Pilots on Cross-boundary Credit Referencing

Our Ref： B4/1C B9/60C B9/218C

28 June 2024 The Chief Executive All Authorized Institutions Dear Sir / Madam, Pilots on Cross-boundary Credit Referencing This circular sets out the arrangements for conducting pilots for cross-boundary credit referencing (“CBCR”), and the application of the Supervisory Policy Manual (“SPM”) module on “The Sharing and Use of Commercial Credit Data through a Commercial Credit Reference Agency” (“IC-7”) on such pilots. With the continued increase in cross-boundary business activities between Hong Kong and the Mainland and rising economic and financial integration in the Guangdong-Hong Kong-Macau Greater Bay Area (“GBA”), there have been calls from the banking industry and the business community, both in Hong Kong and on the Mainland, for cross-boundary commercial credit data connectivity. On the one hand, this can support banks’ credit underwriting and strengthen banks’ credit risk management. On the other hand, this can also benefit the borrowing entities, especially the small and medium enterprises (“SMEs”) in enhancing their access to funding and lowering borrowing costs. Such connectivity is essential in supporting the healthy development of the banking sector and promoting further development of the GBA.

• 2 - The Hong Kong Monetary Authority and the People’s Bank of China (“PBoC”) have signed a Memorandum of Understanding on Cross-boundary Credit Referencing Business Pilots (《關於跨境徵信互通業務試點的諒解備忘 錄》) (“MoU”). The MoU aims at setting out the cooperative arrangements for facilitating and conducting pilots of transfers of commercial credit reference information across the boundary, in support of the promotion and development of CBCR. As enabled by the MoU, the CBCR pilots aim to cover both southbound and northbound transfers of commercial credit information, and will be implemented via credit reference agencies (“CRAs”). In Southbound data transfers, credit referencing information of entities from the Mainland may be transmitted by CRAs on the Mainland to CRAs in Hong Kong, which will in turn be provided to banks in Hong Kong. Similarly, in Northbound data transfers, credit information of entities in Hong Kong may be transmitted by CRAs in Hong Kong to CRAs on the Mainland, which will in turn be provided to banks on the Mainland. The MoU also sets out the following principles under which CBCR pilots are to be conducted: • Customer consent must be obtained for transmission of all data related to the customer; • Compliance with the relevant requirements in data security and protection; • Proper risk management and control; • Focus on facilitating commercial lending, in particular SME lending, in the initial stage; • Open to participation by different banks and CRAs with specific proposals based on their market and business needs; • Pilots to be carried out between Hong Kong and Mainland cities, starting from Shenzhen in the first phase; and • The HKMA and the PBoC will oversee the pilots from the perspectives of data security and prudent risk management. As the pilots may involve the sharing and using of commercial credit data by authorized institutions (“AIs”), both northbound and southbound, through CRAs, AIs participating in the pilots are reminded to comply with all the relevant laws and regulatory requirements when handling cross-boundary flow of commercial credit data. AIs should also, where relevant and practical,

• 3 - observe the guidance stipulated in the SPM module IC-7. In particular, AIs participating in the pilots should pay attention to Sections 4 and 5 of the SPM, including that consents of their customer should be properly obtained before disclosing their credit data to the CRAs for the purpose of cross-boundary data transfer and that the data covered by the pilots are to be properly safeguarded with regard to security and confidentiality, as well as Section 6 of the SPM on requiring the CRAs that AIs engage in to adopt all reasonable procedures to protect the commercial credit data they hold, with regard to the confidentiality, accuracy, relevance and proper utilisation of the information. In case personal data are involved in the cross-boundary data transfer, the AIs concerned are also reminded to comply with the requirements of the Personal Data (Privacy) Ordinance (Cap. 486). With the signing of the MoU for facilitating CBCR, AIs are strongly encouraged to make use of the pilot arrangements under the MoU to conduct pilots for meeting their business development needs. Should you have any questions regarding this circular, please contact Ms. Jessica Szeto or Mr. Jack Wat at 2597 0848 on matters relating to the CBCR, or Ms. Cora Ching or Ms. Ivy Lo at 2878 1708 on matters relating to the SPM. Yours faithfully, Alan Au Executive Director (Banking Conduct) c.c. The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association Secretary for Financial Services and the Treasury (Attn: Mr Justin To)