Practice Guide on Cloud Adoption

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref.: B1/15C B9/30C 8 January 2026 The Chief Executive All Authorized Institutions Dear Sir/Madam, Practice Guide on Cloud Adoption I am writing to draw your attention to a new “Practice Guide on Cloud Adoption” (Practice Guide), which sets out enhanced guidance by the Hong Kong Monetary Authority (HKMA) and shares good industry practices to help Authorized Institutions (AIs) unlock the potential of cloud technology. This Practice Guide attests to the HKMA’s continued support for AIs to adopt cloud in a responsible manner, under our “Fintech 2030” strategy1 . According to our ongoing engagement, including supervisory review of new initiatives and over 70 bilateral sessions, the HKMA notes that banks in Hong Kong are actively leveraging cloud technologies to facilitate digital transformation, as well as uplift operational resilience and efficiency. Remarkable progress has been noted to-date, with cloud-related projects now accounting for about 80% of reportable technology outsourcing initiatives, and roughly one-third to one-half involving critical banking systems. AIs’ cloud models have also become more complex, expanding beyond private and public clouds to hybrid and multi-cloud environments. The new Practice Guide provides enhanced supervisory guidance to better dovetail with the expected maturity of cloud adoption, assisting AIs’robust risk management. The latest Practice Guide expands the number of cloud-related domains covered from four to eight2 , and through this, augments supervisory guidance in areas pertinent to cloud adoption, including cloud record management, resilience by design and exit testing, /…Page 2 1 Please refer to the HKMA’s press release on “The HKMA Unveils “Fintech 2030” at the Hong Kong FinTech Week 2025”, November 2025 (https://www.hkma.gov.hk/eng/news-and-media/press￾releases/2025/11/20251103-3/). 2 The eight domains are: (1) Governance and oversight; (2) Risk assessment and due diligence; (3) Cloud service provider contractual provisions and related controls; (4) Cloud resilience and exit strategy; (5) Cloud security and data protection; (6) Incident management; (7) Ongoing monitoring; and (8) Workforce strategy and empowerment.

• 2 - supply-chain management, integrated monitoring, and cloud workforce strategy. The key risk and control areas in focus – third-party dependency, concentration risk, security risk, data governance, and resilience – are also increasingly recognised by international standard-setting bodies3 , as meriting additional attention in the light of the latest risk landscape. To enhance practical usability, the guidance is set out following a “lifecycle” approach, and comprises both: (i) high-level principles from relevant Supervisory Policy Manual (SPM) modules4 ; as well as (ii) good practices that the HKMA has observed through supervisory work, and which AIs may follow to help achieve compliance with the principles. This “dual-layered” design aims to keep our supervisory expectations up-to￾date and relevant for a variety of cloud adoption scenarios and applications, while also providing guidance that is actionable and of implementation reference to AIs. The HKMA expects AIs adopting cloud technology to apply the high-level principles for managing cloud-related risks in a manner that is proportionate and commensurate with the risk profile and criticality of their cloud arrangements, and to adopt the good practices where appropriate for their circumstances. The previous “Guidance on Cloud Computing” of 2022 is also superseded as of the date of this letter. The HKMA will continue to actively monitor developments and engage with the industry with a view to further facilitate and promote the responsible adoption of cloud technology. Should you have any questions regarding this circular, please contact us at cloud@hkma.iclnet.hk. Yours faithfully, Carmen Chu Executive Director (Banking Supervision) 3 For instance, the “Digitalisation of Finance” report published by the Basel Committee on Banking Supervision (BCBS) in May 2024, and the “The Financial Stability Implications of Artificial Intelligence” report published by the Financial Stability Board (FSB) in November 2024. 4 Including but not limited to SPM modules OR-2 on “Operational Resilience”, SA-2 on “Outsourcing”, and TM-G-1 on “General Principles for Technology Risk Management”.