Revision of Supervisory Policy Manual Modules CG-1 and IC-1

Our Ref: B1/20C B1/21C 6 October 2017 The Chief Executive All authorized institutions Dear Sir / Madam, Revision of Supervisory Policy Manual (SPM) Modules CG-1 “Corporate Governance of Locally Incorporated Authorized Institutions” IC-1 “Risk Management Framework” I am writing to inform you that, following consultation with the two industry Associations, the Monetary Authority (MA) is issuing by notice in the Gazette today a revised version of the above-mentioned SPM modules as statutory guidance under section 7(3) of the Banking Ordinance. Revisions to the modules were made to incorporate guidelines issued by the Basel Committee on Banking Supervision (BCBS) 1 and the Financial Stability Board (FSB) 2 as well as to update provisions for the board of locally incorporated authorized institutions (AIs) and its committees. We have also taken the opportunity to simplify and streamline the structure of the SPM modules. The revised modules provide more elaborate guidance on the following. With respect to CG-1: (i) the responsibilities of the board and senior management; (ii) the role of the chair and the appropriate composition of independent non-executive directors as members; and (iii) the governance issues in group structures, in the case where an AI acts as the parent company or where the AI is a regulatory subsidiary of an overseas-incorporated group. 1 Corporate governance principles for banks (July 2015), Principles for effective risk data aggregation and risk reporting (January 2013) and The internal audit function in banks (June 2012). 2 Principles for an Effective Risk Appetite Framework (November 2013) and Thematic Review on Risk Governance (Februray 2013).

2 With respect to IC-1: (i) the key elements of an effective risk management framework; including, for example, delineation of the responsibilities of the Board, Risk Committee, and risk management function; (ii) the operation of a risk appetite framework and regular formulation of a risk appetite statement to facilitate oversight of risk-taking activities and risk management process; and (iii) the maintenance of effective systems and procedures to facilitate firm-wide risk measurement and monitoring. On-line access to the SPM modules is available on the HKMA’s public website (http://www.hkma.gov.hk/eng/key-functions/banking-stability/supervisory-policy-man ual.shtml) and private website (http://www.stet.iclnet.hk/index.htm). AIs will be expected to implement the requirements set out in the revised SPM modules with effect from 1 January 2018. In the meantime, AIs should make reasonable progress in complying with these requirements. In the event of an AI expecting difficulties in complying with specific requirements, you may wish to approach your usual supervisory contact at the HKMA regarding implementation issues. Yours sincerely, Daryl Ho Executive Director (Banking Policy) Encl cc: The Chairperson, The Hong Kong Association of Banks The Acting Chairperson, The DTC Association FSTB (Attn: Ms Eureka Cheung)