Supervisory Policy Manual GS-1 Climate Risk Management

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 1 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To provide guidance to AIs on the key elements of climate-related risk management; and to set out the HKMA’s approach to, and expectations in, reviewing AIs’ climate-related risk management. Classification A non-statutory guideline issued by the MA as a guidance note. Previous guidelines superseded This is a new guideline. Application To all AIs Structure

1. Introduction 1.1 Background 1.2 Scope 1.3 Legal framework 1.4 Supervisory objectives 1.5 Application and implementation
2. An overview of climate-related issues 2.1 Climate-related risk drivers 2.2 Unique characteristics of climate change and the implications
3. Governance

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 2 3.1 Responsibilities of the board and senior management 3.2 Oversight 4. Strategy 4.1 Overview 4.2 Formulation 4.3 Implementation 5. Risk management 5.1 Overview 5.2 Risk identification and measurement 5.3 Scenario analysis and stress testing 5.4 Monitoring and reporting 5.5 Control and mitigation 6. Disclosure 6.1 Overview 6.2 Approach to disclosure —————————

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 3 1 Introduction 1.1 Background 1.1.1 Climate change is one of the major risks threatening the well-being of mankind. To combat climate change, the Paris Agreement was reached in 2015 among 196 parties in Paris which aims to limit the rise in global average temperatures to well below 2°C above pre￾industrial levels and to pursue efforts to limit the temperature increase to 1.5°C. The agreement also aims to increase the ability of countries to deal with the impacts of climate change, and to make finance flows consistent with a low greenhouse gas emissions and climate-resilient pathway. This would potentially trigger a radical shift in economic activities and resource allocation, and would hence have far reaching implications for all sectors of the economies and financial markets around the world. Global development 1.1.2 Against this background, climate change is increasingly recognised as a source of financial risks for financial institutions and corporates. Globally, the central banking and regulatory community is demonstrating growing awareness of the issue and commitment to tackling the challenge. For instance:  in December 2015, the Task Force on Climate￾related Financial Disclosures (TCFD) was established by the Financial Stability Board (FSB). The TCFD developed a set of voluntary, consistent disclosure recommendations for use by companies in providing information to investors, lenders and insurance underwriters about their climate-related financial risks.  In December 2017, eight central banks and supervisors established the Central Banks and Supervisors Network for Greening the Financial System (NGFS) with the aim of contributing to the development of environment and climate risk management in the financial sector, and mobilising

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 4 mainstream finance to support the transition toward a sustainable economy.  In February 2020, the Basel Committee on Banking Supervision (BCBS) established the Task Force on Climate-related Financial Risks to undertake work on climate-related financial risks. Local development 1.1.3 In 2016, China formally signed and ratified the Paris Agreement, and announced the Agreement’s application to the Hong Kong Special Administrative Region. In 2017, the “Hong Kong’s Climate Action Plan 2030+” set out Hong Kong carbon emission reduction target for 2030. The Policy Address 2020 further reinforces the Government’s ambition and pledges to strive to achieve carbon neutrality before 2050. In October 2021, the Government announced Hong Kong’s Climate Action Plan 2050, setting out the vision of “Zero-carbon Emissions ‧ Liveable City ‧ Sustainable Development”, and outlining the strategies and targets for combating climate change and achieving carbon neutrality. 1.1.4 In May 2020, the HKMA and the Securities and Futures Commission jointly initiated the establishment of the Green and Sustainable Finance Cross-Agency Steering Group.1 The Steering Group aims to co-ordinate the management of climate and environmental risks to the financial sector, accelerate the growth of green and sustainable finance in Hong Kong and support the Government’s climate strategies. In December 2020, the Steering Group announced its strategic plan which sets out six key focus areas for strengthening Hong Kong’s financial ecosystem to support a greener and more sustainable future in the longer term as well as five near-term action points.2

1 Other members are the Environment Bureau, the Financial Services and the Treasury Bureau, Hong Kong Exchanges and Clearing Limited, the Insurance Authority and the Mandatory Provident Fund Schemes Authority. 2 Source: Green and Sustainable Finance Cross-Agency Steering Group. press release, 17 December 2020.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 5 1.2 Scope 1.2.1 In developing this module, the HKMA has drawn on the relevant work of FSB, BCBS and NGFS3 and has taken into account certain practices in the industry in managing climate-related risks. Section 2 illustrates how climate change poses risks to AIs. Sections 3 to 6 sets out our requirements with regard to AIs’ governance, strategy, risk management and disclosure in building climate resilience. 1.2.2 Climate change has traditionally been approached from a corporate social responsibility perspective. However, with the increasing threat of climate change and the associated physical damage, change in market perception and shift in preference of the public towards more environmental-friendly products and services, the financial, reputational and strategic risk implications are becoming increasingly prominent. This module therefore focuses primarily on these emerging perspectives of climate risks and the impact on the business activities and operations of AIs. 1.2.3 While this module focuses on climate risk management, AIs should not overlook the risks and opportunities brought by other environmental and sustainability￾related issues. This would better enable an AI to deal with the challenges posed by increasing expectation of its stakeholders and the public on this front. For instance, it is increasingly recognised internationally that biodiversity loss could pose risks to the financial system through physical risks and transition risks4 . Furthermore, achieving the Sustainable Development Goals included in the United Nations 2030 Agenda for Sustainable

3 The major references include: FSB’s The implications of climate change for financial stability, NGFS’ Guide for Supervisors Integrating climate-related and environmental risks into prudential supervision, and BCBS’ Climate-related financial risks: a survey on current initiatives. 4 Physical risks arise from the declining performance of assets or economic activities that depends upon biodiversity, such as reducing crop yields and productivity. Transition risks arise when there are biodiversity-related regulation and policy change, such as quota restriction on protected area for fishery, or technological innovation or shifting consumer preferences. Source: NGFS, Biodiversity and financial stability: exploring the case for action, Jun 2021.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 6 Development5 would require substantial transformation for the society and mobilisation of financial resources. 1.2.4 This module should be read in conjunction with other relevant modules of the Supervisory Policy Manual, e.g. IC-1 on risk management framework, IC-5 on stress￾testing and the various modules on the effective management of the relevant inherent risks such as RR￾1 on reputational risk and SR-1 on strategic risk. 1.3 Legal framework 1.3.1 AIs should be aware of their legal obligations to meet the minimum authorization criteria stipulated under the Seventh Schedule to the Banking Ordinance in relation to their management of climate-related risks. 1.3.2 Para. 10 of the Seventh Schedule to the Banking Ordinance requires AIs to maintain adequate accounting systems and systems of control. These are essential for ensuring the prudent and efficient running of the business, safeguarding the assets of the AI, monitoring the risks to which the AI is exposed and complying with legislative and regulatory requirements. 1.3.3 Para. 12 of the Seventh Schedule to the Banking Ordinance requires AIs to conduct their business with integrity, prudence and professional competence and in a manner which is not detrimental to the interests of depositors or potential depositors. In this connection, the HKMA will take account of, among other things, AIs’ approach to managing climate-related financial risks and building climate resilience. 1.4 Supervisory objectives 1.4.1 As climate risk drivers would translate into one or more of the inherent risks (see para 5.2.2) assessed under the HKMA’s risk-based supervisory process (see SA-1 on risk-based supervisory approach), the main objectives of the HKMA’s supervisory approach in respect of climate risks are to assess (i) the risk profile of AIs in respect of the vulnerability to climate risks, including the level and

5 For details, see the Sustainable Development Goals of the United Nations.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 7 trend and (ii) the adequacy and effectiveness of AIs’ risk management framework in addressing climate risks, noting the distinctive characteristics of climate change and the material level of uncertainty surrounding it (see para 2.2.1). 1.4.2 In assessing an AI’s exposures to, and management of, climate risks, the HKMA will have particular regard to the financial impact associated with climate risks. For instance, the potential financial implications of the physical impact of extreme weather events and transition to a low-carbon economy on the AI’s exposures (see para 2.1.1). Besides, given the increasing concern and expectation from the public, the HKMA would also expect AIs to properly manage the reputational and strategic risks arising from climate-related issues. 1.4.3 Recognising AIs are at varying stages of development in addressing climate-related risks and that there is no “one-size-fit-all” approach given the differences among AIs in terms of size, structure and business, the HKMA will adopt a proportionate approach in applying the guidance set out in this module. For instance, AIs having a small and simple business operations will not be expected to have an approach to climate risk management as sophisticated as those with more complex operations. However, they should, at a minimum, be able to demonstrate that the requirements set out in sections 3-6 are implemented. 1.5 Application and implementation 1.5.1 This module is applicable to all AIs. For locally incorporated AIs, they should apply the requirements on a solo-entity basis and, where applicable, on a consolidated basis covering their subsidiaries. To the extent practicable and if the risks are assessed as material, they should also consider applying to their associated companies and joint ventures. 1.5.2 International banking groups operating in Hong Kong (whether in the form of a local subsidiary or a branch) should have a framework in addressing climate-related issues appropriate for their Hong Kong operations. If certain processes are centralised at the group or regional

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 8 level, the AI should assess whether such processes are appropriate for the local circumstances. Whether having its own framework for the Hong Kong operation or relying on the group/parent, AIs should, upon request by the HKMA, be able to demonstrate that the relevant functions are appropriate for the size, nature and complexity of the local operations and are in line with the requirements in this module in all material aspects. 1.5.3 Unless otherwise specified, the HKMA will allow a 12- month period for the implementation of the requirements set out in this module. Separately, the HKMA may approach individual AIs to understand their work plan and progress during the above-mentioned period. 1.5.4 Recognising the practical challenges (e.g. insufficient data and difficulty in modelling and measuring the risks) facing AIs and the evolving methodologies in climate risk analysis, the HKMA will be pragmatic in reviewing AIs’ implementation, along with the proportionate approach suggested. 2 An overview of climate-related issues 2.1 Climate-related risk drivers 2.1.1 Climate risks generally refer to the risks posed by climate change, such as damage caused by extreme weather events or a decline in asset value in carbon-intensive sectors. They are broadly classified into physical risk and transition risk6 .  Physical risk refers to the impacts of climate and weather-related events and long-term progressive shifts of climate7 .

6 Source: NGFS, First Comprehensive Report - A Call for Action, April 2019 and NGFS, Guide for Supervisors: Integrating climate-related and environmental risks into prudential supervision, May 2020. 7 Weather events such as heatwaves, floods, storms while change in average temperatures, precipitation and sea-level rise. Direct impacts of such events may lead to damage to property or reduced productivity and revenues, indirectly impacts may result in disruption of global supply chains.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 9  Transition risk refers to the financial risk related to the process of adjustment towards a lower-carbon economy which can be prompted by, for example, changes in climate policy, technological changes8 or a change in market sentiment. 2.2 Unique characteristics of climate change and the implications 2.2.1 Climate change has the following distinctive characteristics9 and hence requires special attention and to be managed differently from other conventional financial risks.  Far-reaching impacts in breadth and magnitude: climate change will affect all agents in the economy, across all sectors and geographies. The impacts could be much larger, more widespread and more diverse than those of other structural changes. The complex interactions between climate and other systems (e.g. social, economic, regulatory and technological) present significant challenges to the identification and measurement of the risks.  Foreseeable nature but uncertain timing and outcome: although there is a high degree of certainty that some combination of physical and transition risk will materialise in the future, the exact timing, outcome and future pathways remain uncertain and the impacts are unevenly distributed both between and within countries.  Irreversibility: a high degree of confidence that, above a certain threshold for the concentration of greenhouse gas emissions in the atmosphere, climate change will have irreversible consequences on our planet.  Dependency on short-term actions: the magnitude and nature of future impacts will be determined by

8 Such as technological advancement in energy-saving and cost reduction in renewable energy. 9 Source: NGFS, First Comprehensive Report - A Call for Action, April 2019.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 10 the actions taken today. Collective actions by governments, central banks and supervisors, financial market participants, firms and households are crucial. 2.2.2 As such, the materialisation of physical and transition risks, which depends on multiple nonlinear dynamics that interact with each other in complex ways, are subject to deep uncertainty. Therefore, despite the limitation of the use of climate-economic models in representing these interactions, forward-looking methodologies play an important role in exploring the potential vulnerabilities10 . 2.2.3 Furthermore, as tackling climate change requires collective efforts by all parties, there would be increasing expectation on the financial sector, whose core function is to allocate capital resources, to channel finance to support the transition. This is reflected in one of the goals of the Paris Agreement about the mobilisation of climate finance. 3. Governance 3.1 Responsibilities of the board and senior management General requirements 3.1.1 The board has primary responsibility for the oversight of an AI’s approach to managing climate risks and opportunities, which is fundamental to an AI’s climate resilience. Overall responsibilities 3.1.2 The board and senior management should:  have sufficient knowledge and understanding of global, regional and local developments to consider the impact on the AI;  consider the climate-related risks and opportunities in a holistic manner and to ensure the AIs business

10 Source: BCBS, Climate-relate financial risks – measurement methodologies, April 2021.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 11 decisions are commensurate with the magnitude of climate risks; and  define and articulate the roles and responsibilities for the AI’s approach to addressing climate-related issues. 3.1.3 While the board remains ultimately responsible for the oversight of an AI’s approach to managing climate risks and opportunities, it may delegate authority to board￾level committees. Such delegation should be made formally with the relevant roles and responsibilities, governance structure, and escalation/ reporting procedures clearly outlined and documented. Senior management 3.1.4 The senior management is responsible for the proper functioning of the AI’s risk management framework and for driving necessary changes in addressing climate￾related issues. This includes ensuring the effectiveness of the framework through regular review, formulation and implementation of relevant policies and processes. The senior management should also put in place effective escalation channels for reporting material risks and exceptions. Designated personnel or committee 3.1.5 At the management level, AIs should designate personnel or committee to be responsible for climate￾related risks. To carry out their duties effectively, the designated personnel or committee should be vested with sufficient authority within the AI’s organisational structure, and should possess relevant knowledge and experience in risk management function. 3.2 Oversight General requirements 3.2.1 The board should exercise oversight of the development and implementation of the AI’s strategy in addressing climate-related issues, including embedding climate￾related risks into the AI’s risk management framework.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 12 Oversight of strategy development and implementation 3.2.2 To ensure effective development and implementation of climate strategy, involvement from the top is crucial. Therefore, the board should play an active role in overseeing the development and implementation of the AI’s climate strategy, including:  ensuring that the AI’s strategic goals are in line with its vision,  approving the climate strategy recommended by senior management, having regard to relevant global, regional and local developments (including economy-wide, national-wide and internationally agreed goals),  ensuring that there are appropriate resources, processes, systems and controls to support the implementation of the strategy; and  cultivating a risk culture from the top that embeds climate-related considerations into the business activities and decision-making process. 3.2.3 To facilitate effective oversight, the board should regularly be provided with relevant management information, as well as updates on major policy initiatives and developments concerning climate-related issues. Setting of climate goals and actions 3.2.4 While setting of climate goals is not mandatory, AIs should be vigilant to the potential adverse impacts or shocks that may arise from their inaction, delayed responses in supporting transition, or misalignment with economy-wide / national-wide / internationally agreed climate goals. For instance, an AI’s competitiveness, reputation and long-term resilience may be impaired if it fails to address stakeholders’ concerns of managing the climate risks or support transition as reflected in its business practices. In this connection, setting clear climate goals11 in line with global and local developments would be an effective measure in addressing the

11 For example: contributing to the global effort in reducing greenhouse gas emission.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 13 strategic risks associated with climate change and should therefore be actively explored. Setting risk appetite 3.2.5 The board is responsible for setting the AI’s overall risk appetite and approving the risk appetite statement (RAS) recommended by senior management. It should review and consider whether and how climate risks should be integrated into the existing risk appetite framework. This could be accomplished by developing an understanding on the risks posed by climate change over different time horizons, and taking into account the AIs’ specific circumstances such as:  the strategic goals;  risk-taking capacity; and  results of any materiality assessment, climate risk stress testing and scenario analysis. 3.2.6 If assessed to be appropriate, climate risks should be reflected explicitly in the RAS in a proportionate manner. While the consideration of climate risks in the RAS may be qualitative initially, AIs should consider adopting quantitative metrics to facilitate tracking and reporting. 3.2.7 The RAS should be reviewed at least annually, taking into account the evolving physical and transition impacts arising from climate-related issues, as well as the circumstances of the AI such as data availability and capability in the assessment. 4. Strategy 4.1 Overview 4.1.1 Given the unique characteristics of climate change (see para 2.2.1 above), its physical and transition impact will have strategic risk implications on AIs, affecting the business environment in which they operate, the corresponding actions they take, and the deployment of resources in establishing their competitive advantage. Proper formulation, planning and implementation of

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 14 climate strategy will support an AI’s effectiveness and resilience in navigating such risks and opportunities. 4.1.2 A strategic planning process usually begins with the setting of strategic goals, and an evaluation of strategic position, leading to the formulation of a strategic plan. 4.1.3 For effective strategy implementation, it is essential to allocate sufficient resources, align internal settings and processes. 4.2 Formulation General requirements 4.2.1 AIs should embed climate considerations throughout the current strategy formulation process, from strategic assessment to action plan development. Strategic assessment 4.2.2 A proper strategic assessment process is key to the formulation of strategy in addressing climate-related issues. In evaluating the AI’s strategic position, considerations should be given to relevant internal and external factors. AIs should monitor the material factors which will impact the business activities in which they are active, as well as those relating to their products and services. To promote a consistent understanding and efficient communication across the institution, AIs should have a process to define and document those aspects of climate-related risks that are assessed as most relevant to the AI. 4.2.3 Internal factors include the AI’s strengths and weaknesses. In the context of climate change, this involves an evaluation of the AI's risk management structures and data systems to support its management of climate-related risks, the knowledge and expertise of staff and management on climate-related risk, the AI’s competitive position and market standing in exploring business opportunities and supporting clients during the transition.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 15 4.2.4 External factors generally refer to the environment that poses threats and opportunities to an AI. For instance, climate change may impact the business environment in which the AI operates, through government policies and regulations, technological advancement and stakeholder sentiments. All these external factors may foster a structural change towards a more climate-resilient economy and in turn affect the AI and its customers and counterparties. Stakeholder engagement 4.2.5 With increasing awareness of climate-related issues across the community and the development of economy –wide / national-wide / internationally agreed climate goals, a comprehensive strategic assessment could benefit from involving relevant stakeholders to gather their views and insights. The stakeholders that an AI should engage typically involve regulators, the government, investors, depositors, clients, counterparties, industry associations, standard setting bodies, suppliers, employees and the general public, subject to the specific situations facing the AI. Engagement efforts should aim at enabling the AI to better understand the key concerns and expectations of the stakeholders, and conversely inform them about how the AI is positioning itself in the light of climate-related risks and opportunities. 4.2.6 Approach to stakeholder engagement varies and can be tailored according to different objectives. For instance, it may include surveys, meetings, written communication or any other channels, depending on the need of the AI and the types of stakeholders targeted. Time horizon 4.2.7 Climate-related risk considerations over different time horizons should be incorporated into the strategy formulation process. 4.2.8 The business plan of AIs normally covers a time horizon of 1 to 3 years, which is considered relatively short in the context of climate change. For example, the physical impacts of climate change (e.g. the rises in temperature

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 16 and sea level) are more relevant over a longer horizon of more than 5 years, and government policy and transition plan are typically in the order of decades. Therefore, in formulating climate strategy, the impacts of climate change over a longer time horizon, say over 10 years, should also be considered to cater for the unique nature of climate risks. 4.3 Implementation General requirements 4.3.1 AIs should ensure the effective implementation of their strategy for addressing climate-related issues by properly aligning internal resources and processes, and managing relevant changes. Organisational structures, business policies, processes and resources availability should be reviewed. Structure and process 4.3.2 Organisational structure and business process should be reviewed, and enhanced as appropriate, to support effective communication and co-ordination among different business and operation units. In this regard, AIs may consider establishing an inter-departmental working group, comprising of members of different functions within the AI. 4.3.3 Each relevant business and functional unit taking part in climate strategy implementation should have their roles and responsibilities clearly defined. Certain roles and functions in the climate strategy, such as those relating to the management of climate-related risks, should contain built-in mechanisms for checks and balances (see para 5.1.3 for details of the three lines of defence model). Business policy 4.3.4 AIs’ strategic goals should be properly reflected in their business policies. For instance, an AI may embed climate risk considerations into its client’s risk profiling by evaluating the environmental impacts (such as energy

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 17 efficiency, emission level) and transition plan of a client against the AI’s climate strategy. On the other hand, depending on its goals, it may develop policies to support clients’ transition, or deploy exclusion, negative screening or tilting mechanism. Remuneration 4.3.5 AIs should ensure that their remuneration policy and practices are consistent with their climate strategy as appropriate. AIs may further consider properly integrating climate considerations into the remuneration system having regard to risks, for example, by embedding climate-related risk considerations into performance scorecard. Resources 4.3.6 AIs should ensure that sufficient resources, whether financial or non-financial, are allocated to climate strategy implementation. Potential enhancements include, for example, building capacity, seeking expert advice, recruiting talents, strengthening relevant data system and framework and enhancing data governance and quality. 4.3.7 In case where data or methodologies are sourced from external consultants or vendors, or certain processes are outsourced to external service providers, AIs should have an appropriate process to assess the quality and reliability of the products or services12 . 4.3.8 Given the distinctive features of climate-related risks, it is not uncommon for the data systems of AIs to be inadequate for proper management of such risks for the time being. In such a case, AIs should devise action plan to enhance their data collection process and adapt their systems, so as to capture the necessary data for effective implementation of climate strategy.

12 For instance, AIs may seek to understand about the data coverage, data sources, key assumptions made and limitations, etc.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 18 5. Risk management 5.1 Overview 5.1.1 AIs should incorporate climate-related risk considerations into their risk management framework, and establish effective risk management processes to identify, measure, monitor, report, control and mitigate climate-related risks. 5.1.2 An appropriate framework for managing climate-related risks should be based on a comprehensive assessment on how and to what extent climate change would affect an AI’s portfolios and operations. In view of the unique characteristics of climate change, the financial, reputational and strategic risk implications should be properly taken into account. Based on the materiality and potential impacts identified, existing risk management framework and relevant policies should be enhanced to embed climate-related risk considerations. AIs are expected to have documented policies and procedures which enable climate-related risks to be managed in a proactive manner. Given the evolving nature of climate-related risks (including how they are transmitted, how government policies and technologies emerge), relevant risk management framework, policies and procedures, as well as the effectiveness of related internal controls, should be reviewed regularly to keep pace with the changing environment, having regard to the level of risk, size and nature of business of the AI. 5.1.3 In line with the usual risk governance arrangement, the responsibilities of managing climate-related risks should be allocated among three lines of defence (see also section 2.1 of IC-1 “Risk Management Framework”):  The first line of defence is provided by the business units where risks are taken. For instance, when conducting climate-related risk assessments during client on-boarding, credit application and credit review process, relevant staff should have sufficient awareness and understanding to identify and assess potential climate-related risks.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 19  The second line of defence is provided by independent and effective risk and/or compliance functions, and is primarily responsible for overseeing climate-related risks in business activities, on-going risks monitoring and reviewing relevant policies and procedures. These functions should undertake independent climate risk assessment and monitoring, including challenging the assessment conducted by the frontline, and monitoring compliance with applicable laws, regulations and internal policies.  The third line of defence is provided by an independent and effective internal audit function, which is responsible for providing assurance and periodic audit evaluation on the effectiveness of the AI’s climate-related risk management (including the first and second lines of defence described above). 5.2 Risk identification and measurement General requirement 5.2.1 AIs are expected to have sufficient understanding of how climate risks could be transmitted into the traditional risks faced by them13 and assess the potential impacts on their business. Where appropriate, AIs should also formulate plans to build capabilities to address any information and data gaps. Transmission to traditional risk types 5.2.2 The first step of risk identification involves a comprehensive assessment of how the risks posed by climate change, whether quantifiable or non-quantifiable, may affect the AI through the traditional risk types. Below are some examples:  Credit risk: climate risk drivers may reduce collateral value, borrowers’ repayment ability (income effect) or AIs’ recovery of the loan outstanding in the event of default (wealth effect).

13 For example, the eight major types of inherent risks defined in the HKMA’s supervisory process (see also section 2 of SA-1 Risk-based supervisory approach).

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 20 (see relevant modules on credit risk management14)  Market risk: a large, sudden and negative price adjustments may be triggered when climate risk, which has not yet incorporated into prices or valuation, is materialised. The effect would be accelerated if there is a breakdown in correlations between assets or a sharp reduction in market liquidity for particular assets.  Liquidity risk: access to funding sources could be reduced as market conditions change, where climate risk drivers may cause counterparties of AIs to withdraw deposits and draw down credit lines (see LM-2 on sound system and controls for liquidity risk management).  Operational and legal risk: there may be increasing business disruption to AI’s operation and its outsourced arrangements owing to extreme weather events, and increasing legal / liability15 and regulatory compliance costs associated with climate-sensitive investments and business activities (see OR-1 on operational risk management, TM-G-2 on business continuity planning, and SA-2 on outsourcing).  Reputational risk: AIs may face increasing reputational issue with changing market and consumer sentiment towards more climate or environmental-friendly products, services and business practices, such as expectations / concerns from the public or interest groups for an AI to take up more social responsibilities in combating climate change and support the transition. Negative perception of not taking due

14 For example, CR-G-1 General principle on credit risk management, CR-G-2 Credit approval, review and records, CR-G-3 Credit administration, measurement and monitoring, CR-G-7 Collateral and guarantees and CR-G-8 Large exposures and risk concentrations). 15 For example, emerging legal cases related to climate change seeking compensation from financial institutions which are held responsible for loss and damages resulting from the effects of climate change, or which finance companies with activities having negative environmental impacts.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 21 considerations of environmental aspects in business activities could also adversely affect AIs’ abilities to maintain or establish business relationships (see RR-1 on reputational risk management).  Strategic risk: AIs may lose its competitiveness and market standing for failing to respond timely to the changing market environment along with increasing scrutiny and preference towards climate or environmental-friendly solutions and responsible banking practices (see SR-1 on strategic risk management) Assessment of impacts at portfolio and counterparty levels 5.2.3 AIs could tailor their approach by beginning with identifying material climate-related risks at portfolio, counterparty (including clients), and where appropriate, transactional level, by assessing the relevant financial implications over both short and longer-term horizons. Such assessments could be carried out during client on￾boarding, credit initiation and underwriting, credit evaluation, credit review and investment decision process. AIs could also assess how their business activities may increase the risk of reputational damage, liability and/or litigation.  At portfolio level, AIs could identify the high risk asset portfolios based on sectoral/geographical exposures and assess the concentration risk. This could be done by first performing high-level identification of high-risk sectors/ geographical locations (e.g. by making reference to TCFD 16 documents, national economic and meteorological statistics/documents, and internationally￾recognised standards and certification schemes), followed by more detailed analysis of client or transactional data. For physical risks, such analysis could focus on the physical location of a client’s business operations and assets, potential

16 For example, the TCFD identified sectors and industries with highest likelihood of climate-related financial impacts based on GHG emissions, energy usage, and water usage. The four group of industries identified are – energy, transportation, materials and buildings, and agriculture, food and forest products.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 22 physical disruption to the client's supply chain, as well as the potential implication on collateral valuations. For transition risks, risk criteria such as carbon emission, energy usage and sensitivity to climate policy may be applied to assess vulnerability of exposures to transition risk.  Counterparty-level assessment could also be conducted for a more granular assessment for those high risk sectors / portfolios as determined by the AI during the portfolio level review. AIs may prioritise such assessment taking into account the materiality, geographic locations and sectors of their exposures. Counterparty-level risk criteria may include the counterparty’s financial position, transition strategy, exposures to stranded assets and business supply chain17 . AIs may collect such information and conduct risk assessment when commencing the relationship as well as on an ongoing basis. Assessment of impacts at operation level 5.2.4 At the operation level, AIs should assess whether their facilities, operations and major outsourced arrangements may be prone to physical risks brought by extreme weather events, and assess the resilience as part of the business contingency planning process. Bridging information and data gaps 5.2.5 Where appropriate, AIs should formulate plans to build capabilities to address any information and data gaps. For instance, AIs may consider whether the data collection process should be enhanced, such as by strengthening the engagement with clients to develop a better understanding of the impact of climate-related risks on the clients’ business, and obtaining more climate-related or environmental information from clients. AIs may also consider appointing external consultants or data providers to assist in the process.

17 AIs may assess the second order impact of physical and transition risk on the counterparty arising from its suppliers and distributors.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 23 5.3 Scenario analysis and stress testing General requirement 5.3.1 AIs should build capability to measure climate-related risks using various methodologies and tools. AIs should adopt the techniques of climate-focused scenario analysis, including stress testing, to regularly assess vulnerability under different plausible climate scenarios having adverse impacts on them. AIs should consider the requirements outlined below when setting scenarios and determining the approaches. Proper documentation should also be maintained. 5.3.2 The methodologies and tools should be reviewed and enhanced as appropriate. The HKMA will adopt a proportionate approach when assessing AIs’ relevant arrangement, having regard to the nature, scale and complexity of their business activities and the risks associated with those activities. Purpose 5.3.3 Climate scenario analysis, including stress testing, could be considered as a technique for testing an AI’s resilience to climate stress. The purpose of conducting such analysis is to assess how physical and transition risks may impact an AI’s business under different future states, so as to facilitate an AI’s planning of responses to these different states, and hence the building of climate resilience. Specifically, it could be used to evaluate an AI’s financial position under severe but plausible scenarios in the near term, thus allowing the AI to assess potential vulnerability of its financial position to “stressed” business conditions brought about by climate change. Scenario setting 5.3.4 Multiple scenarios, covering both physical risk and transition risks, should be included in scenario analyses and stress tests. Examples of the types of scenario include a transition to a lower-carbon economy consistent with a 2°C or below scenario, different pathways of lower-carbon transition (e.g. orderly and disorderly), and a pathway where no transition takes place. When setting scenarios, AIs could determine

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 24 which scenarios and time horizons are relevant and meaningful having regard to their business model and risk profile. A spectrum of events and severity levels for all relevant risks, as well as the interactions among these risk factors, could be considered. Considerations may include:  for assessing physical risk impact, assumptions may be made based on average global temperature increase, change in mean sea level, and the rising frequency and severity of extreme weather events.  for transition risk, the assumptions may focus on the impact of policy change (e.g. change in carbon price), technological advancements, changes in market sentiment or a combination of these factors.  reference could also be made to the reference scenarios developed by the NGFS and the Shared Socio-economic Pathways adopted by the Intergovernmental Panel on Climate Change, which have been widely adopted internationally and could serve as a good starting point for analysing climate-related risks. 5.3.5 In conducting these analyses, AIs should explore using both short and longer time horizons. Short-term assessments, as emphasised under traditional stress testing methodology, are useful in measuring and assessing the risks within an ordinary business planning horizon. However, as climate change occurs over a longer period with high complexity and uncertainty, conducting analyses for both short-term and longer term would help the AI measure existing and potential vulnerabilities, and eventually facilitate the planning of mitigating actions accordingly. Approaches 5.3.6 When conducting climate-focused scenario analyses including stress tests, all major exposures that are being or will be affected by climate change should be covered, and both quantitative and qualitative assessments should be performed. For example, AIs could assess

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 25 how climate-related risks may be translated into financial risk drivers (such as change in revenue, costs, asset value, and borrowers’ repayment ability) and manifest in the major risk categories (such as how the AI’s credit risk profile and fair value assets are impacted, and the aggregate impact on its financial position). AIs may also identify the most significant factors which will materially affect their financial positions and operations, and explore mitigation strategies. 5.3.7 AIs should be mindful of the potential model risk and limitation arising from the use of new modelling methodologies and assumptions for performing the analyses and making long-term projections. For instance, scenario assumptions and stylised model parameters may not be able to capture the complex interaction of the various climate risk factors, and hence present difficulty in using the analysis to predict the evolution of these factors. Model limitations should be properly documented. 5.3.8 AIs should also keep in view development in this space which is fast-evolving 18 and explore enhancing their approach.19 Documentation 5.3.9 AIs should maintain proper documentation of the scenario analysis and stress test undertaken to inform management discussion and facilitate ongoing development of methodologies and tools. For instance, areas covered could include:  key features of the exercises, including parameters used (e.g. macro-economic variables), assumptions made and analytical choices (e.g. choices of scenarios, time horizons);

18 For example, a number of international bodies / initiatives, such as TCFD, NGFS and the BCBS, have showcased different tools and methodologies adopted by financial institutions. 19 Recognising the challenges in conducting a robust climate-focused scenario analysis including stress testing, the HKMA will monitor the situation and continue to work with the industry to support bank’s capacity building.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 26  analyses and processes adopted in deriving any assumptions and parameters;  model limitations;  assessment results; and  actions undertaken and plans formulated to address risks identified, and how such actions and plans can reduce the long run impact of climate change on the AI. 5.4 Monitoring and Reporting General requirement 5.4.1 AIs should implement processes to monitor and report exposures to climate-related risks to ensure that such exposures are consistent with their risk appetite. Given the evolving nature of climate-related risks, AIs should monitor evolution of climate-related risks and ensure that the risk monitoring process should keep pace with the latest developments on climate change (e.g. in respect of emission pathways and environmental policies). 5.4.2 A range of quantitative and qualitative tools and metrics should be considered to facilitate monitoring, and to provide early warning signals for necessary actions. Timely and regular reporting should be made to the board to facilitate oversight. Monitoring at portfolio level 5.4.3 At portfolio level, AIs should consider focusing on certain risk factors having regard to the materiality. Such monitoring should, at a minimum, cover the AI’s exposures to certain sectors which are more vulnerable to transition risks, and collaterals which are more likely to be impacted by physical risks. 5.4.4 To facilitate holistic portfolio monitoring, simple metrics, such as percentage of exposures to high-risk sectors, and carbon intensity of projects financed by the AI, may be considered. Monitoring at counterparty level

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 27 5.4.5 At counterparty level, AIs may consider maintaining a monitoring list of counterparties with high risk profile. AIs may then focus on such counterparties and consider carrying out enhanced due diligence on these clients, for example, monitoring their transition progress through direct engagement and publicly available information. Monitoring of exposure of operation to physical risks 5.4.6 In monitoring the physical risk exposures of an AI’s own facilities, operations and major outsourced arrangements, it may consider appropriate indicators that provide management with early warning of operational risk issues. Monitoring the evolution of climate-related risks 5.4.7 AIs should also keep track of the evolution of climate￾related risks and evaluate the potential impacts on their exposures. This is because the materialisation of climate-related risks is largely dependent upon whether global emissions could be reduced on a pathway consistent with a 2°C warming, and the changes in the climate system and policy responses. For example, a continuous high emissions pathway may result in more substantial global temperature increase and hence potentially more drastic policy responses. In the meantime, the readiness of a jurisdiction to switch to a low-carbon economy and its economic composition will affect its vulnerabilities to transition. Reporting to board and senior management 5.4.8 Timely and regular reports on climate-related risk exposures including adherence to risk appetite, progress of strategic and business plans, information on implementation of control and mitigation (see sub￾section 5.5) should be provided to the board and senior management to inform decision-making. 5.4.9 While AIs could determine their risk reporting requirements taking into account their own business models and risk profiles, the reports should, at minimum, cover all material climate-related risks identified, adherence to risk appetite / risk limits, and any forward￾looking assessment of risks. Simple quantitative metrics

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 28 (as mentioned in para 5.4.4) could also be considered in the reporting process. 5.4.10 In the meantime, AIs should keep in view any need to enhance risk reporting framework to enable them to better capture, aggregate and report climate-related exposures. 5.5 Control and Mitigation General requirement 5.5.1 AIs should carry out measures to control and mitigate exposures to climate-related risks, having regard to their business strategy and risk appetite. Sector-level measures 5.5.2 AIs should consider control measures for sectors which do not align with AIs’ climate strategy or risk appetite, such as imposing limitations, setting lending thresholds, adopting a tilting policy. AIs could also develop sector￾level policies to facilitate consistent risk control measures. 5.5.3 In the event that an exclusion policy has to be implemented (e.g. ceasing financing to certain sectors), considerations should be given to financial inclusion to avoid abrupt changes causing undue hardship to clients which would not be conducive to a smooth transition. For example, a gradual approach could be considered by beginning ceasing the financing of new projects. Counterparty and transaction-level measures 5.5.4 For counterparties which are not in line with AIs’ climate strategy or risk appetite, AIs should determine the appropriate mitigation measures at counterparty and/or transaction level. For example, AIs may consider applying more stringent lending terms such as shorter tenor, lower loan-to-value limit, or have the climate￾related risks reflected in pricing. On the other hand, AIs may also apply favourable financing conditions or covenants to promote consideration of climate-related issues by their clients, such as taking steps to manage

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 29 exposures to climate-related risks, developing a transition strategy, adhering to applicable standards or establishing performance targets. To address potential reputational risk issues arising from controversy connected to their lending and investment activities, AIs could consider developing guidelines and procedures about their engagement with clients and responses. 5.5.5 AIs may also consider assisting their clients in building climate resilience by supporting them in transitioning to low-carbon activities, for example, through establishing with clients certain performance targets such as energy efficiency improvement and carbon emission reduction. Another possible way is to encourage clients to enhance their climate-related disclosures, which could in turn help inform the AI about the risks faced by the clients. Measures for preventing disruption to operation 5.5.6 AIs should consider adequate measures to safeguard business continuity in case of extreme weather events causing disruptions to their own facilities, operations and major outsourced arrangements. AIs could also consider relocating critical functions to areas less vulnerable to climate risks. 6. Disclosure 6.1 Overview 6.1.1 Climate-related disclosure is an important avenue for different stakeholders (e.g. regulators, investors, customers and depositors) of an AI to understand relevant risks faced by it and its approach to addressing such issues. 6.1.2 There has been growing demand for information to address concerns on climate-related issues. Among the various disclosure frameworks concerning climate and sustainability, the TCFD published a set of recommendations in 2017 to help businesses discloses

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 30 risks and opportunities arising from climate change20 . The TCFD recommendations have gone through extensive consultation, and gained broad support among preparers and users internationally. They are also widely recognised, adopted or referenced by regulators and authorities21 . 6.1.3 As such, TCFD recommendations are considered a desirable framework for AIs to rely upon, at least at the initial stage. Referencing to a common framework could also facilitate consistency and comparability among AIs. 6.2 Approach to disclosure General requirements 6.2.1 AIs should develop an appropriate approach to disclosing climate-related information to enhance transparency. As a minimum, AIs should make climate￾related disclosures aligned with TCFD recommendations. TCFD’s recommended disclosures 6.2.2 The TCFD’s 11 recommendations surrounding four thematic areas (i.e. governance, strategy, risk management, and metrics and targets) address financial risks and opportunities posed by climate change. The recommendations and recommended disclosures of the TCFD are presented below. The examples quoted are for illustration and not exhaustive. AIs should strive to work along these recommendations taking into account their unique circumstances22 . TCFD’s recommendations on governance

20 In December 2015, the FSB established the industry-led TCFD to design a set of recommendations for consistent “disclosures that will help financial market participants understand their climate-related risks”. The TCFD released its final recommendations in June 2017. 21 Source: TCFD, TCFD status report 2021, October 2021. 22 AIs may refer to “Final Report: Recommendations of the Task Force on Climate-related Financial Disclosures” (June 2017), and the updated guidance in “Implementing the Recommendations of the Task Force on Climate-related Financial Disclosures” (October 2021) which provides supplemental guidance to assist preparers in certain sectors including the banking sector.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 31 Disclose the organisation’s governance around climate-related risks and opportunities. a) Describe the board’s oversights of climate–related risks and opportunities b) Describe management’s role in assessing and managing climate￾related risks and opportunities. 6.2.3 For example, AIs may disclose:  the committee or key personnel in charge of overseeing the climate-related issues within the AI and / or setting AI’s climate strategy;  processes and frequency by which the board or designated committees are informed of climate￾related issues;  description of the roles and responsibility assigned to senior management related to climate risk management;  description of the relevant organisational structure; and  key aspects and issues of climate-related risks and opportunities as discussed and reviewed by the board and senior management during the reporting period. TCFD’s recommendations on strategy Disclose the actual and potential impacts of climate-related risks and opportunities on the organisation’s businesses, strategy, and financial planning where such information is material. a) Describe the climate-related risks and opportunities the organisation has identified over the short, medium, and long term. b) Describe the impact of climate-related risks and opportunities on the organisation’s businesses, strategy and financial planning. c) Describe the resilience of the organisation’s strategy, taking into consideration different climate-related scenarios, including a 2o C or lower scenario.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 32 6.2.4 For example, AIs may disclose:  relevant short-, medium- and long-term time horizons being considered and determined by the AI, with regard to the useful life of assets;  specific climate-related issues potentially arising in each time horizon (short, medium, and long term) that can have a material financial impact (in terms of business lines, revenue, costs, balance sheet assets);  the materiality assessment process undertaken by the AI, e.g. process and methodology used to identify the impacts of climate-related risks and opportunities;  any scenario analysis conducted, such as the scenario, assumptions, methodology, coverage of business lines and portfolios;  results of scenario analysis conducted and any implications on the AI’s strategy; and  any plans for transitioning to a low-carbon economy, which could include GHG emissions targets and specific activities intended to reduce GHG emissions or to support the transition. TCFD’s recommendations on risk management Disclose how the organisation identifies, assesses and manages climate-related risks. a) Describe the organisation’s processes for identifying and assessing climate-related risks. b) Describe the organisation’s processes for managing climate￾related risks. c) Describe how processes for identifying, assessing, and managing climate-related risks are integrated into the organisation’s overall risk management.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 33 6.2.5 For example, AIs may disclose: -  key processes for identifying and assessing climate risks;  method or techniques in measuring, monitoring and mitigating climate risks (e.g. relevant models, limits and metrics);  quantification of exposures in relation to climate risks;  definitions of risk terminology used or references to existing risk classification framework; and  progress being made in enhancing risk management capabilities and incorporation of climate risk into existing risk management framework. TCFD’s recommendations on metrics and targets Disclose the metrics and targets used to assess and manage relevant climate-related risks and opportunities where such information is material. a) Disclose the metrics used by the organisation to assess climate￾related risks and opportunities in line with its strategy and risk management process. b) Disclose Scope 1, Scope 2 and, if appropriate, Scope 3 greenhouse gas emissions, and the related risks. c) Describe the targets used by the organisation to manage climate￾related risks and opportunities and performance against targets. 6.2.6 For example, AIs may disclose:  risk and alignment metrics and targets23 used to measure climate-related risks and opportunities;

23 Risk metrics such as probabilities of default, adjusted risk rating, exposure to carbon sensitive sectors, and alignment metrics such as carbon footprints, carbon intensity and implied temperature rise, can be actively explored. AIs may also keep in view of the developments of initiatives such as Partnership for Carbon Accounting Financials (PCAF), and Science Based Targets Initiative (SBTi).

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 34  breakdown of metrics and targets by industry, geography, credit quality and tenor;  scope 1 and 2 emissions of AI’s own operation;  methodology used in relation to such metrics and targets (e.g. calculation, standard adopted); and  any verification and assurance of the disclosed metrics (e.g. emission). Timeline and location 6.2.7 The HKMA would expect AIs to take actions to prepare climate-related disclosures in accordance with TCFD recommendations as soon as practicable, and make their first disclosures no later than mid-2023. Recognising the potential challenges for AIs in implementing the TCFD recommendations, the HKMA will be pragmatic in monitoring such disclosures initially24, with a view to aligning disclosures of AIs with the TCFD framework no later than 2025. 6.2.8 AIs should make such disclosure at least on an annual basis. Regarding location of disclosure, AIs may consider making use of their sustainability reports, website, annual reports, or a combination of them to facilitate public access. Disclosures at group or head office level 6.2.9 For AIs which are local subsidiaries or branches of foreign banks, they may rely on the disclosure arrangement at the group or head office level, as long as such disclosures are applicable to the AI’s local operation and meet the requirements in this section. Comply-or-explain approach

24 For example, we would expect more meaningful disclosures for the areas of “governance” and “risk management” by AIs.

Supervisory Policy Manual GS-1 Climate Risk Management V.1 - 30.12.2021 35 6.2.10 In the light of the evolving development in climate-related disclosures and the burden, a “comply-or-explain” approach may be adopted by AIs, taking into account:  the significance of an AI’s operation, including the nature and size of business (particularly lending and investment activities) in Hong Kong25; and  the materiality of climate-related risks exposed to the AI. 6.2.11 AIs adopting such approach should explain, in their disclosure, their circumstances, the difficulties encountered and any plans for future enhancements to their climate-related financial disclosures (and if possible, a timeline for implementing such plan). The evolving landscape 6.2.12 In view of the evolving disclosure landscape, AIs should keep abreast of the development globally26, and should plan ahead to progressively enhance their disclosure. For instance, while most AIs may be less ready at this stage to report Scope 3 emissions, they should start working out a plan to obtain relevant information such as by collecting emission data from their clients. Moreover, AIs may also consider assessing and disclosing the impact of their business activities towards the environment27 .

25 For instance, those currently exempted from making relevant disclosures under the Banking (Disclosure) Rules. 26 For example, on 3 November 2021, a new International Sustainability Standards Board was formed to develop global baseline of high-quality sustainability disclosure standards. 27 Please refer to TCFD status reports for more examples of disclosure practices. For example, the 2021 status report is available at https://assets.bbhub.io/company/sites/60/2021/07/2021-TCFD￾Status_Report.pdf .