Supervisory Policy Manual: New Module OR-2 on Operational Resilience and Revised Module TM-G-2 on Business Continuity Planning

Our Ref: B1/15C B9/81C B9/78C 31 May 2022 The Chief Executive All Authorized Institutions Dear Sir / Madam, Supervisory Policy Manual (SPM): New module OR-2 on “Operational Resilience” and revised module TM-G-2 on “Business Continuity Planning” I am writing to inform you that, following consultation with the industry, the Monetary Authority issued today a new SPM module OR-2 on “Operational Resilience” and a revised version of the SPM module TM-G-2 on “Business Continuity Planning”. New SPM module OR-2 and revised SPM module TM-G-2 The modules serve to implement the Basel Committee on Banking Supervision (BCBS)’s Principles for Operational Resilience (POR) issued in March 2021. Specifically: • The new OR-2 module, issued as a guidance note, specifies the HKMA’s overall approach to operational resilience. It sets out the HKMA’s expectation that every Authorized Institution (AI) should be operationally resilient, and provides high￾level guidance on how AIs can develop an integrated and holistic operational resilience framework to support this. • The revised TM-G-2 complements OR-2 by providing enhanced guidance on business continuity planning, which is a key component of an effective operational resilience framework. It incorporates additional requirements related to business continuity planning and testing covered within the POR, and also aligns the terminology used for business continuity planning and operational resilience purposes to enhance clarity. AIs should note that many of the concepts and requirements related to operational resilience are not new and are already covered extensively under existing HKMA guidance. AIs should therefore refer to relevant SPM modules when implementing the requirements of OR-2. Besides the revised TM-G-2, these also include SA-2 on “Outsourcing” and the forthcoming revised OR-1 on “Operational Risk Management”, which is being refined having regard to comments received from the

• 2 - industry, and will amongst others, reflect those requirements related to operational risk management contained within the POR. Implementation timeline After factoring in industry feedback, and as detailed within the OR-2 module, the HKMA will expect every AI to have: (i) developed its operational resilience framework and determined the timeline by which it will become operationally resilient, within 1 year after the final OR-2 module is issued (i.e. 31 May 2023); and (ii) become operationally resilient as soon as their circumstances allow and no later than 3 years after the initial 1-year planning period (i.e. no later than 31 May 2026). The above timeline applies to all new requirements related to operational resilience, including those contained in the revised TM-G-2 and the revised OR-1. An AI should therefore be compliant with those requirements relating to the development of its operational resilience framework by 31 May 2023, and those relating to the implementation of the framework no later than 31 May 2026. Should you have any questions regarding the above, please contact Ms Joanna Chan on 2878 8694 or Ms Joyce Cheung on 2878 1494. Yours faithfully, Raymond Chan Executive Director (Banking Supervision) Encl c.c. The Chairperson, The Hong Kong Association of Banks The Chairperson, The DTC Association FSTB (Attn: Mr Justin To)