Supervisory Policy Manual Module OR-1 on Operational Risk Management

Banking Policy Department Our Ref: B1/15C, B1/21C, S4/11C 25 July 2022 The Chief Executive All Authorized Institutions Dear Sir/Madam, Supervisory Policy Manual (SPM): Revised module OR-1 on Operational Risk Management I am writing to inform you that, following consultation with the industry, the Monetary Authority issued today a revised SPM module OR-1 on Operational Risk Management. The revised module implements the Revised Principles for Sound Management of Operational Risk issued by the Basel Committee on Banking Supervision (BCBS) in March 2021, which primarily incorporates clarifying guidance on the existing principles, updates in the areas of change management and information and communication technology management, and specific guidance related to operational resilience. It also reflects those requirements related to operational risk management contained within the BCBS’ Principles for Operational Resilience. AIs should implement this module within 18 months from the date of this letter (i.e. no later than 25 January 2024), except for the areas related to operational resilience as set out in paragraph 1.5.2 which should follow the implementation timelines for the new SPM module OR-2 on Operational Resilience based on our circular letter dated 31 May 2022. Should you have any questions regarding the above, please contact Mr Andy Cheung on 2878 1022 or Ms Jacqueline Chan on 2878 8299. Yours faithfully, Daryl Ho Executive Director (Banking Policy) Encl cc: The Chairperson, The Hong Kong Association of Banks The Chairperson, The DTC Association FSTB (Attn: Mr Justin To)