a cryptoassets on a standalone basis according to:  a modified version of the SSTM approach set out in paragraphs 6.2.3 to 6.2.11; or  a modified version of the STM approach set out in paragraphs 6.2.12 to 6.2.28. SSTM approach for Group 2a cryptoassets 6.2.3 For Group 2a cryptoassets, the SSTM approach will include a separate risk category with its capital requirement determined based on the specifications set out in paragraphs 6.2.4 to 6.2.11. 6.2.4 All instruments, including derivatives and off-balance sheet positions that are affected by changes in Group 2a cryptoasset prices should be included. 81 Group 2b cryptoassets are not subject to market risk capital charges. Instead, Group 2b cryptoasset exposures are subject to the conservative treatment as set out in section 385(2) of the Rules, which is intended to capture both credit and market risk, including CVA risk.

154 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 6.2.5 An AI should first express each Group 2a cryptoasset position in terms of its quantity, and then convert it at the current spot price into HKD. 6.2.6 When consolidating, an AI should not offset positions for each Group 2a cryptoasset in different markets or exchanges, meaning that the AI should determine separate long and short gross consolidated positions. In addition, only the products listed in paragraph 3.1.1 of CRP-1 “Classification of Cryptoassets” may be used for the purposes of offsetting and for the purposes of calculating the net position set out in paragraph 6.2.7 below. Other products that reference Group 2a cryptoassets are subject to the capital requirements that apply to Group 2b cryptoassets. 6.2.7 For each Group 2a cryptoasset k, an AI should determine a net position based on the following formula: 𝑁𝑒𝑡 𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛𝑘 = 𝑚𝑎𝑥(𝑙𝑜𝑛𝑔 𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛𝑘,|𝑠ℎ𝑜𝑟𝑡 𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛𝑘 |) − 0.65 ∙ 𝑚𝑖𝑛(𝑙𝑜𝑛𝑔 𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛𝑘,|𝑠ℎ𝑜𝑟𝑡 𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛𝑘 |) 6.2.8 The capital requirement for position risk of a Group 2a cryptoasset will be 100% of its respective net position. 6.2.9 The total capital requirement for position risk consists of the simple sum of all Group 2a cryptoasset capital requirements. 6.2.10 For options with a Group 2a cryptoasset as underlying asset and associated hedging positions, an AI should calculate the market risk capital charge under the scenario approach.82 The simplified approach and the delta-plus approach are not allowed. In particular, the AI should:  revalue the options and associated hedging positions using matrices for simultaneous changes in (i) the underlying price and (ii) the volatility of that price; 82 An AI should use the scenario approach without the prior consent of the HKMA only for options with a group 2a cryptoasset as underlying asset. For option exposures to debt securities, interest rates, equities, foreign exchange (including gold) and commodities, the use of the scenario approach requires the prior consent of the MA set out in section 299(c) of the Rules.

155 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025  set up a different matrix for each Group 2a cryptoasset;  for each matrix: – use ±100% for the underlying price change and divide the ±100% range into at least seven observations with equally-spaced intervals (including the current observation); – use ±100% for the relative volatility change, inclusive of the current observation, and at the request of the HKMA, use additional intermediate levels between the ±100% range; and  calculate the net position in each cell of the matrix. The market risk capital charge for each Group 2a cryptoasset is equal to the difference between the current net position and the lowest net position occurring in the matrix. 6.2.11 The Group 2a risk class total capital charge should be aggregated in a manner consistent with paragraph 5.2.1. Instead of the scaling factors in paragraph 5.2.1, a scaling factor of 1 shall apply for the Group 2a cryptoassets. STM approach for Group 2a cryptoassets 6.2.12 An AI should include Group 2a cryptoassets in the STM approach as a separate risk class and determine its capital requirement based on the specifications set out in paragraphs 6.2.13 to 6.2.28. 6.2.13 All risk factors, including those related to derivatives and off-balance sheet positions that are affected by changes in Group 2a cryptoasset prices should be included. 6.2.14 An AI should first express each Group 2a cryptoasset position in terms of its quantity, and then convert it at its current spot price into HKD. 6.2.15 When consolidating, an AI should not offset sensitivities for each Group 2a cryptoasset in different markets or exchanges, meaning the AI should calculate those sensitivities as separate long and short gross consolidated sensitivities. In addition, only the products

156 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 listed in paragraph 3.1.1 of CRP-1 “Classification of Cryptoassets” may be used for the purposes of offsetting and for the purposes of calculating the capital charge set out in paragraphs 6.2.17 to 6.2.28 below. Other products that reference Group 2a cryptoassets are subject to the capital requirements that apply to Group 2b cryptoassets. 6.2.16 The computation of the sensitivities-based method for Group 2a cryptoassets includes new specifications of delta, vega and curvature risk factors. The sensitivity definitions are also extended to include those of Group 2a cryptoassets. Finally, a new bucket structure is introduced, composed of multiple buckets, one for each Group 2a cryptoasset, containing only its respective sensitivities. 6.2.17 Group 2a cryptoasset delta spot specification: the sensitivity is measured by changing the Group 2a cryptoasset spot price by 1 percentage point (i.e. 0.01 in relative terms) and dividing the resulting change in the market value of the instrument 𝑉𝑖 by 0.01 (i.e. 1%) as follows: 𝑠𝑘 = 𝑉𝑖 (1.01 ∙ 𝐶𝑅𝑌𝑃𝑇𝑂(𝐺2𝑎)𝑘 ) − 𝑉𝑖 (𝐶𝑅𝑌𝑃𝑇𝑂(𝐺2𝑎)𝑘 ) 0.01 where:  k is a given Group 2a cryptoasset;  𝐶𝑅𝑌𝑃𝑇𝑂(𝐺2𝑎)𝑘 is the market value of the Group 2a cryptoasset k; and  𝑉𝑖 is the market value of instrument i as a function of the price of the Group 2a cryptoasset k. 6.2.18 Group 2a cryptoasset vega specification: the option￾level vega risk sensitivity to a given Group 2a cryptoasset is the mathematical product of the vega and the implied volatility of the option as follows: 𝑠𝑘 = 𝑣𝑒𝑔𝑎 × 𝑖𝑚𝑝𝑙𝑖𝑒𝑑 𝑣𝑜𝑙𝑎𝑡𝑖𝑙𝑖𝑡𝑦 where:  vega, 𝜕𝑉𝑖 𝜕𝜎𝑖 , is defined as the change in the market

157 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 value of the option 𝑉𝑖 as a result of a small amount of change to the implied volatility 𝜎𝑖 ; and  the instrument’s vega and implied volatility should be sourced from pricing models used by the independent risk control function of the AI. 6.2.19 Bucket structure: the new risk class will comprise “n” buckets, where each bucket corresponds to the aggregate positions in a specific Group 2a cryptoasset; this is reflected in the following tables. Delta cryptoasset buckets and risk weights Bucket number Group 2a cryptoasset Risk weight 1 Cryptoasset X1 100% ... ... ... n Cryptoasset Xn 100% Vega cryptoasset buckets and risk weights Bucket number Group 2a cryptoasset Risk weight 1 Cryptoasset X1 100% ... ... ... n Cryptoasset Xn 100% 6.2.20 Delta (vega) capital requirements: Delta sensitivities should be determined based on a risk factor structure considering two dimensions83:  exchange; and  time to maturity, at the following tenors: 0 years, 0.25 years, 0.5 years, 1 year, 2 years, 3 years, 5 years, 10 years, 15 years, 20 years and 30 years. 83 That is, distinct risk factors need to be considered for identical contracts traded on different exchanges or at different tenors, so that no perfect offsetting is permitted between risk factors arising from different exchanges or different tenors.

158 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 6.2.21 For vega sensitivities, no differentiation by exchange or underlying maturity is considered. Group 2a cryptoasset vega risk factors are defined along the maturity of the option. The implied volatility of the option is mapped to one or more of the following tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. 6.2.22 In order to calculate the delta (or vega) capital requirements for a single bucket b 𝜌𝑘𝑙 = 94%. 6.2.23 The delta (or vega) capital requirement, 𝐾𝑏, for a single bucket b is calculated as follows: 𝐾𝑏 = √max (0,∑𝑊𝑆𝑘 2 + ∑∑𝜌𝑘𝑙𝑊𝑆𝑘𝑊𝑆𝑙 𝑘 𝑘 𝑙≠𝑘 ) 6.2.24 The delta (or vega) capital requirement for the Group 2a cryptoasset risk class is ∑𝑏 𝐾𝑏, taking into account that there is no recognition of diversification between different Group 2a cryptoassets. 6.2.25 Curvature capital requirements: for the curvature risk capital requirement, the delta buckets specified above should be used. The curvature sensitivities should be calculated by shifting all tenors in parallel (i.e. no term structure decomposition is required). For calculating the net curvature risk capital requirement CVRk for the risk factor k for the Group 2a cryptoasset, the curvature risk weight, which is the size of a shock to the given risk factor, is a relative shift equal to the delta risk weight. 6.2.26 For aggregating curvature risk positions within a bucket, the following formula should be used: 𝐾𝑏 = max (𝐾𝑏 + ,𝐾𝑏 − ) where: 𝐾𝑏

• = ∑𝑚𝑎𝑥(0, 𝐶𝑉𝑅𝑘 +) 𝑘 𝐾𝑏 − = ∑𝑚𝑎𝑥(0, 𝐶𝑉𝑅𝑘 −) 𝑘

159 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 6.2.27 Curvature risk cannot be diversified across buckets. The total curvature risk capital charge across the entire portfolio is ∑𝑏 𝐾𝑏. 6.2.28 Group 2a cryptoassets are not subject to the SA-DRC. In case of a stablecoin included in Group 2a, the risk of default of the redeemer and the risks arising when intermediaries perform the redemption function should be treated in line with the capital requirements for the credit risk.

160 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Annex A: Example of calculations under structural FX exemption This example is for illustrative purposes only. An AI may adopt an alternative methodology, with reasonable assumptions, to determine its maximum open position to be excluded. The methodology should also be documented in AI’s risk management policy for structural FX positions. This policy should be pre￾approved by the HKMA. Suppose that an AI only holds assets and liabilities denominated in HKD and CNY, respectively. The AI aims to protect its capital adequacy ratio from the movements in the exchange rate CNY/HKD by running a net long position in CNY. Once the maximum open position to be excluded is calculated, the AI must also fulfil all the conditions in paragraph 1.3.3. The table below shows a simplified balance sheet of the AI. Value in HKD equivalent Value in HKD equivalent Asset 1 in HKD 1,200 Liability in HKD 1,185 Asset 2 in HKD 100 Liability in CNY 120 Asset 3 in CNY 150 Capital in HKD 145 The risk-weighted amount for credit risk and market risk (FX risk of the structural currency excluded) for each asset is presented as follows. For the sake of simplicity, it is assumed that there is neither a risk-weighted amount for counterparty credit risk nor for CVA risk and that the risk-weighted amount for operational risk is insensitive to movements in the exchange rate CNY/HKD. 84 Also, there is no market risk on the liabilities side. Risk-weighted amount for credit risk in HKD equivalent Risk-weighted amount for market risk in HKD equivalent Risk-weighted amount for operational risk in HKD equivalent Asset 1 in HKD 1,200 Asset 2 in HKD 50 50 Asset 3 in CNY 150 84 To determine the maximum open position to be excluded, AIs must take into account all the risk￾weighted amounts in determining the capital ratio to be hedged, except the FX risk of the structural currency under the market risk capital charge. See footnote 86.

161 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Based on the information above, we can derive the following positions (in HKD equivalents): • Net open position in CNY 3085 • Maximum open position to be excluded 15 86 • Net open position in CNY subject to FX risk 1587 85 Asset 3 in CNY ─ Liability in CNY = 150 − 120 = 30 86 𝐶𝑎𝑝𝑖𝑡𝑎𝑙 𝑅𝑊𝐴𝑎𝑑𝑗 ∙ 𝑑 𝑅𝑊𝐴𝑎𝑑𝑗 𝑑 𝑆𝐹𝑥

145 1,200+50+150+50 ∙ 150 = 15, where: (i) Capital refers to Tier 1 Capital or Total Capital depending on the capital ratio to be hedged, (ii) 𝑅𝑊𝐴𝑎𝑑𝑗 refers to the adjusted total risk-weighted amount (i.e. without taking into account the FX risk of the structural currency under the market risk capital charge), and (iii) 𝑑 𝑅𝑊𝐴𝑎𝑑𝑗 𝑑 𝑆𝐹𝑥 refers to the sensitivity of 𝑅𝑊𝐴𝑎𝑑𝑗 with respect to a small movement of the structural currency against the reporting currency. 87 Net open position in CNY ─ Maximum open position to be excluded = 30 − 15 = 15

162 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 Annex B: Abbreviations APL actual P&L BCBS Basel Committee on Banking Supervision CDS credit default swap CSR credit spread risk CSR non-SEC credit spread risk for non-securitisation CSR SEC (CTP) credit spread risk for securitisations (correlation trading portfolio) CSR SEC (non-CTP) credit spread risk for securitisations (non-correlation trading portfolio) CTP correlation trading portfolio CVA credit valuation adjustment ES expected shortfall FRTB Fundamental Review of the Trading Book FX foreign exchange GIRR general interest rate risk HBR hedge benefit ratio HPL hypothetical P&L IMA internal models approach IRB internal ratings-based JTD jump-to-default KS Kolmogorov-Smirnov NMRF non-modellable risk factor P&L profit and loss PLAT profit and loss attribution tests RFET risk factor eligibility test RRAO residual risk add-on

163 Supervisory Policy Manual MR-1 Market Risk Capital Charge V.2 – 19.12.2025 RTPL risk-theoretical profit and loss SA-DRC standardised default risk charge SBM sensitivities-based method SES stressed expected shortfall SME small or medium-sized enterprise SSTM approach simplified standardised approach STM approach standardised (market risk) approach VaR value-at-risk ——————— Contents Glossary Home Introduction