Sharing of good industry practices for implementing operational resilience framework

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref.: B1/15C 20 January 2025 The Chief Executive All Authorized Institutions Dear Sir/Madam, Sharing of good industry practices for implementing operational resilience framework I am writing to share observations of good industry practices for conducting mapping exercises and scenario testing to support implementation of operational resilience framework in accordance with Supervisory Policy Manual (SPM) module OR-2 1 . Through ongoing engagement with the industry to track implementation progress, the HKMA noted that all Authorized Institutions (AIs) have developed operational resilience frameworks and are on track to achieve full compliance with the OR-2 requirements by May 2026. Major retail banks have also taken on board our supervisory feedback to tighten the tolerance limits for disruption, thus enhancing resilience and recovery capability for critical operations that are important to the AI, its customers and the banking sector. Most AIs are now in the second critical stage of their operational resilience implementation, namely the mapping and scenario testing exercises. These exercises enable AIs to identify vulnerabilities and dependencies of each critical operation, thereby facilitating effective remediation. The HKMA acknowledges the challenges involved given the increasing complexity of banking operations, which were discussed at an industry sharing session co-hosted by the HKMA and the Hong Kong Association of Banks (HKAB) in December 2024. …/page 2 1 The SPM module OR-2 on Operational Resilience was issued on 31 May 2022.

• 2 -
• 2 - Insights from the sharing session and good industry practices observed through various engagements are summarised in the Annex. AIs are encouraged to consider applying the good practices for mapping, testing and remediation of relevant vulnerabilities, in a manner commensurate with the scale and scope of their operations and risk profiles. Going forward, AIs should prioritise the remaining tasks for becoming operationally resilient and track progress through self-assessments, with a view to achieving full compliance with the OR-2 requirements by May 2026. The HKMA will continue to provide guidance and support to the industry in the process. Should your institution have any questions on the above, please contact us at operational.resilience@hkma.iclnet.hk. Yours faithfully, Carmen Chu Executive Director (Banking Supervision) c.c The Chairperson, The Hong Kong Association of Banks The Chairperson, The DTC Association FSTB (Attn: Ms Tanna Chong)