Supervisory Policy Manual Module TM-C-1: Supervisory Approach on Cyber Risk Management

Our Ref.: B1/15C B1/21C B9/29C 29 November 2024 The Chief Executive All Authorized Institutions Dear Sir/Madam, New Supervisory Policy Manual (SPM) Module TM-C-1 on “Supervisory Approach on Cyber Risk Management” I am writing to inform you that, following consultations with two industry Associations, the Monetary Authority is issuing by notice in the Gazette today a new SPM module TM-C-1 on “Supervisory Approach on Cyber Risk Management” as a statutory guideline under section 7(3) of the Banking Ordinance. In light of the escalating cyber risks and the potential systemic impact of a severe cyber incident on financial stability, the Hong Kong Monetary Authority (HKMA) considers it timely to articulate in a SPM module its policy, overarching principles and supervisory approach on banks for managing cyber risks. This SPM module is not intended to introduce any new requirements but sets out holistically the HKMA’s guidance and supervisory processes on cyber risk management as well as its expectation for deeper collaboration between the banking sector and other stakeholders in the ecosystem. /… Page 2

• 2 - On-line access to the SPM module is available at the HKMA’s public website (https://www.hkma.gov.hk/eng/regulatory-resources/regulatory￾guides/supervisory-policy-manual/) and the Supervisory Communication Website (https://www.stet.iclnet.hk). Should you have any questions regarding the new module, please feel free to contact Mr Edmund To at 2878-1105 or Mr Clarence Wong at 2878-8695. Yours sincerely, Carmen Chu Executive Director (Banking Supervision) Encl. cc. The Chairperson, The Hong Kong Association of Banks The Chairperson, The DTC Association Secretary for Financial Services and the Treasury (Attn. Mr Justin To)