Sound practices for payment operations

Our Ref: B1/15C 28 July 2022 The Chief Executive All Authorized Institutions Dear Sir / Madam, Sound practices for payment operations I am writing to share with the industry some sound practices for payment operations of authorized institutions (AIs). Over the past year, a few payment-related operational incidents were reported by AIs to the Hong Kong Monetary Authority (HKMA). Most of these incidents were caused by IT system malfunctions, rendering the institutions unable to complete payment transactions within the cut-off timelines specified by the Hong Kong Interbank Clearing Limited (HKICL). These incidents have not only impacted the institutions themselves and their customers, but in several instances have also affected other financial institutions, including those in the securities sector. The HKMA would like to remind AIs of the importance of maintaining high operational resilience with respect to their payment operations. They should appreciate that a stable and efficient payment system is immensely important to Hong Kong being an international financial centre. In keeping with the supervisory guidance as set out in the HKMA’s Supervisory Policy Manual, including Module OR-2 on Operational Resilience, Module TM-G-1 on General Principles for Technology Risk Management and Module TM-G-2 on Business Continuity Planning, payment operations should generally be regarded as critical operations, and AIs should have in place robust business continuity plans (BCPs) to ensure that their payment functions can continue to operate even when disruptions occur. Having regard to the experience obtained from the earlier operational incidents, the HKMA has identified a range of sound practices for payment operations, which are set out below for reference of AIs:- • Preventing payment-related operational incidents – Given the importance of payment function, it is imperative that all systems supporting payment operations are well-designed and thoroughly tested before they are rolled out. In the event that there are subsequent system changes or enhancements, AIs should test the new or enhanced systems with the same level of rigorousness before they go live. Where an AI’s payment systems rely on those of its head office, it should clearly communicate with its group counterparts to ensure that the local management are informed of any system changes affecting payment operations well in advance, and

• 2 - the local management should be closely involved in the testing process before any system changes are effected. (Reference: TM-G-1 section 4) • Close monitoring of payment operations – There should be a dedicated team charged with the responsibility for ongoing monitoring of payment operations, including tracking the status and flow of payments, so as to identify irregularities at early stages of the payment process. The team of staff responsible for this function should be familiar with the institution’s BCP for payment operations and be in a position to make recommendations to management on when to trigger contingency arrangements, such as Special Posting1 , at a suitably early juncture to ensure timely completion of payment transactions within the specified cut-off times for various Real Time Gross Settlement (RTGS) systems. (Reference: TM-G-2 section 4 and TM-G-1 section 5) • Robust business continuity planning – AIs are expected to have robust and well￾defined BCPs in place to ensure the ongoing resilience of their payment operations. The BCP should cover a variety of scenarios, including prolonged service degradation or system outages, so that AIs can readily respond to actual disruptions. In this regard, AIs should critically review their end-to-end workflows, and conduct rigorous risk assessments in order to formulate viable contingency options to mitigate the residual risks. The assessments should factor in relevant interdependencies (e.g. transaction volume) and the time required for potential action points throughout the process (e.g. internal escalation, decision making, external communications). AIs should also have adequate processes in place to prioritise the execution of payment transactions when a disruption occurs, taking into account factors such as the nature, value and time sensitivity of the payments, and the potential knock-on market impact (e.g. the possibility of affecting other banks or other financial markets). (Reference: OR-2 section 6 and TM-G-2 section 4) • Timely deployment of contingency arrangements – A key commonality of the operational incidents observed by the HKMA is that the disruption of the AIs’ payment operations was not timely brought to the attention of bank management as most of the efforts were placed on system recovery. Eventually, the decision to trigger the contingency arrangements specified in the BCPs was usually made at a late stage, causing many of the outstanding transactions not being completed in time. AIs should take steps to ensure that their processes require early escalation of payment-related operational incidents, and prompt response from management. AIs should not assume that an extension of RTGS cut-off times will always be granted. As stated in the HKMA’s circular dated 8 May 20152 , the discretion to extend the RTGS operating window is exercised only on an exceptional basis, with due consideration to factors such as the impact on financial stability, potential knock-on effects and convenience to users of financial services. (Reference: OR-2 section 8 and TM-G-2 section 4) 1 Special Posting is an existing contingency arrangement put in place by the HKICL to enable AIs to submit CHATS (i.e. Clearing House Automated Transfer System) payment instructions via alternative channels (e.g. ICLNet, internet, offline media) using batch files to the HKICL. 2 HKMA’s circular dated 8 May 2015 issued to HKD CHATS Members on “Request for extension of HKD CHATS operating window”

• 3 - • Periodic testing – The effectiveness of AIs’ BCPs should be ensured through regular testing and drills. The coverage of the drills should be sufficiently wide to capture the entire end-to-end journey, and designed in a way that allows AIs to identify critical action points and develop practical solutions to expedite recovery. Apart from their own testing and drills, AIs should ensure their operational and technical readiness for special posting or other functions on an ongoing basis, and to mandatorily test all related tools through the participation of the annual industry￾wide special posting trial runs co-ordinated by the HKICL. (Reference: OR-2 section 6 and TM-G-2 section 6) • Incident reporting and communication with stakeholders – An effective communication strategy should be developed by AIs to ensure key stakeholders in the payment process are engaged in a timely manner. In particular, relevant internal and external stakeholders should be identified upfront and included in the communication plan as part of the BCP, so as to facilitate timely communication with bank customers and other relevant parties. As payment-related incidents may have wider implications on financial stability, AIs are expected to promptly escalate and report the matter to the HKMA and other supervisory authorities, to facilitate timely regulatory response at the system level. (Reference: OR-2 section 8 and TM￾G-2 section 4) AIs should review their existing practices against the above sound practices for payment operations. Where gaps are identified, AIs should critically evaluate the need for enhancing their existing practices and make improvements where appropriate. In view of the increased number of payment-related operational incidents, the HKMA will step up its surveillance of AIs’ payment operations, including undertaking examinations focused on payment operations. Should your institution have any questions about this circular, please get in touch with your usual contact in the Banking Supervision Department. Yours faithfully, Raymond Chan Executive Director (Banking Supervision) c.c. The Chairperson, The Hong Kong Association of Banks The Chairperson, The Deposit-taking Companies Association The Securities and Futures Commission (Attn: Ms Julia Leung) Hong Kong Interbank Clearing Limited (Attn: Ms Haster Tang)