Supervisory Policy Manual SPM OR-1 Operational Risk Management

Our Ref: Circulars 28 Nov 2005 Supervisory Policy Manual ("SPM"): OR-1 Operational Risk Management B1/15C B1/21C 28 November 2005 The Chief Executive All authorized institutions Dear Sir / Madam, Supervisory Policy Manual ("SPM"): OR-1 Operational Risk Management I am pleased to inform you that, following consultation with the industry, the Monetary Authority is issuing the above SPM module today. Background Globally, failure to implement proper processes and procedures to control operational risks has resulted in significant operational losses for some banks in recent years. Thus there is a growing appreciation of a need to establish a sound framework of enhancing operational risk management and to take a more proactive approach to managing operational risk. To foster a greater understanding of current industry trends and practices for managing operational risk, the Basel Committee issued a paper entitled "Sound Practices for the Management and Supervision of Operational Risk" in 2003. Moreover, Basel II introduces an explicit capital charge for a bank's operational risk under Pillar I. It further requires the use of more advanced measurement approaches i.e. the Standardised Approach (STO) (and Alternative Standardised Approach (ASA)) or the Advanced Measurement Approaches be conditional upon the fulfilment of specific operational risk management criteria. Against the above background, the HKMA developed the above SPM module, drawing reference to the Basel Committee paper, the surveys or guidance issued by other supervisory authorities and professional bodies, and the policies and practices of some large international banks. Objectives and implementation The key objectives of the module are to provide:

a. high level guidance to all AIs on the development of an appropriate operational risk framework which covers the organisational structure for operational risk management, risk culture, and policies and procedures for identifying, assessing, monitoring, and controlling operational risk; and b. additional guidance on how the qualitative criteria for using either the STO or ASA for calculation of operational risk capital charge under Basel II may be met by AIs. The HKMA recognises that operational risk management as a separate discipline remains at an early stage of development compared with some other areas of risk management. The various techniques and tools used to identify, assess, monitor and report operational risk exposures are still evolving. The module therefore sets out "sound practices" rather than "statutory requirements" on operational risk management. AIs are expected to develop an operational risk management framework consistent with the guidance in this module and commensurate with their size, complexity, and risk profile. No specific implementation date is proposed in the module as we wish to continue to monitor how the management of operational risk is evolving in leading banks internationally and the progress of the local banking industry in developing and implementing risk management systems for operational risk. However, AIs intending to use the STO or ASA to calculate operational risk capital charge starting from 1 January 2007 will need to consider the guidance, where appropriate, in assessing their compliance with the qualitative criteria for using such approaches. Approval for using STO or ASA Following issue of this SPM module, the HKMA will start receiving applications from locally incorporated AIs for using the STO or ASA to calculate operational risk capital charge. STO or ASA aspirants should notify the HKMA of their intention and demonstrate that they meet all the relevant qualifying criteria in writing. The qualifying criteria are set out in the consultation paper on "Weighting Framework for Operational Risk" issued in February 2005. We do not intend to issue any template or application pack. To demonstrate that they meet all the relevant qualifying criteria, AIs should provide the HKMA with a brief description of their existing operational risk management framework and information on their operational risk management policy and arrangements in the applications. Furthermore, AIs should also submit their policies and procedures for mapping their gross income for current business lines and activities into the STO framework. Verification of compliance with the relevant qualifying criteria, while not necessarily form part of the approval process, may be covered in a subsequent on-site examination. Online access to the SPM module is available under the icon of "Supervisory Policy Manual" in the HKMA's public (http://www.info.gov.hk/hkma) and private websites. Should you have any question relating to this module, please feel free to contact Ms Rose Luk on 2878 1638 or Ms Aloysia Wong on 2878 8743. Yours faithfully,

c.c. Simon Topping Executive Director (Banking Policy) The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association FSTB (Attn: Mr. Clement Chan) Last revision date : 01 August 2011