Revised Supervisory Policy Manual Module IC-5 on Stress-testing

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 1 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To provide guidance to AIs on the key elements of an effective stress-testing programme, and describe the HKMA’s supervisory approach to assessing the adequacy of their stress-testing practices. Classification A non-statutory guideline issued by the MA as a guidance note. Previous guidelines superseded IC-5 “Stress-testing” (V.2) dated 09.05.12 Application To all AIs. Structure

1. Introduction 1.1 Background 1.2 Main functions of stress-testing 1.3 Scope and coverage 1.4 Application
2. Stress-testing programme 2.1 General 2.2 Objectives 2.3 Process, policies and procedures 2.4 Governance, resources and infrastructure

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 2 2.5 Risk identification 2.6 Stress-testing approaches, models and methodologies 2.7 Design and setting of stress scenarios 2.8 Use of stress-testing results and risk-mitigating strategies 2.9 Interpretation and communication of stress-testing results 2.10 Independent review of stress-testing programme 3. Supervisory assessment of stress-testing practices 3.1 General 3.2 Assessment approach 3.3 Use of supervisory scenarios Annex: Risk factors and stress scenario examples

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 3

1. Introduction 1.1 Background 1.1.1 Stress-testing involves the use of various techniques to assess a financial institution’s potential vulnerability (typically in terms of its profitability, liquidity and capital adequacy) to “stressed” business conditions and thereby plays an important role in the management of risk by banks. It is also a tool commonly employed by supervisors for assessing the risks and vulnerabilities within banking systems. 1.1.2 Examples of extreme market movements and crises in the past show that it is inadequate to manage risks only on the basis of “normal” business conditions. In the event of a severe idiosyncratic or market shock, banks may incur substantial losses and/or experience rapid liquidity outflow as a result of one or more of the following circumstances:  assumptions of how markets behave during normal conditions no longer hold true and risk characteristics change rapidly as market events unfold, making certain historical statistical relationships (such as correlations), and thus banks’ risk management models that build on these relationships, unreliable;  new concentrations of risk emerge through unexpected linkages between different markets, risk types and positions;  initial shocks may be dramatically amplified and spill over to other market segments, as reactions by market participants can induce feedback effects and lead to system-wide interactions;  negative news or rumours of banks may be fuelled by media coverage (including social media), which accelerate the spread of public concerns about banks’ viability and may trigger unprecedented large-scale and simultaneous deposit withdrawals;  market prices may become highly volatile, and a squeeze in liquidity across multiple markets may occur and may last for a prolonged period of time;

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 4  economic conditions may suddenly deteriorate in affected jurisdictions or regions;  impairment or closure of foreign exchange swap markets may render it impossible to exchange one currency for another;  difficulties in unwinding or hedging positions may be experienced as participants scramble to exit the market simultaneously, thereby drying-up market liquidity and heightening concern over counterparty credit risk; or  disruptions to critical systems and infrastructure, such as payment processing, trading platforms, third-party services, or other technological failures may cause significant financial losses and reputational damage. 1.1.3 The above should serve to illustrate the importance of stress-testing to estimate an AI’s likely losses under adverse conditions, and to enable the AI to be better prepared for such situations. 1.2 Main functions of stress-testing 1.2.1 Stress-testing is a critical risk management tool for AIs. It helps alert AIs’ Board1 and senior management to adverse unexpected outcomes related to a variety of risks to which AIs are exposed, and provides an indication of the amount of financial resources (including capital and liquidity) that might be necessary to absorb losses caused by, or to withstand, severe stressed conditions. 1.2.2 Stress-testing generally serves the following purposes, as appropriate:  providing a forward-looking assessment of an AI’s risk exposures under stressed conditions and enabling the AI to develop appropriate risk-mitigating strategies (e.g. restructuring positions) and contingency plans across a range of stressed conditions; 1 In this module, the term “Board” refers to the Board of Directors of a locally incorporated AI or, in the case of an AI incorporated outside Hong Kong, its Board of Directors and/or regional or local management as appropriate. The term “Board” may also refer to a committee of the Board with delegated authority where applicable.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 5  assisting the AI in its risk identification and quantification processes, thereby enhancing its understanding of its own risk profile and facilitating the monitoring of changes in the profile over time;  informing the Board and senior management on the setting of the AI’s risk appetite or tolerance and the determination of whether its risk exposures are commensurate with the stated risk appetite or tolerance;  supplementing the use of statistical risk measures such as value-at-risk, expected shortfall or economic capital models which are based mainly on historical data and assumptions, and contributing to the modelling of the risks associated with new products or activities where there is a lack of sufficient historical data. Stress￾testing helps quantify “tail” risk (i.e. the risk of losses under extreme market conditions) and re-assessment of modelling assumptions (e.g. those in relation to volatility and correlation);  evaluating the AI’s existing and potential vulnerabilities on a firm-wide basis 2 (e.g. emerging risk concentrations) and its capacity to withstand stressed situations in terms of profitability, liquidity and capital adequacy;  facilitating the AI’s calibration of risk appetite and limits, financial and capital planning, liquidity and funding risk assessment, contingency planning, and resolution and recovery planning;  supporting the AI’s Internal Capital Adequacy Assessment Process (ICAAP) and liquidity risk management;  facilitating the AI’s portfolio management, new trade and/or product approval processes, investment 2 For a banking group, the concept of firm-wide risk management will similarly apply on a group-wide basis, i.e. through managing the relevant risks of the parent bank and its group entities as a whole.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 6 decisions and other key strategic decision-making processes; and  supporting internal and external communication regarding the AI’s risk appetite or tolerance, risk exposures, and risk-mitigating strategies. 1.3 Scope and coverage 1.3.1 This module sets out key elements of an effective stress￾testing programme and explains the HKMA’s expectations with regard to AIs’ stress-testing practices. Within this context, stress-testing refers not only to the mechanics of applying specific stress tests for risk management purposes, but also to the wider environment within which the tests are developed, evaluated and used to assist in an AI’s decision￾making processes. 1.3.2 This module draws principally on (i) the “Stress testing principles” issued by the Basel Committee on Banking Supervision in October 2018; (ii) the HKMA’s relevant supervisory practices and experience; and (iii) recommendations and observations made by other international organisations and industry groups in respect of the past system-wide banking stresses (such as the 2008/09 Great Financial Crisis and the 2023 banking turmoil in the US and the Europe). These weaknesses, in general, include –  inadequate Board and senior management oversight of the stress-testing process;  under-estimation of the potential severity and duration of stress events;  inadequate account taken of system-wide interactions and feedback effects caused by market reactions to stressed conditions;  insufficient identification and aggregation of risks on a firm-wide basis;  various limitations associated with stress-testing models and methodologies (e.g. inability to change stress scenarios flexibly in response to a rapidly

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 7 evolving environment, breakdown of statistical relationships in times of stress, lack of adverse stress scenarios to test against a range of potential risks on the horizon); and  inadequate coverage of risks arising from complex structured products, accounting treatment in securities portfolio, pipeline or securitization risk, counterparty credit risk, contingent risks and funding liquidity risk (e.g. deposit concentration, deposit flight). 1.3.3 This module should be read in conjunction with other relevant modules of the Supervisory Policy Manual (SPM), e.g. IC-1 “Risk Management Framework”. More specific guidance on the use of stress tests (such as that for the purposes of assessing the adequacy of regulatory capital and liquidity positions, and for the management of specific risk types) is contained in other SPM modules and Code of Practice, including:  CA-G-4 “Validating Risk Rating Systems under the IRB Approaches”;  CA-G-5 “Supervisory Review Process”;  CR-G-1 “General Principles of Credit Risk Management”;  CR-G-3 “Credit Administration, Measurement and Monitoring”;  CR-G-5 “Country Risk Management”;  CR-G-7 “Collateral and Guarantees”;  CR-G-8 “Large Exposures and Risk Concentrations”;  CR-G-12 “Credit Risk Transfer Activities”;  CR-G-13 “Counterparty Credit Risk Management”;  GS-1 “Climate Risk Management”;  IR-1 “Interest Rate Risk in the Banking Book”;  LFIR-1 “Resolution Planning – Liquidity and Funding in Resolution”, the Code of Practice chapter issued under

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 8 the Financial Institutions (Resolution) Ordinance (Cap. 628);  LM-2 “Sound Systems and Controls for Liquidity Risk Management”;  MR-1 “Market Risk Capital Charge”;  OR-1 “Operational Risk Management”;  OR-2 “Operational Resilience”;  RE-1 “Recovery Planning”;  RR-1 “Reputation Risk Management”;  SR-1 “Strategic Risk Management”; and  TA-2 “Foreign Exchange Risk Management”. 1.4 Application 1.4.1 The guidance set out in this module applies to all AIs in a proportionate manner, having regard to their size, structure, business mix and the risks associated with their activities. 1.4.2 AIs with small and simple operations which undertake and pose relatively less risk will not be expected to conduct stress tests that are as sophisticated as those AIs with more complex operations which undertake and pose more risk. Nonetheless, small and less complex AIs should still be able to utilise qualitative assessments to complement sensitivity and scenario analyses of the specific risk types to which they are most exposed, taking into account the interactions between these risks. Large and complex AIs should have the capacity to undertake more extensive and sophisticated stress tests. 1.4.3 AIs incorporated in Hong Kong should apply the stress￾testing guidance in this module both on a legal entity basis and at the consolidated level, covering the AI’s subsidiaries and business activities that pose material risks to it. 3 3 In determining the scope of consolidation, AIs may have regard to the approach currently adopted for capital adequacy and/or liquidity management purposes as deemed appropriate.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 9 1.4.4 For AIs incorporated outside Hong Kong, the guidance applies in respect of their Hong Kong operations. Nevertheless, the HKMA will also have regard to the firm￾wide stress-testing framework of these AIs in its ongoing supervision (see also para. 1.4.5 below). 1.4.5 Where an AI (branch or subsidiary) is part of a banking group operating in multiple jurisdictions with stress tests being centrally managed and conducted at the regional or group level, the HKMA may consider this arrangement acceptable for the purposes of implementing the guidance in this module, provided that:  the stress-testing approach adopted regionally or group-wide is substantially consistent with the guidance in this module;  the stress scenarios appropriately reflect the specific risk characteristics of the AI and its risks and vulnerabilities in the context of local markets, failing which the HKMA will expect the AI to include specific stress scenarios that are appropriate for its Hong Kong operations; and  the AI’s local management can provide the HKMA with a detailed explanation of the stress-testing framework adopted for the Hong Kong operations, along with relevant stress-testing results and any additional information necessary for the HKMA to comprehensively assess the stress impact on the Hong Kong operations. 1.4.6 AIs that require the flexibility mentioned in para. 1.4.5 above should discuss their proposed approach with the HKMA. 1.4.7 The HKMA will monitor AIs’ progress in meeting the relevant requirements of this module in the course of ongoing supervision.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 10 2. Stress-testing programme 2.1 General 2.1.1 A stress-testing programme (which may also be referred to as a stress-testing framework) describes the context in which stress tests are developed, evaluated and used within the decision-making process. A stress-testing programme should include elements such as governance, resources allocation, policies, processes, infrastructure and methodologies which guide and facilitate the implementation, oversight and use of stress-testing activities. 2.1.2 AIs may differ in terms of their risk profiles, risk appetite or tolerance and ability to withstand adverse stress impacts. They are therefore expected to develop and maintain a robust and comprehensive stress-testing programme that is appropriate to the nature, scale and complexity of their business activities and the risks associated with those activities. This section describes key elements that such a programme should comprise. 2.2 Objectives 2.2.1 Stress testing programme should be designed to meet clear objectives which serve as the foundation for establishing the programme’s requirements and expectations. These objectives are crucial for determining the governance structure of the stress-testing programme, defining its scope, establishing the level of engagement of different business lines and support functions, allocating overall resources and budget, as well as selecting the appropriate stress-testing models and methodologies. 2.2.2 The objectives should be clearly defined, documented and approved by the AI’s Board. They should be consistent with the AI’s risk appetite, risk management framework and its overall governance structure, and may relate, for example, to the functions set out in subsection 1.2 above. 2.2.3 The objectives of the stress-testing programme should be clearly understood by the AI’s senior management and the staff responsible for its implementation.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 11 2.3 Process, policies and procedures 2.3.1 AIs should have in place written policies and procedures covering, at a minimum, all material aspects of their stress￾testing programmes. These policies and procedures should be clearly defined, conceptually sound and consistent with an AI’s risk characteristics and business activities and operations, and be regularly reviewed and updated as appropriate. In particular, the following aspects should be covered:  the objectives of the stress-testing programme, the main purpose of each component of the programme, and the types of stress tests covered;  the governance structure for the stress-testing programme, including the roles and responsibilities of relevant parties (e.g. the Board and senior management, business managers, risk and compliance managers, traders, internal auditors, etc.);  the frequency of conducting stress tests, which may vary depending on the type, purpose and scope of stress-testing, the size and complexity of the AI, and changes in the macroeconomic environment;  the methodological details of each component of the stress-testing programme, including the methodologies used for formulation and selection of scenarios, data collection and aggregation, development and validation of stress-test models, as well as the role of expert judgement;  the assumptions and fundamental elements for each stress-testing exercise, including the range and severity of key scenarios;  the procedures governing the review, reporting and challenge of the outcome of stress tests as well as the uses of the test results, including the range of risk￾mitigating measures available, an assessment of the feasibility of such actions under stressed situations, and the decisions to be taken as a result; and

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 12  the independent review and update of the stress￾testing programme to reflect changing circumstances and developments with respect to the AI and the market environment in which it operates. 2.3.2 AIs’ stress-testing policies and procedures, along with any subsequent changes or updates, should be subject to approval by the Board and/or senior management as appropriate, clearly communicated to relevant staff at all levels, and properly documented. 2.3.3 AIs should document the outcome of their stress-testing exercises (including regular and ad-hoc stress tests) and how the test results are used, including management’s decision to take, or not to take, risk-mitigating actions to address the risks and vulnerabilities revealed. The outcome of regular evaluation of the stress-testing assumptions should also be documented. 2.4 Governance, resources and infrastructure 2.4.1 Stress-testing should form an integral part of an AI’s overall governance and risk management framework, and should be actionable in the sense that the stress-testing results should feed into the decision-making process at the appropriate management levels (such as strategic business decisions made by the Board and senior management). Governance structure 2.4.2 A stress-testing programme should be underpinned by an effective governance structure that is clear, comprehensive and properly documented. To ensure thorough and consistent oversight and monitoring of the actions taken at different stages of the stress-testing process, the governance structure should identify all key stakeholders and clearly define their roles and responsibilities, which should cover all aspects of the stress-testing programme (see para. 2.3.1 above for the key aspects). 2.4.3 The governance structure should facilitate effective collaboration and communication among the Board, senior management and technical experts responsible for stress-

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 13 testing. This includes the sharing of information to foster credible discussions and critical evaluations of the selection of stress scenarios, methodologies and assumptions; management response to stress-testing results; as well as the ongoing performance and effectiveness of the stress￾testing programme. Such discussions and evaluations should occur at different stages during the stress-testing process and at multiple levels within the AI. Board and senior management oversight 2.4.4 The Board has ultimate responsibility for an AI’s stress￾testing programme, including the oversight and approval of the programme, whereas senior management should be accountable for the development, implementation and management of the programme, as well as the formulation of risk-mitigating strategies and the use of stress test outputs. 2.4.5 The Board should understand the material aspects of the stress-testing programme. This enables the Board to engage actively in discussions with senior management or experts responsible for the stress-testing, and to evaluate and where necessary, challenge the processes, key assumptions (such as stress scenarios and sensitivities) and stress-testing results, which the Board should do particularly for firm-wide stress tests that inform strategic business decisions which may potentially impact the financial health of the AI4 . 2.4.6 The Board and senior management should discuss the stress-testing results in the context of the AI’s risk profile and the need for any consequent decision-making. They should also ensure that suitable actions are taken to mitigate potential risks, although this does not preclude a conscious and well-justified management decision not to take action on the results. 4 To support the Board in effectively fulfilling these duties, they may delegate the technical aspects to a designated function or a specialised committee. However, the Board should maintain the ultimate responsibility for the oversight and approval of the stress-testing programme.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 14 2.4.7 To facilitate decision-making, the Board and senior management should, where appropriate, be apprised of the limitations of the stress tests (e.g. key underlying assumptions, the extent of judgement used, the likelihood of a stress event occurring, etc.). 2.4.8 The Board and senior management should ensure that the AI actively utilises stress-testing. They are also responsible for providing sufficient resources, staff with relevant skills, knowledge and experience (see para. 2.4.12 below) as well as a robust infrastructure (see paras. 2.4.15 to 2.4.18 below) to support the stress-testing programme. 2.4.9 Senior management should, in monitoring the stress-testing programme, be able to clearly articulate the AI’s risk appetite or tolerance and understand the impact of stress events on its risk profile. To achieve this, it is important that senior management participate in the review and identification of potential stress scenarios and contribute to the development of risk-mitigating strategies. Organisation and resources 2.4.10 AIs should establish a clear and appropriate organisational structure for their stress testing activities, including a sound control environment, adequate segregation of duties, as well as clear accountability and lines of authority. 2.4.11 An AI may employ a centralised approach for its stress￾testing activities, where a central team conducts analyses and communicates with the business lines, or a decentralised approach, where analyses are undertaken by the business lines and then collated and discussed centrally. An AI which adopts a centralised approach is expected to establish proper governance systems to incorporate insights from business lines5 , such as how the AI’s portfolios will be impacted by the stress scenarios. In contrast, an AI that adopts a decentralised approach should establish firm-wide 5 For example, business experts can bring market insights to the stress-testing process and play a vital role in challenging the methods, underlying assumptions and output of the models (both during development and on an ongoing basis). This ensures that the stress test has taken into account practical experiences and is not solely reliant on statistical or hypothetical approaches.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 15 policies, procedures and controls to ensure consistency in the methodologies for translating stress scenarios into impacts that can be aggregated to provide a coherent view of the risks faced by the AI. 2.4.12 AIs should allocate sufficient resources for the development and implementation of stress-testing programme. In the resourcing decision-making process, AIs should take account the fact that stress tests have become increasingly sophisticated over time, necessitating the engagement of specialised staff (see para. 2.4.13 below), as well as the establishment of robust systems and infrastructure (see paras. 2.4.15 to 2.4.18 below). 2.4.13 The stress-testing process may involve the collaboration among various experts, such as risk managers, financial controllers, economists, business managers and/or traders, as appropriate, to identify relevant stress events, apply sound modelling approaches, and ensure the appropriate use of stress-testing results. In this regard, AI should ensure that: • competent functions and personnel are engaged in a given stress-testing exercise, taking into account the objectives and nature of the stress-test (e.g. firm-wide or more targeted), as well as the AI’s own specific structure; and • the staff responsible for executing the stress-testing programme possess suitable skill set6 , with appropriate recruitment and training programmes in place to support the development of staff expertise. 2.4.14 If an AI engages third-party service providers 7 to supplement internal resources for stress-testing exercise, the AI should ensure that it has put in place adequate 6 The set of skills typically required for stress-testing includes, but not limited to, expertise in liquidity risk, credit risk, market risk, operational risk, capital rules, financial accounting, modelling and project management. Furthermore, it is essential for an AI to possess talent with specialised knowledge in stress-testing for new and emerging risks (e.g. climate-related risks, cryptoasset exposures, cyber risks, etc.) to address the evolving risk landscape. 7 For the purpose of this SPM module, third-party service provider refers to any entity or individual that performs services, activities, functions, processes or tasks directly for the AI, including intragroup service provider.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 16 policies, procedures and controls for sound third-party risk management, including appropriate due diligence and oversight of the service providers’ performance8 . Systems and Infrastructure 2.4.15 There should be adequate and robust information systems and infrastructure in place to support an AI’s stress-testing programme, enabling the accommodation of different stress tests and any subsequent changes to these tests on a continuing basis. 2.4.16 The infrastructure should be suitably flexible, and the information systems should be capable of retrieving, processing, aggregating and reporting data9 of appropriate quality and granularity on a timely basis, to allow for:  targeted or ad hoc stress tests (e.g. those arising from on-demand requests) to be conducted at various levels (e.g. at the portfolio, business line or firm-wide level) to assess specific risks, particularly in times of stress;  customised or new stress-testing methodologies, scenarios or data sets to be used;  comparable risks and exposures (e.g. to a given risk factor, product or counterparty) to be aggregated across the AI and the banking group (see para. 2.9.3); and  participation in HKMA’s supervisory stress tests as and when required (see subsection 3.2 below). 2.4.17 Regarding the use of data in stress-testing, an AI should ensure that:  data used by the AI is accurate, complete and sufficiently granular (also see para. 2.7.5); 8 Please refer to SPM module SA-2 “Outsourcing” for more guidance. 9 Please refer to section 5 of SPM module IC-1 “Risk Management Framework” for more guidance in relation to risk data aggregation and risk reporting.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 17  data sources, processing and aggregation across its stress tests are consistent;  data produced by the AI is coherent with its overall risk management framework; and  historical data relevant to the stress-testing programme are collected, quality-assured and maintained, and the AI can accurately integrate data associated with mergers and acquisitions into its historical data set. 2.4.18 An AI should establish controls and processes for monitoring its systems and infrastructure, and address any deficiencies identified in a timely manner. 2.5 Risk identification 2.5.1 Stress-testing programme should involve a sound risk identification process which captures all material and relevant risks of an AI10 . This process should include a comprehensive assessment of risks, taking into account on￾and off-balance sheet exposures, contingent and non￾contingent commitments, earnings vulnerabilities, operational risks, and any other risk factors that could affect the solvency or liquidity position of the AI (see Annex for examples of common risk factors for reference). 2.5.2 An AI should evaluate the risk characteristics of its exposures and related entities, and analyse the relevant risk factors as well as the correlation (and potential for change in correlation) and interaction between these factors in its risk identification process11 . 2.5.3 When assessing the relationships between different risk factors, an AI may employ a range of methods, spanning 10 Depending on the AI’s business activities and risk profile, these risks will likely encompass the eight inherent risks covered under the HKMA’s risk-based supervisory framework (viz. credit, market, liquidity, interest rate, strategic, operational, legal and reputation risks), and may include risks related to digitalisation, climate￾related financial risks and other emerging risks. 11 AIs should identify and assess possible linkages across different markets and risks under stressed conditions, such as the potentially strong interaction between asset and funding markets, the impact of a reduction in market liquidity on the valuation of exposures, and the contagion from distressed banks to the banking system across multiple jurisdictions during periods of severe stress (such as those revealed in the 2008/09 Great Financial Crisis and 2023 banking turmoil in the US and Europe).

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 18 from complex financial models (e.g. pricing or statistical models) to less sophisticated means (e.g. qualitative judgement based on experience or assessment by senior management and technical experts). The selected method should be commensurate with the nature of the AI’s portfolios and risks involved, taking into account all relevant risk factors and stress scenarios, and with the results subsequently incorporated into the risk management process (see subsections 2.6 and 2.7 below for further guidance on stress test models and stress scenarios). 2.6 Stress-testing approaches, models and methodologies General approach 2.6.1 AIs are expected to conduct stress tests at firm-wide levels (solo and consolidated levels where applicable) and, depending on their own needs and in a manner consistent with the objectives (see subsection 2.2 above), also at product-, portfolio-, business- or entity-specific levels. 2.6.2 Where an AI is part of a larger banking group, its stress￾testing approaches should, to the extent possible, align with those of other group members12, and should account for the potential spill-over effects and interdependence among members of the group. 13 2.6.3 For firm-wide level stress tests, particular attention should be paid to risk concentrations. An AI’s strategic orientation and the prevailing economic environment should be taken into consideration when defining the scope and scenarios of the stress test. 2.6.4 AIs should determine the appropriate time horizon for their stress tests. The time horizon may vary, depending on the risk characteristics of the exposures being analysed and the 12 While AIs may tailor certain elements of their stress-testing approaches to reflect jurisdiction‑specific risks, regulatory requirements, or business models, they should ensure that such adjustments do not compromise the overall coherence of the group’s stress‑testing programme. 13 For example, an AI may be compelled, although not legally obliged, to provide financial support to an affiliated insurance company in distress out of reputational concerns and to maintain market confidence in the group of which both institutions are members.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 19 purposes (e.g. for risk management, strategic or tactical use) of the tests. 2.6.5 For stress tests conducted for risk management purposes, relevant considerations include the risk management horizon of the target portfolio, the liquidity horizon of the underlying exposures, and the potential change in liquidity conditions under stressed scenarios. 2.6.6 AIs should also assess the impact of recession-type scenarios in considering the time horizon, as well as their ability to react over a medium to long term horizon. However, as the time horizon of stress tests is lengthened, AIs should note the increased importance of the validity of underlying assumptions, and the greater need to incorporate feedback effects and firm-specific and market-wide reactions into such stress tests. 2.6.7 Generally, stress tests should be conducted at regular intervals under a defined schedule, except for ad hoc stress tests which serve for specific purposes (see para. 2.6.8 below). In determining the frequency of conducting a particular stress test, AI should consider the nature of the risks involved and the purpose of such stress test. Stress scenarios should be coherently developed to ensure that inherently linked risks (e.g. market risk and credit risk) can be assessed together across portfolios and over time. AIs may refer to other SPM modules (see para. 1.3.3 above) for any available guidance on stress-testing for specific risks, where applicable. 2.6.8 AIs should conduct ad hoc stress tests on specific areas whenever this is warranted under special circumstances. For example, in the light of rapidly deteriorating economic or political conditions in a jurisdiction, or when stress assumptions (such as those related to historical relationships of risk factors or market behaviours) are no longer valid and new risks or vulnerabilities emerge, an AI must be able to make a quick assessment of the likely impacts on its exposures and financial strength. 2.6.9 AIs should employ a diverse range of models, methodologies and perspectives to achieve comprehensive coverage within their stress-testing programme, ranging

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 20 from sensitivity tests to more complex scenario analyses (including firm-wide stress scenarios) and reverse stress￾testing. AIs should use both quantitative and qualitative techniques to support and complement the use of models or other risk management approaches, and the extension of stress-testing to areas where a greater degree of expert judgement is called for. AIs should adopt those methodologies that are best suited to, and commensurate with, the nature, scale and complexity of their business activities, as well as the associated risks14 . 2.6.10 AIs should regularly review and assess the appropriateness of their stress-testing programmes and methodologies, and evaluate whether adjustments are needed in light of changes in the AIs’ risk profile or in market conditions, taking into account the validity of assumptions used. Stress test models 2.6.11 Stress test model refers to the tool built for the purpose of producing projections for a financial system, sector, institution, portfolio or product, under stress or different scenarios, and under other analytical assumptions. Stress test model encompasses all quantitative processes, methods and tools describing relationships and dynamics of the covered economic and financial variables15 . 2.6.12 The models and methodologies used by AIs to assess stress estimates and impacts should fit the purpose and intended use of the stress tests. In this regard, AIs should ensure that:  the development of appropriate models for stress￾testing is guided by the mix of AI’s business lines, its strategy, the risk characteristics of its activities and exposures, as well as the objectives of the stress￾testing programme; 14 An AI should consider the scope, complexity, target risk types and objectives of each specific stress test when determining the appropriate procedures and resources to apply. 15 The requirements outlined in para. 2.6.11 to 2.6.18 pertain to the underlying logic of the predictive model used for stress-testing purpose. Regarding the systems and technologies that support the implementation of the model, please refer to the requirements outlined in para. 2.4.15 to 2.4.18.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 21  the coverage, segmentation and granularity of the data and types of risks are adequately defined at the modelling stage, in line with the objectives of the stress-testing programme;  the level of sophistication of the models is appropriate for both the objectives of the stress-testing framework, and the type and materiality of the portfolios being monitored using the models; and  at a minimum, all material aspects of the models and methodologies, including performance testing and validation results, are properly documented, maintained and made available to the senior management and relevant internal and external stakeholders, including the HKMA as and when required (also see para. 2.6.15 below). 2.6.13 The development of stress test models requires the collaboration of different experts, which is particularly important for firm-wide stress-testing to ensure the inclusion of all material and relevant risks, as well as a sound aggregation of results. Model developers should engage with relevant stakeholders (see para. 2.4.13 above) to gain insights into the risks being modelled and to identify the objectives, business drivers, risk factors (e.g. based on the type of market, product or portfolio, and the nature and materiality of risk exposures), and other relevant information, taking into account the objectives of the stress￾testing programme. 2.6.14 The modelling choices and calibration decisions should take into account the interactions between different risk types and the linkages among models where applicable. Dynamic interactions and feedback effects between capital and liquidity stresses also require careful consideration. Examples of the interconnections between capital and liquidity stresses include:  inability to meet short-term obligations which forces an AI to sell assets at fire sale price, resulting in losses that erode capital;

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 22  a deterioration in an AI’s capital position which leads to a downgrade in its credit rating, thereby compromising the AI’s ability to issue debt or access to funding markets (including central bank liquidity facilities);  an increase in non-performing loans that reduces expected inflows from debt payments; and  a higher funding cost which reduces an AI’s profitability. 2.6.15 AIs should maintain a firm-wide model inventory which captures comprehensive information on all stress test models that are implemented for use, under development for implementation, or recently retired. A designated party should be assigned responsibility for maintaining the accuracy and completeness of the model inventory. 2.6.16 AIs should regularly (at least annually) validate and review the performance of their models and assess whether any adjustments to model components are necessary to ensure that the results generated are reasonable and adequately sensitive to stress conditions. An independent model validation function should be established, comprising personnel of the AI who are adequately qualified and are independent of the AI’s staff or management responsible for designing and implementing the models, to review the performance and conceptual soundness of the models (also see subsection 2.10 below). Where appropriate, AIs may engage a qualified independent third party for this purpose. 2.6.17 During the process of evaluating the model’s performance, AIs should, if applicable, conduct out-of-sample testing (i.e. testing based on a separate dataset which is not used during model development or training) to assess the model’s predictive accuracy and reliability under unseen adverse conditions. 2.6.18 AIs should apply a sufficient degree of conservatism as appropriate to account for uncertainty and potential risks associated with the modelling assumptions.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 23 Sensitivity tests and scenario analyses 2.6.19 A sensitivity test estimates the impact on the value of a portfolio of exposures of assumed movements in a single risk factor or a small number of closely related risk factors (e.g. a parallel yield curve shift). In most cases, sensitivity tests involve changing inputs or parameters without relating those changes to an underlying event or real-world outcome.16 While it is helpful to draw on extreme values from historical periods of stress, sensitivity tests should also include hypothetical extreme values to ensure that a wide range of possibilities is included. Moreover, AIs should be aware of the limitation of sensitivity tests in reflecting the risks arising from transactions with non-linear, kinked, or cliff-like features. If inappropriate stress parameters are adopted, test results will be unable to fully reveal the sharply changing risk sensitivities of such transactions. An adequate understanding of the risk characteristics of transactions is therefore important for the appropriate design of sensitivity tests. 2.6.20 A scenario analysis measures the impact on an AI of a simulation of forward-looking stress scenarios that affect a number of risk factors (e.g. adverse movements in equity prices, foreign exchange rates and interest rates) together. The stress scenarios can be based on historical or hypothetical events that are, where applicable, economic, financial, operational, legal or connected to any other risks with potential impact on the AI (see subsection 2.7 and Annex below). 2.6.21 While a sensitivity test highlights the influence of specific risk factors on a portfolio of exposures (or business lines or products), a scenario analysis evaluates the potential combined and interactive effects of the change in all the risk factors encompassed in the stress test (particularly if that interaction is complex and not intuitively clear). Scenario analysis is therefore more often used for generating stress results on a firm-wide basis. Both sensitivity test and 16 For example, a sensitivity test may explore the impact of varying declines in property prices (e.g. 10%, 20%, 30%).

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 24 scenario analysis should be used to serve distinct yet complementary purposes and reflect a variety of perspectives at both individual portfolio and firm-wide levels to provide a comprehensive risk assessment. 2.6.22 Sensitivity tests and scenario analyses can help validate whether certain quantitative approaches and models adopted by an AI are working as originally intended. For example, an AI may run a series of such analyses of varying severity to test whether the assumption of a linear relationship between changes in a risk factor and the resultant impacts on the capital position as well as the long￾term business plan of the AI holds true. Reverse stress-testing 2.6.23 Stress tests should encompass a range of severities, covering the most critical business areas across an AI and the events that have the potential to cause the most significant damage, whether financial or reputational. A comprehensive stress-testing programme should therefore include the regular use of reverse stress-testing to identify events that could potentially threaten the viability or solvency of the AI. 2.6.24 Reverse stress test is a valuable tool for understanding the underlying risks and vulnerabilities in an AI’s business and products that could compromise its viability, and for identifying scenarios that could potentially threaten its resilience. Reverse stress tests start from a known stress￾testing outcome (such as a breach of regulatory capital ratios, illiquidity or insolvency) and then work backwards to identify the possible scenarios that could lead to such an outcome for an AI. 2.6.25 There is no single “correct” way for AIs to develop reverse stress scenarios, which may vary depending on AIs’ own business models and risk drivers. For illustrative purposes, an AI may consider adopting the following steps: • defining specific trigger points that could threaten the AI’s viability or solvency. Such trigger points may involve situations in which (i) the AI’s capital or liquidity positions fall below the respective minimum regulatory

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 25 standards; (ii) certain indicators are hit reflecting a loss of confidence by the AI’s major counterparties (e.g. access to wholesale funding markets denied) or by depositors (e.g. deposit run-off rates reach a significant level); or (iii) the AI is unable to repay its debt obligations. Some of the trigger points (re item (ii) above) may render the AI unviable (e.g. due to illiquidity resulting from a substantial and rapid deposit run) before it becomes insolvent; • “reverse-engineering” the trigger points to identify what adverse but plausible events, financial or non-financial, either individually or in combination, could have brought the AI to those trigger points notwithstanding existing management actions that can be deployed. That is, for reverse stress-testing purposes, an AI is to devise a stress scenario under which existing systems and controls (e.g. established risk limits and controls, collateralisation of exposures, etc.) are not able to prevent the AI from reaching the trigger point(s) so as to facilitate the AI’s analysis of the risks and vulnerabilities revealed by the reverse stress tests and determination of additional credible remedial actions to address them (e.g. by revising its business strategy towards a particular sector); and • constructing the stress scenarios that would give rise to the events. 2.6.26 AIs should note that the development of reverse stress scenarios is an iterative process involving a mix of qualitative and quantitative analyses for identifying the causes, consequences and impacts under the various scenarios. During the process, AIs should take account of possible correlations between different trigger points and their associated risk factors and second-round effects.17 17 As a hypothetical example, an AI with materially large and concentrated exposures to exporters in a specific market (e.g. a particular jurisdiction or region) might assess that the default of the AI’s top five corporate customers would erode its profitability and capital to such an extent that its business would become unviable, and then (i) work backwards to identify what circumstances could possibly cause this risk to materialise; and (ii) construct a scenario that could create those circumstances (e.g. economic downturn of the concerned

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 26 2.6.27 A reverse stress test allows for the consideration of scenarios that go beyond normal business settings or that lead to events with contagion risk or systemic implications. It can supplement quantitative models which are based on historical data and known experiences in the identification of “tail” risks, 18 and help uncover hidden vulnerabilities and interactions among risks relevant to an AI. 2.6.28 A well-designed reverse stress test should also include sufficient diagnostic support to allow for further investigations into the sources of potential failure, enabling proactive risk assessment and implementation of an appropriate strategy for risk monitoring, prevention and mitigation.19 2.6.29 AIs should utilise reverse stress test results to comprehend the viability and sustainability of their business models. For instance, reverse stress tests are particularly useful for assessing the risks in specific areas, including (i) business lines where traditional risk management models indicate an exceptionally favourable risk/return trade-off; (ii) new products and new markets which have not experienced severe strains; and (iii) exposures characterised by the absence of liquid two-way markets. 2.6.30 In assessing AIs’ reverse stress tests, the HKMA will take into account the principle of proportionality (re para. 1.4.1), the latest development and availability of reverse stress￾testing techniques, the objectives and scope of the stress test, and the practical usefulness of reverse stress-testing for the area being assessed. In general, the mix of qualitative analyses and quantitative analyses may vary in jurisdiction or region leading to currency depreciation due to loss of confidence, plummeting demand and weakened financial positions of numerous buyers in those markets), incorporating potential correlations and second-round effects as appropriate (e.g. heightened currency risk for the AI and its corporate clients, heightened liquidity risk for the AI due to potential increased concern on the part of its counterparties, the spillover effects of any crisis to the local economy and other markets, etc.). 18 As revealed from the 2008/09 Great Financial Crisis, it was common for financial institutions to under￾estimate the duration and severity of a crisis in their stress-testing exercises. 19 For example, if an AI has large exposures to complex structured credit products, it should critically evaluate whether such exposures may lead to substantial losses under a severe stress scenario, and if so, the AI needs to re-assess the suitability or viability of having such levels of exposure to such products, and conduct further analysis of the robustness of its risk-hedging strategy amid a stressed market environment.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 27 relation to the size, structure, business mix and the risks associated with their activities. Thus it will be acceptable for smaller and less complex AIs to develop reverse stress tests that focus more on qualitative analyses, while those for larger and more complex AIs should include more quantitative elements alongside the qualitative analyses. Expert judgement 2.6.31 Assumptions and overlays within a model or methodology, as well as qualitative judgement and perspectives from relevant experts (such as risk controllers, economists, business managers and traders), can provide important input to the stress-testing programme. Expert judgement can supplement the mechanical analysis performed by models, assess the impact of extreme events which are difficult to model statistically (because by definition they occur very rarely), minimise the risk of “silo” effects (e.g. crucial information being compartmentalised within individual business units and not being shared with other relevant units), and analyse and respond to fast changing market conditions. 2.6.32 AI should ensure that the expert judgements are properly justified, documented and subject to credible challenge, including regular independent review (also see subsection 2.10 below). 2.7 Design and setting of stress scenarios General approach 2.7.1 An effective stress-testing programme should comprise a range of scenarios that span a spectrum of events capturing all material and relevant risks associated with an AI, and the interactions among such risks (see subsection 2.5 above for the risk identification process). The scenarios should be tailored to the AI’s specific businesses and vulnerabilities, accompanied by a narrative that explains how the scenario captures the associated risks. Any exclusions of material and relevant risks should be well justified and documented. The design process of stress scenarios should be

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 28 transparent to both internal stakeholders and relevant external stakeholders, including the HKMA. 2.7.2 Stress scenarios should be designed to evaluate an AI’s financial position under severe but plausible conditions along a spectrum of events and severity levels, covering idiosyncratic risks and systemic risks. In this regard, AI should, to the extent possible, develop and apply a range of stress scenarios in its stress tests, including idiosyncratic and market-wide scenarios, as well as a combination of both, taking into account the objectives of the stress tests and the specific circumstances of the AI. 2.7.3 The stress scenarios should be subject to discussion and debate among experts and senior management within an AI, so as to leverage their collective knowledge, expertise and judgement in the scenario design process. Risk coverage and impact measurement 2.7.4 In designing and developing stress scenarios, AI should ensure that:  the characteristic of each scenario (such as the level of stress 20 and the types of risks that are taken into account) are carefully determined so that they reflect the AI’s risk appetite and objectives;  key variables within the same scenario are internally consistent;  the stress scenarios are forward-looking, accounting for changes in an AI (e.g. in respect of risk profile, products and activities) and in the markets in which it operates, including the macroeconomic and financial environment. Stress scenarios should also incorporate an element of “imagination” (e.g. thinking outside of the box) in order to better identify hidden vulnerabilities;  appropriate assumptions are determined for stress￾testing various risk factors in a particular scenario and 20 In determining the level of stress to be applied to the stress scenarios, AIs should have regard to their “baseline” assessment of the normal or expected course of development. The range of scenarios should, in principle, reflect an increasing level of stress compared with the “baseline” situation.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 29 estimating the resultant impact on AI’s financial strength;  a range of appropriate methodologies are used to quantify the stress impacts 21 , ranging from, for instance, point-in-time static approaches to more sophisticated dynamic simulations that reflect future business activities and management actions;  the stress scenarios provide insight into the firm-wide impact of severe stress events on an AI’s financial resources (including capital and liquidity), allow for an assessment of the AI’s ability to react to such events, and produce useful results to inform decision-making at relevant levels of the AI. In determining the firm￾wide impact of a particular type of risk or activity, AIs may aggregate the stress-testing results performed across their business lines or units, making prudent and conservative allowances for possible correlations among the risk factors and diversification effects between the exposures being examined22;  the potential effect of reputation risk on other risk types (such as credit, liquidity and market risks) have been considered; and  the risks arising from on- and off-balance sheet exposures and contingent and non-contingent commitments, including commitments to off-balance sheet vehicles (e.g. structured investment vehicles) and other related entities, and the size and soundness of such vehicles relative to the AI’s own financial, liquidity and regulatory capital positions, have been 21 The impact of stress tests is usually evaluated against one or more measures, depending on the specific purpose of the test, and the risk exposures and particular issues being analysed. A range of measures may be needed to provide comprehensive perspectives on identified vulnerabilities and the impact of the stress scenarios. Typical measures include (i) asset values; (ii) accounting profit or loss; (iii) economic profit or loss; (iv) regulatory capital requirements (e.g. capital adequacy ratios or risk-weighted assets); (v) regulatory liquidity requirements; (vi) economic capital measures; and (vii) liquidity and funding gaps. 22 AIs should treat the aggregation of stress-testing results of individual business lines with a degree of caution and prudence, as simple aggregation may not adequately or accurately capture correlations of risks, offsetting effects of individual exposures, and risk concentrations, resulting in double-counting of risks or under-estimation of the stress impact.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 30 duly assessed and integrated into the stress scenarios. The structural, solvency, liquidity and other risk issues (e.g. the effects of covenants and triggers) have been considered in the assessment. 2.7.5 The effects of shocks across different risks should be examined at a level of granularity appropriate to the objective of the stress test, taking into account inter￾relationships among the various risks and the contagion effect from distressed banks, non-bank financial institutions (NBFI) and other relevant industries to the banking system across multiple jurisdictions, where applicable. Historical and hypothetical scenarios 2.7.6 Historical events and hypothetical future events that take into account new information and emerging risks in the present and foreseeable future should, to the extent relevant and feasible, be considered in the development process of stress scenarios. Scenarios not based on historical events or empirically observed relationships may be warranted for some or all risks, particularly when new or heightened vulnerabilities are identified or if historical data lack a severe crisis episode23 (see Annex below for examples of stress scenarios). 2.7.7 Where applicable, the results of reverse stress tests (which may provide complementary information about the AI’s vulnerabilities and help assess the sensitivity of the AI’s financial position based on different stress calibrations) should be used in identifying adverse circumstances and events (see paras. 2.6.23 to 2.6.30). 2.8 Use of stress-testing results and risk-mitigating strategies 2.8.1 AIs should ensure that the stress-testing results, and any other relevant findings, are effectively used in accordance with the objectives, policies and procedures of the stress￾23 For example, in the context of climate risks, events that appear to be extreme and unlikely (based on historical data) may occur with increasing frequency and/or severity in unpredictable ways. As a result, the impact of climate risks could be greater than historical observations. To address this, AI should incorporate plausible future states of the world and potential real-world events into the stress scenarios to quantify the “tail” risk of extreme climate events.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 31 testing programme. The Board, senior management and relevant business managers should be regularly informed of the results of stress tests at an appropriate level of aggregation (also see para. 2.4.16 and 2.9.3). Their attention should be drawn to the potential risks and vulnerabilities identified, along with recommendations for appropriate courses of management action. Report of stress-testing results should include the key assumptions and limitations (such as scenario relevance, risk coverage and model assumptions) to facilitate the understanding of the stress-testing results among the Board, senior management and other relevant stakeholders. AIs should inform the HKMA (or relevant banking supervisors in other jurisdictions) the results and anticipated actions as appropriate or necessary24 . 2.8.2 AI should take into account the stress-testing results in its setting of risk appetite and risk limits. Moreover, AI should, where applicable, use stress-testing results to evaluate the effectiveness of its business strategies (existing and new) and their impact on the AI’s management of capital and liquidity (also see subsection 1.2 above). 2.8.3 AIs should be guided by a clear set of pre-agreed strategies or principles in determining how to respond to stress-testing results, based on careful analysis and thorough discussion of the results by the Board or senior management as appropriate, and an assessment of the potential impact of the decision (to act or not to act). In this regard, the factors for consideration may include (i) the risk appetite and tolerance of the AI; (ii) the strength of its capital, liquidity and financial positions; (iii) the robustness of its risk prevention, detection and mitigation measures; (iv) applicable supervisory requirements; (v) assumptions regarding the stress scenarios and management actions; and (vi) potential 24 AIs should ensure that they comply with all applicable notification requirements in respect of their stress￾testing results. For example, if an AI’s stress-testing exercise reveals material vulnerabilities, such as an indication of likely breach of recovery triggers or supervisory limits due to substantial losses or significant deposit outflow, the AI is obliged to notify the MA in accordance with the applicable legal and regulatory requirements.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 32 effects on the AI’s reputation among its counterparties and investors. 2.8.4 AIs are expected to establish appropriate management action triggers (e.g. in terms of the results of pre-defined stress scenarios) to inform the decision of when to pursue management actions. 2.8.5 Credible risk-mitigating measures and contingency plans should be developed across a range of stressed conditions. The expected effectiveness of such actions (see para. 2.8.7 below for examples), especially under stressed conditions when markets may not be fully functioning and multiple institutions could be simultaneously pursuing similar risk￾mitigating strategies, should be challenged and assessed systematically. The implications of taking different management actions at different times should be properly assessed and understood. 2.8.6 The level of authority for determining the appropriate course of management action should be clearly designated and documented. Once the course of action has been decided, the individual members of senior management to whom the relevant responsibilities have been assigned should ensure that the selected actions are implemented as soon as practicable, with progress reported regularly to the Board or the relevant Board committee of the AI. AIs should provide adequate justification and documentation for the management actions taken in response to stress-testing results (including the risk-mitigating measures taken or not taken). 2.8.7 The types of management action to be taken by AIs will vary, depending on the magnitude and likelihood of the potential stress events. The management actions should be proportionate to the severity of the impact of the stress test and the overall risk management framework, based on reasonable assumptions 25 , and consistent with other relevant internal policies and processes (e.g. ICAAP, 25 The assumptions of benefits of management actions should not be overly optimistic. Extra scrutiny should be made to the management actions that may significantly affect the AI’s longer term viability (e.g. substantial business disposal).

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 33 liquidity risk management policy and recovery plan). These actions may generally include:  restructuring, liquidating, unwinding or hedging a position;  seeking collateral, buying credit protection or reducing risk exposures to specific sectors, jurisdictions, regions or portfolios;  tightening underwriting requirements, and reviewing and adjusting exposure limits, business strategies or bank policies (including those relating to funding or capital adequacy) to constrain risk-taking;  shrinking the balance sheet, adjusting the asset or liability structure or restricting profit distribution (e.g. reducing dividend payout) to conserve capital or liquidity;  disposing a part and/or the whole of a portfolio, business line or a subsidiary;  building up an additional buffer of capital or liquidity to cope with the potential impact of stressed conditions;  amending pricing policies (e.g. on interest spread or margin income) to reflect previously unidentified risks;  preparing for a liquidity squeeze under stressed situations by increasing credit lines and funding sources and managing the liability structure to ensure adequate funding during a crisis; or  implementing contingency plans. 2.9 Interpretation and communication of stress-testing results 2.9.1 Stress-testing plays a crucial role in communicating risk exposure within an AI, as plausible forward-looking scenarios are more easily grasped than purely statistical models, thereby assisting in the assessment of vulnerabilities as well as the adequacy and effectiveness of the AI’s risk management framework. Stress-testing provides valuable insights to support the decision-making processes of the Board and senior management and the

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 34 external communication with supervisors (e.g. with respect to internal assessment of the adequacy of regulatory capital or liquidity positions). 2.9.2 AIs should however be aware of the limitations when interpreting the results of stress tests. Stress-testing estimates the exposure to a specified stress event or scenario but does not provide the probability of such an event or scenario occurring. Moreover, stress-testing is influenced by the judgement and experience of the experts designing the stress tests. The effectiveness of stress￾testing therefore depends in particular on whether an AI has chosen the “right” scenarios for stress-testing, interpreted the results properly and taken the necessary steps to address the results. 2.9.3 For an AI that is part of a larger banking group, it should put in place processes to facilitate, to the extent legally permissible and practical, regular coordination and communication of stress testing practices and findings between the AI and other group entities (particularly subsidiaries and business activities that present material risks to the AI), whether they are located within or outside Hong Kong. In particular, the banking group should be able to aggregate and report stress-testing results across different group entities in a consistent manner. 2.9.4 AIs are required to comply with the disclosure obligations under the Banking (Disclosure) Rules (BDR) and refer to the applicable standard templates and tables specified by the MA under BDR and SPM module CA-D-1 on “Guideline on the Application of the Banking (Disclosure) Rules” for the minimum disclosure requirements of stress-testing information. AIs are encouraged to make more extensive voluntary disclosures (such as additional quantitative and qualitative information of their stress-testing results), where it is practical for them to do so, to provide market participants a better understanding of the AIs’ risk positions and promote market discipline. When disclosing stress-testing results, AIs should ensure that adequate relevant supporting information (such as the stress-testing objectives and framework, major stress-testing limitations, underlying assumptions, methodologies used and an evaluation of the

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 35 impact of the stress tests) is provided with a view to ensuring an informed and accurate interpretation of the stress-testing results by third parties. 2.10 Independent review of stress-testing programme 2.10.1 AIs should regularly review and assess the continued effectiveness and robustness of their stress-testing programme (including major individual components) qualitatively and quantitatively. Such reviews should be undertaken at least once a year, or more frequently if warranted by significant changes in the business strategies and risk characteristics of the AI or in the external environment in which it operates. The independent review may be conducted by personnel of the AI or a third-party who are adequately qualified and are independent26 of the AI’s staff or management responsible for designing and conducting the stress tests. 2.10.2 The review should be comprehensive and should cover at least the following:  the effectiveness of the stress-testing programme in meeting its intended objectives;  the adequacy of management oversight;  the adequacy of policies, procedures, controls and documentation for the programme;  the integration of stress-testing into daily risk management and decision-making processes at appropriate management levels, as well as capital and liquidity planning;  the approval process for the programme; 26 Staff who are not involved in the design and execution of stress tests (e.g. an independent unit within the risk management function or other appropriate independent functions) may be tasked with conducting an independent review of the stress-testing programme. However, it is also expected that the internal auditors or external auditors (in cases where internal audit activities are partially or fully outsourced) will undertake a separate and independent review of the stress-testing programme and its implementation (including the work performed by the risk management function or other relevant functions) on a regular basis. Please refer to SPM module IC-2 “Internal Audit Function” for further guidance.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 36  the implementation of the programme as well as subsequent authorization for, and implementation of, significant changes or development work (e.g. to take account of changes in an AI’s business strategies, risk characteristics or external environment);  the scope of exposures captured by the stress tests;  the performance and conceptual soundness (including developmental evidence) of the stress test models, and the appropriateness of methodologies, scenarios and assumptions;  the reasonableness of the estimations of stressed losses, revenue, capital and the assumptions for cash flow projection;  the quality of data sources used to run the stress tests (e.g. in terms of accuracy, consistency, timeliness, completeness and reliability);  the integrity of management information and reporting systems for the stress tests;  the validation of stress-testing results, such as through back-testing historical scenarios (e.g. the 2023 banking turmoil in the US and Europe, 2008/09 Great Financial Crisis and the 1997 Asian Financial Crisis) and their impact on an AI’s portfolios, an analysis of the sensitivity of the stress-testing results to the assumptions, or benchmarking with other stress tests conducted within and outside the AI; and  an assessment of whether the stress-testing results are being used in a way that is consistent with the objectives, policies and procedures of the stress￾testing programme. 2.10.3 AIs should adequately address any issues or weaknesses revealed from the review. Any consequential changes to the stress-testing programme should be duly approved and documented.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 37 3. Supervisory assessment of stress-testing practices 3.1 General 3.1.1 Stress tests, if properly designed and implemented, can significantly enhance an AI’s risk management capability and decision-making process, ultimately enabling the AI to better prepare for challenging market conditions. While stress-testing alone cannot address all risk management issues, it is a crucial component of a comprehensive risk management framework, playing a key role in strengthening risk governance and thereby fortifying the resilience of individual AIs and the overall stability of the Hong Kong banking system. 3.1.2 AIs are expected to integrate stress-testing into their risk governance and management processes and conduct stress tests on a regular basis. Given the varying risk characteristics and risk management capabilities of individual AIs, there is no “one-size-fits-all” stress-testing programme that can be universally applied to all AIs. Furthermore, stress-testing may be conducted for diverse purposes and may be based on a range of techniques. Consequently, AIs should develop and maintain a comprehensive stress-testing programme that properly reflects their specific risk profiles and is commensurate with the nature, scale and complexity of their business activities and the associated risks. 3.2 Assessment approach 3.2.1 The HKMA will regularly evaluate the appropriateness and effectiveness of AIs’ stress-testing programmes and their alignment with the guidance in this module during its off-site reviews or on-site examinations, having regard to the following:  the nature, scale and complexity of an AI’s business activities and the risks associated with those activities;  the appropriateness of the AI’s stress tests (e.g. in terms of the objectives, scope and the types of stress scenarios and parameters chosen) in relation to its risk appetite or tolerance, overall risk profile and business

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 38 plan, and the effectiveness of the stress tests in identifying relevant vulnerabilities on a firm-wide basis;  the appropriateness of the assumptions used in the stress-testing models and methodologies, taking into account existing and potentially changing conditions in respect of the AI and its operating environment;  the capacity of the AI’s financial resources (including capital and liquidity) to absorb potential losses under stressed situations;  the integration of stress-testing into the AI’s overall governance and risk management culture, its capital and liquidity risk management framework, strategic decision making, as well as resolution and recovery planning;  the adequacy of resources, infrastructure and established procedures to support the stress-testing programme;  the use of stress-testing results and how the results impact decision-making at different management levels, including strategic business decisions at the Board and senior management level;  the adequacy, feasibility and credibility of the AI’s risk￾mitigating strategies and contingency planning for actions to be taken should a particular stress scenario happen, taking into account the extent to which management actions may be restrained under stressed situations;  the level of oversight exercised by, and the involvement of, the Board and senior management in the stress-testing programme; and  the adequacy of the AI’s internal review and audit of the stress-testing programme and its implementation. 3.2.2 The HKMA may request AIs to submit for its review regularly, and whenever necessary, the results of their firm-wide stress tests or other specific stress tests (including any actions taken in response to the results generated and the supporting analyses and justifications for the actions taken).

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 39 In reviewing and interpreting individual AIs’ submissions, the HKMA will be mindful of the need to take into account the specific objectives and circumstances that guided the design of their stress-testing programmes. 3.2.3 In order to arrive at a comprehensive assessment of an AI’s stress-testing programme and its implementation, the HKMA will, where necessary, engage in discussion with the Board and/or senior management, particularly in respect of the following:  their views on major macroeconomic and financial market vulnerabilities and relevant threats specific to the AI’s operation and business model; and  their justifications for various aspects of the stress￾testing programme, and the models and methodologies employed (such as the key assumptions driving the stress-testing results, the scope and severity of the scenarios used, governance structure and how the stress-testing results are in practice being used). In its assessment, the HKMA will pay particular attention to situations where the impact of stress tests seems unrealistically low or where mitigating actions appear unrealistic. 3.2.4 The HKMA may also request an AI to conduct additional sensitivity analysis in respect of specific business lines, portfolios or positions which pose significant risk to the AI. Furthermore, the AI may be requested to evaluate scenarios under which its viability is compromised (e.g. reverse stress￾testing scenarios), or to assess the plausibility of events that lead to significant strategic or reputation risk, particularly for significant business lines or products. 3.2.5 Where the HKMA’s assessment reveals material shortcomings in an AI’s stress-testing programme or its implementation (or that the results generated are not adequately attended to or acted upon), the AI is expected to provide a detailed plan of corrective actions and follow-up on its implementation.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 40 3.2.6 The HKMA’s approach to assessing AIs’ compliance with stress-testing requirements, in particular, for regulatory capital (i.e. under the Banking (Capital) Rules or the supervisory review process), liquidity and recovery planning purposes is set out in the relevant SPM modules under the respective sections on Capital Adequacy, Liquidity Risk Management and Recovery Planning. 3.2.7 Where necessary, the HKMA may obtain information or confirmation from any relevant home or host supervisor for the purpose of assessing an AI’s stress-testing practices. 3.3 Use of supervisory scenarios 3.3.1 Where appropriate, the HKMA may ask selected AIs to conduct additional stress tests based on common stress scenarios advised by the HKMA. Such supervisory scenarios aim to help (i) identify potential sources of risk to specific groups of AIs or macroeconomic or financial market vulnerabilities; (ii) assess the impact of such stress events on the AIs or the banking sector as a whole; and (iii) determine appropriate supervisory strategies. For AIs which are requested by the HKMA to conduct this type of supervisory stress test, they should clearly document the relevant governance arrangements and methodologies (including their specific roles and responsibilities 27 in the stress-testing exercise), and ensure adequate management oversight of the stress test results. 3.3.2 When conducting the supervisory stress test as referred to in para. 3.3.1, the HKMA will work with participating AIs to ensure that their stress-testing results are comparable in terms of data quality, completeness and consistency with specific guidance. Where necessary, the HKMA will discuss the test results with individual AIs, and the management actions to be taken to address any identified supervisory concerns. In considering the management actions, the HKMA will take into account whether the proposed actions 27 The relevant responsibilities would generally include, but are not limited to, data quality control, interactions with HKMA on interpretative issues, and data and modelling choices.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 41 are part of, or consistent with, the AIs’ other strategic plans, such as their recovery plans. 3.3.3 However, AIs should be mindful that any such supervisory stress tests referred to in para. 3.3.1 will be in addition to, and should not be regarded as a substitute for, the stress tests to be conducted by AIs themselves as part of their own stress-testing programme. Unlike the bespoke stress tests within an AI’s stress-testing programme, a common supervisory scenario is not tailored to the specific risk characteristics of individual AIs. 3.3.4 The HKMA also regularly conducts its own internal supervisory stress tests, which may make use of the data and results generated from AIs’ stress tests, in order to facilitate assessment of the vulnerabilities and soundness of individual AIs, specific groups of AIs, and the Hong Kong banking sector as a whole. AIs’ stress-testing results and the results of the HKMA’s internal supervisory stress tests will inform and refine the HKMA’s prudential supervisory process. 3.3.5 The HKMA will maintain an ongoing dialogue with the Hong Kong banking industry and relevant public authorities on stress-testing practices.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 42 Annex: Risk factors and stress scenario examples A1 General A1.1 This section illustrates various examples of risk factors and stress scenarios that AIs should take into account in their stress-testing programme. They do not however represent an exhaustive list and are provided for reference only. As set out in subsections 2.5 and 2.7, AIs should establish a sound risk identification process to identify their own material and relevant risks, having regard to circumstances specific to their institution, and ensure that the stress scenarios are able to capture all identified material and relevant risks. A2 Examples of risk factors A2.1 Below are some examples of risk factors that should generally be considered by an AI in stress-testing:  Credit risk characterised by an increase in default probabilities (e.g. the rise in delinquencies and charge￾offs); a decline in recovery rates or in the value of supporting collateral; a rating migration of counterparties, issuers or credit protection providers; and worsening of credit spreads. AIs should be aware of the major drivers of repayment ability (such as economic downturns and significant market shocks) that will affect entire classes of counterparties or credits, and should consider their credit exposures in both banking and trading books (including hedging positions and central clearing house exposures) in their stress-testing;  Counterparty credit risk arising from the default of a counterparty before the final settlement of the cash flows of the contracts or transactions (such as

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 43 derivative contracts, securities financing transactions or cash transactions) 28;  Wrong-way risk that occurs when the probability of default of counterparties is positively correlated with the level of exposure to the counterparties, causing an abrupt increase in AIs’ exposures, or a significant decrease in the effectiveness of their credit risk￾mitigating techniques (e.g. credit default swaps bought), in the event of severe market shocks;  Concentration risk in terms of the exposures to individual counterparties, groups of linked counterparties, products / instruments, industries, market sectors, jurisdictions or regions. AIs should also assess the contagion effects and possible linkages (and the potential changes in such inter￾relationships over time and in times of stress) between, as well as the potential vulnerabilities in, different markets, jurisdictions regions, counterparty types and asset classes;  Market risk arising from movements in the price or fair value of assets (e.g. currencies, equities, commodities or other financial instruments, and their derivative positions) and their impact on relevant portfolios and markets;  Interest rate risk in the banking book (IRRBB) arising from adverse movements in interest rates that affect AIs’ banking book positions;  Liquidity risk as a result of rapid and significant deposit outflow, the tightening of credit lines and market liquidity, or the triggering of obligations to provide additional collateral or margin under credit support agreements, under stressed situations, and the impact on funding sources and cash-flow assumptions; 28 For certain derivative or securitization transactions, while their net exposures to counterparties (after taking into account netting effects, continuous re-margining requirements and collateral arrangements) might be small under normal circumstances, their gross exposures could be at risk. For instance, this may happen where an exchange of principal is involved and the counterparty to a transaction defaults after the AI has delivered the principal amount of the transaction.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 44  Operational risk (including legal risk) arising from inadequate or failed internal processes, people and systems or from external events. This covers a wide range of incidents including processing errors, frauds, system failure and damages to physical assets, etc.;  Strategic risk resulting from events or changes in the environment that could adversely alter the original assumptions made in the strategic plan and any potential threats to AIs’ business, both financially and non-financially;  Reputation risk in terms of the potential effect of specific events or circumstances (e.g. massive fraud or scandal, solvency concerns) on AIs’ financial positions, business and reputation. Attention should also be drawn to potential exposures and obligations (whether contractual or non-contractual) to their securitization or off-balance sheet vehicles and related group entities that may have a reputational or other risk impact in times of a market crisis29;  Product-specific risks such as prepayment risk for mortgages or securitized portfolios. Other potential risks may also arise from abnormal market movements and their impact on contingent credit exposures (e.g. derivatives) and complex products (e.g. structured products with embedded multiple risks);  System-wide interactions and feedback effects that reflect the impact of likely behavioural responses of other market participants and their counterparties on the broader market in times of stress, and how that impact will feed back to AIs’ own positions30; 29 The 2008/09 Great Financial Crisis revealed cases in which financial institutions, driven by concerns over the reputational spillover effects and damage to market confidence, honoured commitments or took up exposures from their off-balance sheet vehicles or related group entities even though they were not legally obliged to do so. 30 The 2023 banking turmoil in the US and Europe demonstrated that the failure of a financial institution can have far-reaching systemic implications through various channels, including first- and second- round propagation effects. Distress of relatively small banks can also trigger broader and cross-border systemic concerns, as well as contagion effects.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 45  Modelling assumptions for value-at-risk, expected shortfall or pricing models, including assumptions for correlation, volatility and holding period, and the potential impact on AIs if such assumptions no longer hold true in crisis situations;  Economic factors including macroeconomic factors (e.g. GDP growth, change in property prices, unemployment rate and inflation or deflation rate), the economic cycle (including the nature of the cycles in terms of whether they are generic or specific to particular markets, sectors or industries, the duration of the cycles, and the stages of development within the cycles), and their impact on other risk factors;  Political and geopolitical factors pertaining to industries, regions and markets; and  Climate risks, including physical risks driven by worsening climate situation and transition risks arising from a shift towards a low-carbon economy, which might be translated into impact on AIs’ financial positions and operations (e.g. adverse impact on credit risk profile). A3 Examples of stress scenarios A3.1 The following are examples of stress scenarios relating to credit risk and counterparty credit risk31:  Domestic economic downturn: this estimates the impact on an AI’s asset quality, profitability and capital adequacy of adverse changes in selected macroeconomic variables (e.g. GDP growth, unemployment rate, interest rates, bankruptcy rates and asset prices etc.) that are relevant to the AI’s exposures; 31 For the avoidance of doubt, the stress scenarios listed in A3.1 may also be relevant to other types of risks. Conversely, the stress scenarios listed in A3.2 may be relevant to credit risk and counterparty credit risk. See subsection 2.5 for more guidance regarding the consideration of correlation and interactions between risk factors.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 46  Economic downturn in major economies: this estimates the impact on an AI’s counterparty exposures (e.g. corporate loans, holdings in securities, interbank exposures etc.) as a result of economic downturn in major economies that have significant financial / commercial / trading links with Hong Kong. As an example, the impact could be measured in terms of a drop in corporate borrowers’ business revenues or an increase in the default risk of their trading counterparties; or mark-to-market valuation losses on the AI’s holdings of securities relating to the economies concerned. The scenario could be extended to include other shocks in those economies (e.g. stock market crisis);  Major events affecting global economy: examples of such major events include Covid-19 pandemic, which requires estimating the impact of the infection or mortality rate and the social distancing requirements on economic activities (both within and outside Hong Kong), and trade war, which requires estimating the pressures on credit market, recession risks of the global economy, and the corresponding impact on corporate customers and counterparties;  Decline in the real estate market: this estimates the impact of a decline in property prices on collateral coverage, default risk and provisioning needs for loans secured by properties. In the case of a residential mortgage portfolio, AIs can assess the impact of a resultant increase in loans in negative equity and in the level of impairment allowances and regulatory reserves (based on assumptions of the probability of default and realisation value of the underlying properties for such loans). For commercial real estate (CRE) portfolios, AIs may estimate the potential losses amid a downturn of CRE market as driven by cyclical and/or structural changes;  Decline in the value and market liquidity of financial collateral: this estimates the impact of a decline in the valuation and market liquidity of financial collateral held by AIs, which reduces the quality and quantity of the

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 47 collateral, leading to lower collateral coverage and recovery rates and higher provisioning needs and capital charges;  Increases in classified loans and provisioning levels: this assesses the resilience of an AI’s loan portfolios in terms of the impact of such increases on its profitability and capital adequacy. In designing the scenario, an AI may apply different percentages of increase in classified loans and provisioning levels to its loan portfolios;  Rating migration of counterparties: a similar stress test can be performed based on the internal or external credit ratings of an AI’s credit exposures, by migrating a certain percentage of the credit exposures of a specific rating grade (by one or more notches) to a lower rating grade (or to a higher rating grade in respect of short credit risk positions taken), and assessing the resultant impact on the AI’s profitability and capital adequacy. The capital impact may include the effects of increases in credit losses and provisioning needs as well as the application of higher risk-weights due to rating downgrades in the calculation of regulatory capital;  Default of major counterparties: this estimates the impact of default of an AI’s major counterparties, including corporate, sovereign, bank and NBFI counterparties32, on its profitability as well as liquidity and capital adequacy, taking into account factors such as concentration risk, idiosyncratic risk and wrong-way risk in such a scenario. The test can be extended to cover aggregate exposures to major industries, market sectors, jurisdictions and regions (e.g. by assuming that a significant number of defaults occur within such aggregate exposures). The effectiveness of risk mitigation measures in counterparty default situations should also be considered; 32 AIs may consider referencing past major default cases such as Archegos Capital Management and Long￾Term Capital Management, where applicable.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 48  Widening of credit spreads: this captures the risk of increases in the credit spreads of securities or credit derivatives in a particular market (e.g. an industry sector or a region) due to problems in that market or across markets;  Deterioration in the quality of consumer lending: this estimates the impact of a rising unemployment rate and an increasing number of personal bankruptcies on retail portfolios such as credit card receivables and personal loans. An appropriate scenario would be to assume a further rise in the level of charge-offs for such lending taking into account the projected increase in the unemployment rate and personal bankruptcies; and  Decline in the value of taxi licences / gross operating income of taxi drivers: this estimates the impact on an AI’s taxi loan portfolio in terms of collateral coverage, default risk and provisioning needs. A3.2 The following are examples of stress scenarios relating to other risks:  Liquidity crisis: this analyses the adequacy of an AI’s short- to medium-term liquidity and funding capacity to meet crisis situation (e.g. rapid and significant deposit outflows33 , intraday liquidity risk arising from settlement or clearing processes during severe stress, tightening of credit lines, inability to roll over short-term debt, etc.). See LM-2 “Sound Systems and Controls for Liquidity Risk Management” for further guidance;  Operational risk events: this assesses the effects, on an AI’s capital requirement for operational risk or its ability to maintain critical operations and earning capabilities, of external events (e.g. utility outage and suspension of service by a major third-party service 33 As observed during the 2023 banking turmoil in the US and Europe, depositors with a similar profile tend to exhibit similar behaviour during periods of heightened uncertainty. Consequently, deposit concentration in specific types of borrowers or a particular industry can exacerbate the speed and severity of bank runs if one occurs. Furthermore, the growing digitalisation of banking services and the influence of social media may amplify the speed of deposit withdrawals and liquidity outflows.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 49 provider, external fraud, limited access to bank premises by staff amid the pandemic lockdown) or internal events (e.g. business disruption, system failures, problems with information and communication technology, or internal fraud). See OR-1 “Operational Risk Management” and OR-2 “Operational Resilience” for more guidance;  Decline in net interest income: this estimates the impact on an AI’s net interest income due to negative loan growth or squeezes in pricing caused by competition for new business or market share;  IRRBB: this assesses the effects of IRRBB (such as parallel and non-parallel gap risk, basis risk and option risk) on an AI’s earnings and capital adequacy34. See IR-1 “Interest Rate Risk in the Banking Book” for detailed guidance;  Adverse changes in exchange rates between currencies: this estimates the impact on an AI’s net open positions in currencies, including cash flow mismatches for foreign currencies in aggregate and for each significant currency individually. AIs should also assess the impact of such changes on their major customers with substantial foreign exchange exposures. Such exposures could arise from the customers’ foreign currency assets, liabilities or income streams. See TA-2 “Foreign Exchange Risk Management” and LM-2 “Sound Systems and Controls for Liquidity Risk Management” for detailed guidance;  Decline in market value of financial instruments: this estimates the impact of adverse changes in market prices (e.g. exchange rates or interest rates) and liquidity conditions on the market values of financial instruments (e.g. corporate bonds and derivatives). For complex and bespoke products such as 34 During 2023 banking turmoil in the US and Europe, some banks faced increased financing costs and a decline in the market value of their debt securities’ holdings when interest rates raised unprecedentedly, resulting in a sharp increase in unrealized losses on held-to-maturity and available-for-sale portfolios. If the banks were to sell these debt securities prior to their maturity date to meet liquidity needs, the unrealised losses become realised losses, thereby reducing both equity and regulatory capital.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 50 securitization exposures, AIs should take into account the risk characteristics related to the underlying assets, dependence on market conditions, contractual arrangements, embedded triggers and leverage, and subordination level in the issue structure;  Changes in market risk variables: this assesses the effects of adverse changes in market risk factors (i.e. interest rates, foreign exchange rates and equity or commodity prices) on an AI’s market risk exposures. In addition, factors such as market / product illiquidity, concentration risk, effectiveness of risk-mitigating strategies and counterparty risk should be taken into account;  Inability to access the securitization market: this covers the risk from pipeline and warehousing exposures associated with underwriting and securitization activities, which should be taken into account regardless of the probability for securitization of these exposures;  Hidden risk concentrations: this estimates the impact from changes in market conditions which could give rise to risk concentrations. AIs may identify and assess the impact of heightened correlations or hidden inter￾dependencies within and across risk types / risk factors and possible second-round effects under severe market shocks that may lead to an increase in an AI’s exposures. For instance, corporate default rates may accelerate as macroeconomic conditions deteriorate progressively, pipeline and warehousing risks may emerge, or AIs may be obliged to take back exposures they have previously offloaded or to take up exposures to support their related entities;  Decline in stock prices / indices: this estimates the effect on an AI’s share margin lending or holdings of stocks;  Risks of cryptoassets: this assesses the risks resulting from cryptoasset exposures (e.g. impact of significant changes in the value of unbacked cryptoassets or the

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 51 underlying assets of asset-backed cryptoassets on the AI’s capital and liquidity positions);  Market dislocations and spillovers: this estimates the effects of market dislocations and spillovers across counterparty groups, markets or risk types as a result of the inter-connectedness and dependencies among financial institutions, counterparties, markets and economies35;  Geopolitical disruptions: this captures the risk of economic disruptions, trade restrictions and other uncertainties stemming from geopolitical tensions, conflicts, or diplomatic crises, which could affect an AI's exposure to specific jurisdictions / regions, industries or counterparties, and potentially leading to market volatility and financial losses. In addition, the legal enforceability of contracts under specific geopolitical risk scenarios in certain jurisdictions should be duly assessed; and  Climate-related scenarios: this assesses the impact associated with physical risks (e.g. increase in average global temperature and mean sea level, rising frequency and severity of extreme weather events such as heatwaves, floods and storms) and transition risks (e.g. challenges arising from the changes in policies such as carbon pricing, and advancement in technologies for reducing carbon emissions) in both short-term and long-term horizons. In addition, AIs may consider a scenario which captures the simultaneous shocks from climate risks and non￾climate risk factors (e.g. the materialisation of adverse financial impacts of climate risks concurrently with those stemming from general macroeconomic shocks). See GS-1 “Climate Risk Management” for more guidance. 35 Hedges that work efficiently under normal conditions may break down during a stressed market environment, and access to regular funding or credit sources may evaporate rapidly or may only be attained at substantially higher cost.

Supervisory Policy Manual IC-5 Stress-testing V.3 – 13.04.2026 52 A3.3 Below are examples of historical events that may be used for developing stress scenarios, as they illustrate the relationships between different risk factors and how such relationships could change and be exacerbated in a crisis (also see para. 2.7.6 and 2.7.7):  1987 Market Crash;  1997 Asian Financial Crisis;  1998 Russian Financial Crisis;  2001 terrorist attack in the U.S.;  2003 SARS outbreak;  2008/09 Great Financial Crisis;  2010-12 European Sovereign Debt Crisis;  2020-23 Covid-19 pandemic; and  2023 banking turmoil in the US and Europe. ————————— Contents Glossary Home Introduction