Supervisory Review Process

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To (i) set out the MA’s approach to conducting the SRP under Pillar 2, including the criteria and standards used for evaluating an AI’s capital adequacy and, where applicable, the effectiveness of the AI’s CAAP, for the purposes of determining its minimum CAR under §97F of the Banking Ordinance; and (ii) describe how the Pillar 2 framework will operate under the capital adequacy framework Classification A statutory guideline issued by the MA under §16(10) of the Banking Ordinance Previous guidelines superseded CA-G-5 “Supervisory Review Process” (V.1) dated 10.11.06; and CA-G5 “Supervisory Review Process” (V.2) dated 04.06.10 Application To all locally incorporated AIs Structure

Introduction
1.1 Terminology
1.2 Background and scope
1.3 Main objectives and principles
1.4 Implementation
The MA’s approach to supervisory review

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12.1 General
2.2 Legal framework
2.3 Operation of Pillar 2 under capital adequacy framework
2.4 Key components of SRP
2.5 Supervisory arrangements
2.6 Application to local banking groups
2.7 Application to foreign bank subsidiaries
2.8 Review and notification of SRP results
3. Supervisory review of capital adequacy
3.1 General
3.2 Key factors for assessing capital adequacy
3.3 Setting of Pillar 2 capital requirement
3.4 Treatment of overlap with capital buffers
3.5 Determination of §97F minimum CAR
3.6 Integration with risk-based supervisory process
3.7 Use of stress tests
3.8 Supervisory guidance on risk management practices
3.9 Ongoing monitoring of capital adequacy
4. Supervisory standards on CAAP
4.1 General
4.2 Board and senior management oversight
4.3 Key elements of CAAP
4.4 Additional criteria for use of risk-modelling techniques
4.5 Requirements for consolidated capital
4.6 Application to subsidiary AIs
4.7 Review by the MA
Annex A List of major supervisory guidelines applicable to assessment of
capital adequacy

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Annex B Factors for assessing capital adequacy under SRP
Annex C Scoring worksheets to facilitate assessment under SRP
Annex D Supervisory requirements on application of stress tests under
CAAP
Annex E Assessment of securitization risk and off-balance sheet exposures
under CAAP / SRP
Annex F Assessment of risk concentrations under CAAP
Annex G Assessment of high cost credit protection transactions under SRP
Annex H Assessment of counterparty credit risk under CAAP / SRP

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

Introduction
1.1 Terminology
1.1.1 Abbreviations and other terms used in this module have
the following meanings 1
:

“Additional Tier 1 capital” means Additional Tier 1
capital as defined in §39 of the Banking (Capital) Rules;
“Banking (Capital) Rules” mean those rules made by
the MA under §97C(1) of the Banking Ordinance for prescribing capital requirements for AIs incorporated in Hong Kong, taking into account the risks associated with the AIs;
“basic approach”, in relation to the calculation of an
AI’s credit risk, means the method of calculating that risk as set out in Part 5 of the Banking (Capital) Rules;
“BCR minimum CAR” means the minimum CET1
capital ratio, Tier 1 capital ratio and Total capital ratio prescribed in §3A or §3B of the Banking (Capital) Rules, as the case requires;
“CAAP” means the capital adequacy assessment
process that an AI uses to identify and measure the risks it faces and to assess how much capital is needed to support those risks;
“CAR” means the capital adequacy ratio of an AI as
defined in §3 of the Banking (Capital) Rules, which comprises three risk-weighted capital ratios, viz. CET1 capital ratio, Tier 1 capital ratio and Total capital ratio. Unless otherwise specified, any

To facilitate understanding by AIs, the meanings set out in this subsection in respect of certain terms defined in the Banking (Capital) Rules are recast, elaborated or simplified. AIs should refer to the Rules for the legal interpretation, as well as the most up-to-date definitions, of these terms.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 reference to CAR in this module should be read as a reference to the three ratios, both individually and collectively;

“capital add-on”, in relation to an AI’s §97F minimum
CAR, means that portion of the §97F minimum CAR which is in excess of the BCR minimum CAR. For the avoidance of doubt, the capital add-on referred to here is in terms of each of the three risk-weighted capital ratios that comprise the CAR. For example, under §3A of the Rules, the minimum CET1 capital ratio, Tier 1 capital ratio and Total capital ratio for 2013 are set at 3.5%, 4.5% and 8% respectively. If the MA requires an AI to observe a higher minimum CET1 capital ratio (at 3.9%), Tier 1 capital ratio (at 5.1%) and Total capital ratio (at 9%) under §97F, the capital add-on for the AI in respect of each of the three ratios is respectively 0.4%, 0.6% and 1%. The MA determines the capital add-on of individual AIs as part of the SRP;
“capital buffers” 2 mean the capital conservation
buffer and the countercyclical capital buffer set out respectively in sections III and IV of Basel III: A global regulatory framework for more resilient banks and banking systems (revised) issued by the Basel Committee in June 2011. The capital buffers may be extended to cover other requirements (e.g. higher loss absorbency requirements applicable to global and domestic systemically important banks) 3 ;
“CET1 capital” means Common Equity Tier 1 capital
as defined in §38 of the Banking (Capital) Rules;

The Banking (Capital) Rules will be amended to implement the requirements for AIs to hold capital buffers from 1 January 2016. See the document A framework for dealing with domestic systemically important banks issued by the Basel Committee in October 2012 and the final rules for global systemically important banks Global systemically important banks: assessment methodology and the additional loss absorbency requirement endorsed by the G20 Leaders in November 2011.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

“CET1 capital ratio” means the Common Equity Tier
1 capital ratio defined in §2(1) of the Banking (Capital) Rules. This ratio, expressed as a percentage, is the amount of an AI’s CET1 capital to the sum of the AI’s risk-weighted amount for credit risk, risk-weighted amount for market risk, and riskweighted amount for operational risk, as determined in accordance with the Banking (Capital) Rules;
“counterparty credit risk” means counterparty default
risk and CVA risk, as defined in §2(1) of the Banking (Capital) Rules;
“counterparty default risk”, in relation to a derivative
contract or securities financing transaction entered into by an AI with a counterparty, means the risk that the counterparty could default before the final settlement of the cash flows of the contract or transaction, as the case may be, as defined in §2(1) of the Banking (Capital) Rules;
“CVA risk” means the risk of mark-to-market losses
in a transaction with a counterparty arising from a change in the credit valuation adjustment for the counterparty, as defined in §226A of the Banking (Capital) Rules;
“default risk exposure” means an AI’s exposure to
the counterparty default risk of a counterparty;
“IMM approach” means the method of calculating an
AI’s market risk under the internal models approach as set out in Divisions 11 and 12 of Part 8 of the Banking (Capital) Rules;
“IMM(CCR) approach” means the method of
calculating an AI’s default risk exposure under the internal models (counterparty credit risk) approach as set out in Division 2 of Part 6A of the Banking (Capital) Rules;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

“internal capital” means the amount of capital that an
AI holds and allocates internally as a result of the AI’s assessment of the risks it faces;
“IRB approach” means the method of calculating an
AI’s credit risk under the internal ratings-based approach as set out in Part 6 of the Banking (Capital) Rules;
“Pillar 1” means the framework set out in the Banking
(Capital) Rules for calculating the minimum amount of capital that an AI should maintain in respect of its credit, market and operational risks. Starting from 1 January 2016, this framework will include the requirements for AIs to hold capital buffers;
“Pillar 2” means the framework set out in this
module for determining any additional capital that an AI should hold, in the form of a capital add-on, principally to cover risks not captured, or risks not adequately captured, under Pillar 1. This framework has two key elements: (i) the CAAP conducted by AIs and (ii) the SRP undertaken by the MA;
“Pillar 2 capital requirement” means the capital
requirement that an AI is required to maintain in respect of its Pillar 2 risks, as derived from the SRP. This capital requirement will form the basis for determining an AI’s §97F minimum CAR (i.e. its CET1 capital ratio, Tier 1 capital ratio, and Total capital ratio) in accordance with the apportionment method set out in subsection 3.5 4 ;
“Review Tribunal” means the Banking Review
Tribunal established by §101A of the Banking Ordinance. An AI aggrieved by a decision made by

Effective from 1 January 2016 when the capital buffers are implemented, the §97F minimum CAR (derived from the Pillar 2 capital requirement) will be adjusted to remove the effect of any overlap of the Pillar 2 capital requirement with the capital buffers, in accordance with the methodology set out in subsection 3.4.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 the MA in relation to the AI, to which §101B applies, may apply to the Tribunal under §101B of the Ordinance for a review of the decision. The MA’s decision under §97F of the Ordinance is a decision to which §101B applies;

“§97F minimum CAR” means the minimum CET1
capital ratio, Tier 1 capital ratio and Total capital ratio set by the MA for an individual AI pursuant to §97F of the Banking Ordinance;
“SRP” means the supervisory review process
conducted by the MA for the purposes of evaluating and monitoring the capital adequacy of individual AIs, and of determining their Pillar 2 capital requirement and, ultimately, their §97F minimum CAR;
“STM approach” means the method of calculating an
AI’s market risk under the standardized (market risk) approach as set out in Part 8 of the Banking (Capital) Rules;
“Tier 1 capital ratio” means the Tier 1 capital ratio
defined in §2(1) of the Banking (Capital) Rules. This ratio, expressed as a percentage, is the amount of an AI’s Tier 1 capital to the sum of the AI’s riskweighted amount for credit risk, risk-weighted amount for market risk and risk-weighted amount for operational risk, as determined in accordance with the Banking (Capital) Rules;
“Tier 2 capital” means Tier 2 capital as defined in
§40 of the Banking (Capital) Rules;
“Total capital ratio” means the Total capital ratio
defined in §2(1) of the Banking (Capital) Rules. This ratio, expressed as a percentage, is the amount of an AI’s Total capital to the sum of the AI’s riskweighted amount for credit risk, risk-weighted amount for market risk and risk-weighted amount for

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 operational risk, as determined in accordance with the Banking (Capital) Rules.
1.2 Background and scope
1.2.1 The MA has conducted the SRP on AIs since 1 January
2007 as part of its risk-based supervisory process. The main purposes of the SRP are to assess AIs’ capital adequacy and determine if they should hold additional capital to cater for risks that are not covered, or not adequately covered, under Pillar 1. The scope and extent of applying the assessment standards and criteria under the SRP are commensurate with the nature, size and complexity of the business operations of individual AIs.
1.2.2 The basic elements of the SRP are embedded in the
MA’s supervisory framework. With the power conferred upon him under §97F of the Banking Ordinance 5 , the MA may require AIs to observe a minimum CAR 6 in excess of the BCR minimum CAR, depending on the MA’s assessment of the risk profile of individual AIs. This is with the aim of assigning a minimum CAR to each AI that reflects more precisely the range of risks associated with the AI and to which it is potentially exposed.
1.2.3 A major feature of the SRP is the use by the MA of a
detailed and rigorous assessment framework for setting the §97F minimum CAR of individual AIs, taking into account their overall risk profile and risk management systems, the extent to which they are associated with, or exposed to, risks that are outside the realm of Pillar 1 and, where applicable, the effectiveness of their CAAP.
1.2.4 This module sets out the approach that the MA adopts in
conducting the SRP, including a description of:

§97F of the Banking Ordinance provides the MA with the power to vary any capital requirement rule (which includes the BCR minimum CAR) applicable to an AI if he is satisfied, on reasonable grounds, that it is prudent to make the variation, taking into account the risks associated with the AI. For the avoidance of doubt, the CAR referred to in this module covers the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio, individually and collectively, unless otherwise specified.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

the main principles and objectives underlying the
SRP;
the key assessment factors that the MA considers in
determining the Pillar 2 capital requirement and, ultimately, the §97F minimum CAR of individual AIs, and the supervisory arrangements and procedures associated with the assessment;
the supervisory approach to reviewing the CAAP of
individual AIs, including the standards and requirements expected of them; and
the process for ongoing monitoring of AIs’ capital
adequacy and compliance with the Banking (Capital) Rules.
1.2.5 The main purpose of this revision of the module is to
reflect various adjustments to the Pillar 2 framework, which have been made necessary by the implementation of the Basel III capital framework 7 in Hong Kong. The first phase of implementation of Basel III will commence on 1 January 2013 through amendments to the Banking Ordinance and Banking (Capital) Rules.
1.2.6 Some legislative amendments (including prospective
amendments relating to capital buffers) for implementing Basel III will affect the operation of Pillar 2. These include:
the imposition of three risk-weighted capital ratios
(i.e. the CET1 capital ratio, Tier 1 capital ratio, and Total capital ratio) on AIs, compared with the requirement of one single risk-weighted capital ratio 8 before 1 January 2013;

This refers to Basel III: A global regulatory framework for more resilient banks and banking systems (revised in June 2011) issued by the Basel Committee. This refers to the minimum CAR of 8% stipulated in §98(1) of the Banking Ordinance (to be repealed on 1 January 2013).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

the introduction of two capital buffers (i.e. the capital
conservation buffer and countercyclical capital buffer) from 1 January 2016;
the removal of any upper limit for the variation of the
BCR minimum CAR of individual AIs 9 ;
the phase-in of new capital requirements (including
the CET1 capital ratio, Tier 1 capital ratio and capital buffers) over a period of up to six years to achieve full implementation by 1 January 2019;
the formalisation of procedures for notification and
the making of representations in respect of any proposed variation by the MA of any capital requirement rule (including in respect of the variation of the BCR minimum CAR) for an individual AI under §97F of the Banking Ordinance; and
the inclusion of a decision of the MA under §97F of
the Ordinance in relation to an AI as a decision in respect of which the AI may apply under §101B of the Ordinance to the Review Tribunal for a review.
1.2.7 The adjustments referred to in para. 1.2.5, which are set
out in subsections 2.3, 3.4 and 3.5, relate to:
the operation of Pillar 2 within the capital adequacy
framework (including the positioning of the Pillar 2 capital requirement in the capital hierarchy);
the approach to allocating the Pillar 2 capital
requirement amongst the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio;

§101 of the Banking Ordinance (to be repealed on 1 January 2013) provides that the MA may, after consultation with an AI, vary the AI’s minimum CAR by increasing it to not more than 16%. This effectively constrained the maximum size of an AI’s capital add-on to 8%. No upper limit for such variation is specified in §97F of the Ordinance.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

the methodology for identifying any overlap between
the Pillar 2 capital requirement and the capital buffers (when these are implemented on 1 January

and the approach to addressing any such
overlap; and

the manner in which the phase-in arrangements for
the BCR minimum CAR and capital buffers (when the buffers are implemented on 1 January 2016) will be reflected in the determination of the capital addon of individual AIs.
1.2.8 Other revisions of the module (e.g. changes to Annex B
and Annex E, and inclusion of Annex G and Annex H) are principally designed to provide more guidance on the assessment of high cost credit protection transactions, counterparty credit risk and securitization risk under the SRP, taking into account the latest standards and guidance issued by the Basel Committee.
1.2.9 This module should be read in conjunction with the
Banking (Capital) Rules and other supervisory guidelines, including the modules of the Supervisory Policy Manual, issued by the MA that are relevant to the assessment of AIs’ capital adequacy (see a list of such guidelines in
Annex A).
1.3 Main objectives and principles
1.3.1 The SRP is an important and integral part of the capital
adequacy framework. Its main objectives are to:
facilitate supervisory monitoring of the capital
adequacy of AIs to support the risks in their business activities;
encourage AIs to enhance their risk management
techniques for monitoring and controlling such risks; and
provide the impetus for AIs to adopt more active
capital planning and management practices.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
1.3.2 In conducting the SRP, the MA is guided by the following
principles which should help achieve the objectives outlined in para. 1.3.1:

AIs should have an internal process for assessing
their overall capital adequacy in relation to their risk profile and a strategy for maintaining the required level of capital (“the first SRP principle”);
the MA has the responsibility of reviewing AIs’
internal capital adequacy assessments and determining whether the resultant capital position is adequate (“the second SRP principle”);
the MA expects AIs to operate above the BCR
minimum CAR and has the power to require AIs to do so (“the third SRP principle”); and
the MA seeks to intervene at an early stage to
prevent AIs’ capital from falling below prudent levels (“the fourth SRP principle”).
1.3.3 The manner in which the MA applies the four SRP
principles through the legal powers conferred upon him under the Banking Ordinance is elaborated in subsection 2.2.
1.4 Implementation
1.4.1 The revised Pillar 2 framework set out in this module will
take effect from 1 January 2013, to coincide with the commencement of the relevant provisions of the Banking (Amendment) Ordinance 2012 and the Banking (Capital) (Amendment) Rules 2012.
1.4.2 The MA will serve a notice on AIs under §97F of the
Banking Ordinance specifying the minimum CET1 capital ratio, Tier 1 capital ratio and Total capital ratio applicable to them 10 from 1 January 2013, which will be

10 AIs will also be informed of the corresponding non-statutory trigger ratios (see also para. 2.2.4).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 derived by reference to the minimum CAR 11 of each AI immediately in force before that date and according to the apportionment method set out in subsection 3.5. Subject to any representations that may be made by an AI, the three minimum capital ratios (constituting the §97F minimum CAR of the AI) will be in force until otherwise advised by the MA, following the conduct of an SRP on the AI after 1 January 2013.
1.4.3 Under the SRP, AIs (save for those falling within the
exceptions in subsection 4.1.2) are expected to conduct their CAAP in line with the standards in section 4. The MA will attach increasing importance to reviewing the adequacy of an AI’s CAAP as part of the SRP taking into account that the CAAP requirement has been in place since 2007 and since that time AIs have had an opportunity to develop, refine and improve their proficiency in conducting internal capital assessment, capital planning and capital allocation.
1.4.4 The MA’s assessment of an AI’s CAAP will feed into the
MA’s overall assessment of the AI’s capital adequacy, and may result in a change in the AI’s Pillar 2 capital requirement and, if significant weaknesses are observed in the AI’s CAAP, the institution of appropriate supervisory measures.
2. The MA’s approach to supervisory review
2.1 General
2.1.1 This section provides an overview of the legal backing
that the MA derives from the Banking Ordinance for determining the minimum CAR of AIs through the SRP under Pillar 2 (see subsection 2.2), elaborates on the operation of Pillar 2 within the capital adequacy framework (see subsection 2.3), and highlights the key components that make up the SRP (see subsection 2.4).

11 This refers to the minimum CAR imposed on the AI under §101 of the Banking Ordinance (to be repealed on 1 January 2013).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
2.1.2 Other supervisory arrangements relevant to the conduct
of the SRP, including (i) its application to local banking groups and foreign bank subsidiaries; and (ii) the associated notification, representation and appeal procedures, are set out in subsections 2.6 to 2.8.
2.2 Legal framework
2.2.1 The Banking Ordinance provides the MA with sufficient
powers to enforce the four SRP principles set out in subsection 1.3.
2.2.2 Under Paragraph 6 of the Seventh Schedule to the
Banking Ordinance, AIs are obliged to satisfy the MA that they maintain, on and after authorization, adequate financial resources (whether actual or contingent) for the nature and scale of their operations. This provides the basis for AIs to conduct internal capital assessments under the CAAP (i.e. the first SRP principle) and the MA to review such assessments (i.e. the second SRP principle) so as to ascertain that AIs have adequate financial resources.
2.2.3 While §3A and §3B of the Banking (Capital) Rules
require AIs to maintain the BCR minimum CAR 12, §97F of the Banking Ordinance in empowering the MA to vary any capital requirement rule in effect enables the MA to impose a capital add-on on individual AIs, based on the MA’s assessment of their capital adequacy (i.e. the third SRP principle).
2.2.4 Consistent with the fourth SRP principle, all AIs are
required to observe non-statutory trigger ratios above their §97F minimum CAR. The trigger ratios are intended to provide a cushion to reduce the risk of an AI breaching its minimum CAR and to provide an early warning signal of deterioration in its capital adequacy. The MA will continue using this tool to monitor AIs’

12 The level of the BCR minimum CAR will differ between 2013 and 2016 according to the phase-in arrangements set out in §3A and §3B of the Banking (Capital) Rules.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 capital adequacy until 31 December 2015. When the capital buffers commence operation on 1 January 2016, the use of trigger ratios for AIs will be discontinued. Nevertheless, AIs will be expected to ensure that they have comparable internal targets or monitoring tools so that timely discussion with the MA can be undertaken if their capital levels fall close to the buffer zone.
2.2.5 Whilst the trigger ratios are specifically tailored for each
AI, they will be set at a level that is not lower than a floor percentage above an AI’s §97F minimum CAR (i.e. the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio). The floor percentage applicable to each of the three capital ratios is derived by apportioning 0.5% to the ratios based on the split for the underlying BCR minimum CAR in force during the period between 2013 and 2015. The relevant floor percentages are summarised in Table 1 below:
Table 1 – Floor Percentages for Trigger Ratios between 2013 and 2015
Floor Year percentages for trigger ratios in respect of:
2013 2014 2015
CET1 capital ratio
0.219% 0.250% 0.281%
Tier 1 capital ratio
0.281% 0.344% 0.375%
Total capital ratio 0.500% 0.500% 0.500%
2.2.6 Where an AI’s trigger ratios are set at levels above the
floor percentages, the same apportionment method described above will be used except that 0.5% will be replaced by the higher trigger level used. For example, if a higher trigger level of 1% (instead of 0.5%) is applied to an AI in 2013, the levels above the AI’s minimum CET1 capital ratio, Tier 1 capital ratio and Total capital ratio at which its trigger ratios are to be set will be respectively 0.438%, 0.563% and 1%.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
2.2.7 The fourth SRP principle is further reinforced by §97D(1)
and §97E(2) of the Banking Ordinance which respectively require an AI to (i) notify the MA immediately regarding a matter prescribed in the Banking (Capital) Rules (which may concern a failure to comply with a minimum capital requirement (and, in this regard, §3D of the Banking (Capital) Rules requires an AI to notify the MA immediately of any failure to maintain the §97F minimum CAR)); and (ii) take remedial action, as specified by the MA, to comply with the capital requirement concerned.
2.2.8 Failure of an AI to meet the statutory requirements may
call into question whether the AI continues to satisfy the authorization criterion stipulated in Paragraph 6 of the Seventh Schedule to the Banking Ordinance.
2.2.9 Under §97D(3) and §97E(4) of the Banking Ordinance,
every director, chief executive and manager of an AI has the legal responsibility to ensure that the AI complies with the MA’s requirements under §97D(1) and §97E(2) of the Ordinance. Such persons may commit an offence and be liable to prosecution if the AI fails to comply with the requirements.
2.2.10 If an AI is aggrieved by the MA’s decision to vary the AI’s
minimum CAR under §97F of the Banking Ordinance, the AI may apply to the Review Tribunal for a review of that decision under §101B(1) of the Ordinance.
2.3 Operation of Pillar 2 under capital adequacy framework
2.3.1 The MA derives the Pillar 2 capital requirement for AIs
through the SRP, and the Pillar 2 capital requirement will be used in turn to determine the capital add-on (and hence the §97F minimum CAR) applicable to them.
2.3.2 The MA intends to implement the requirement for AIs to
hold more capital in the form of capital buffers, in addition to their §97F minimum CAR, from 1 January 2016 in line with the Basel III implementation timetable.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Notwithstanding this, the MA considers that there is still a need to retain the SRP for ensuring that AIs hold, and continue to hold, sufficient capital against all of the major risks associated with them. This includes not just the Pillar 1 risks (credit, market and operational) but also other Pillar 2 risks that are not covered, or not adequately covered, under Pillar 1. The MA’s approach also recognises that the capital buffers, which are intended to be general cushions of capital above the minimum CAR available for use during periods of stress, do not address specific risks in the same way as the SRP.
2.3.3 Nevertheless, the assessment framework under the SRP
has been refined to address any potential overlap between the Pillar 2 capital requirement and the capital buffers when the latter come into effect on 1 January 2016 (see subsection 3.4 for more details). Restructuring of Pillar 2 capital requirement
2.3.4 To cater for the implementation of the capital buffers from 1
January 2016, the Pillar 2 capital requirement (“P2”) will, from 1 January 2016 onwards, be differentiated into two constituent parts:

P2A which relates to the portion of the Pillar 2
capital requirement that reflects risks not captured, or not adequately captured, in Pillar 1 (the risks involved being similar to the eight inherent risks 13 identified by the MA for the purpose of risk-based supervision). This portion of the Pillar 2 capital requirement will be treated in the same way as the capital held against Pillar 1 risks and will be included in, and counted as, a constituent part of the §97F minimum CAR applicable to an AI; and
P2B which relates to the portion of the Pillar 2
capital requirement that provides a cushion of capital to bolster resilience in times of stress (and

13 See para. 3.2.3 for more details.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 hence should be allowed to be used in such times) and that is not directly associated with P2A risks. This part of the Pillar 2 capital requirement can therefore be regarded as akin in nature to the capital buffers and should, logically therefore be (i) constituted solely by CET1 capital (to ensure loss absorbency on a going concern basis) and (ii) absorbed into the buffers. See subsection 3.4 for more details on the assessment factors underlying P2A and P2B, the rationale underlying their capital treatment, and how P2A and P2B will operate when the capital buffers are implemented. Key components of capital hierarchy
2.3.5 Table 2 below illustrates the key components of the capital
hierarchy (and the positioning of Pillar 2 within that hierarchy) within 2013 and 2015, and from 2016 onwards.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Table 2–Key Components of Capital Hierarchy
Building block Components Explanatory notes §97F minimum CAR • CET1 capital ratio (BCR minimum CAR + apportioned P2 14)

Tier 1 capital ratio (BCR
minimum CAR + apportioned P2)
Total capital ratio (BCR
minimum CAR + apportioned P2)
All three minimum capital
ratios (including the respective AI-specific capital add-ons) must be met at all times
From 2016 onwards, P2
will be replaced by P2A when determining the capital add-on for the three ratios. Capital buffers (requirements to be incorporated into the Banking (Capital) Rules for implementation from 1 January 2016)
Capital conservation
buffer (in CET1 capital) 15
Countercyclical capital
buffer (in CET1 capital)
Falling below the buffer
levels will render AIs subject to restrictions (e.g. reducing distribution of earnings)
From 2016 onwards,
P2B (in CET1 capital) will be a part of, and in effect absorbed into, the buffers Non-statutory trigger ratios (will be discontinued upon the implementation of the capital buffers from 1 January 2016)
Three trigger ratios, set at
a certain percentage point above each of the three minimum capital ratios (see also para. 2.2.4 - 2.2.6)
A monitoring tool to
facilitate early intervention in respect of any prospective failure to comply with the capital requirements
Will be replaced by AIs’
comparable internal capital targets or monitoring tools from 1 January 2016

14 See subsection 3.5 for details on the apportionment approach of the Pillar 2 capital requirement to the three minimum capital ratios. 15 This buffer may be extended to include higher loss absorbency requirements applicable to global and domestic systemically important banks.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Order of applying CET1 capital 16
2.3.6 For the avoidance of doubt, the CET1 capital held by an AI
must be applied in the order set out in Table 3 below, i.e. the CET1 capital will first be used to meet the three minimum capital ratios that constitute the §97F minimum CAR before the remainder can contribute to the capital buffers (which will be treated as one single buffer for this purpose) when they come into operation from 1 January 2016.
Table 3 – Order of Application of CET1 Capital
Order Capital requirement
1 CET1 capital ratio
2 Tier 1 capital ratio
3 Total capital ratio
4 Capital conservation buffer and countercyclical capital buffer (from 1 January 2016)
2.4 Key components of SRP
2.4.1 The SRP conducted on an AI typically consists of the
following key components:

Review of the AI’s risk profile – the MA forms a view
of the AI’s overall risk profile as part of the MA’s ongoing risk-based supervision, with the purpose of assessing those risk and control factors that may justify the imposition of additional capital requirements on the AI;

16 The order of applying CET1 capital set out in para. 2.3.6 and Table 3 will take effect when the capital buffers come into operation on 1 January 2016.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

Review of the AI’s CAAP – for AIs that are subject to
the CAAP standards set out in section 4, the MA assesses their CAAP as part of the SRP. This review includes a consideration of the assumptions, methodology, coverage and outcome of an AI’s CAAP, with a view to ascertaining the adequacy and effectiveness of the AI’s CAAP;
Determination of the AI’s §97F minimum CAR and/or
other supervisory measures – the MA considers whether the AI’s existing minimum CAR remains appropriate or needs to be changed by applying the assessment framework set out in section 3 to the results and findings gathered from the above reviews. The MA may also require the AI to take other actions to rectify any system or control deficiencies identified during the SRP. The assessment results, including any supervisory measures proposed, are subject to an independent review process described in subsection 2.8;
Communication of SRP results to the AI – after
completion of the SRP, the MA discusses with the AI the results of his assessment, including any areas of concern which may lead to an increase in its §97F minimum CAR (meaning that the MA will have to propose a variation of the BCR minimum CAR of the AI under §97F of the Banking Ordinance) 17. The MA will explain in sufficient detail the factors which have led to his assessment and recommend what actions the AI should take to address the concerns. 18 If the MA is to invoke his §97F power to vary the AI’s minimum CAR, the AI will be notified of the proposed variation and the grounds for variation

17 For example, if the Total capital ratio of the AI is to be increased from 10% to 11% against the BCR minimum Total capital ratio of 8%, the MA will propose under §97F of the Banking Ordinance to increase the AI’s minimum Total capital ratio by 3% to 11%. 18 To facilitate AIs’ capital planning, the MA will, in advance of the restructuring of the Pillar 2 capital requirement coming into effect in 2016 (say, in the latter part of 2014) inform individual AIs of their P2A / P2B split.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 (and given the opportunity to make representations to the MA) before a decision is finalised, pursuant to §97F of the Ordinance. A mechanism for the AI to apply to the Review Tribunal for review of the MA’s decision is also available under §101B of the Ordinance;

Ongoing monitoring of the AI’s capital adequacy –
this is to monitor that the AI complies with the various regulatory capital standards and requirements applicable to it on a continuing basis. The MA updates the AI’s risk profile regularly, taking into account its progress in addressing any supervisory concerns raised or other events which may significantly affect the AI’s ability to monitor and ensure compliance with the Banking (Capital) Rules.
2.4.2 The SRP is designed to generate an active dialogue with
the AI concerned regarding the fulfilment of capital adequacy and risk management standards, through which the MA seeks to:
gain deeper insights into the AI’s overall control and
risk management framework;
establish a closer understanding of how the AI
approaches the risks that are not covered under Pillar 1 and the amount of internal capital allocated to them;
understand the mechanisms the AI has maintained
for identifying, measuring, monitoring, controlling, mitigating and reporting its risks; and
assess the extent to which the AI’s CAAP, where
applicable, may be relied upon as a factor to be considered in the MA’s evaluation of the AI’s capital adequacy.
2.4.3 Diagram 1 below provides a graphical presentation of the
key components of the SRP described above.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Diagram 1 – Key Components of SRP
2.5 Supervisory arrangements
2.5.1 The MA performs the SRP on each AI regularly
(normally once a year) as part of the MA’s ongoing riskbased supervision. The scope of the SRP covers all significant business activities of the AI, whether operating locally or overseas, on a solo and/or consolidated basis.
2.5.2 When carrying out the SRP, the MA adopts a forwardlooking approach to the extent that he will take stock of
any significant changes (either arising from institutional or external conditions) to the AI’s overall risk profile in the past year and assess how these changes will affect the AI and its business plans and prospects in the coming year. For this purpose, the MA takes into account the (increase in minimum CAR and/or other appropriate supervisory measures) INDEPENDENT REVIEW OF SRP RESULTS Supervisory monitoring of ongoing compliance with regulatory capital requirements & standards Review and evaluate compliance with minimum requirements and standards for calculation of CAR SUPERVISORY FINDINGS G o v e r n a n c e C o r p o r a t e AI being assessed SRP conducted by the MA SUPERVISORY ACTION Identify, review and evaluate all risk and control factors of AI via risk-based supervision Review and evaluate AI's CAAP (where applicable) Capital strength and CAAP (with stress-testing applied) Systems and controls Other relevant factors Inherent risks APPLICATION OF SRP ASSESSMENT FRAMEWORK DIALOGUE COMMUNICATION OF SRP RESULTS (with consultation on increase in minimum CAR where applicable)

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 results of any offsite reviews and onsite examinations, and makes use of any relevant information obtained from various sources such as prudential interviews, banking returns and routine supervisory contacts.
2.5.3 The MA takes a proportionate approach when applying
the SRP to AIs of varying size and complexity. In other words, the frequency, intensity and depth of the SRP will be determined by the potential risk that the AI poses to the supervisory objectives of the MA. For example, the MA may subject large and sophisticated AIs to a somewhat more in-depth and comprehensive SRP than would be applied to AIs with less complex operations. The MA would not expect AIs with less complex operations to have such sophisticated risk management systems and CAAP, and hence the SRP conducted on such AIs is likely to be less intense and frequent. In categorising AIs, the MA takes account of factors such as the AI’s business nature, scale of operations (i.e. size, risk profile and complexity), history of regulatory compliance and role in the financial system or other supervisory objectives.
2.5.4 The SRP does not replicate or supplant the role of the
Board and senior management of AIs. The primary responsibility for ensuring that an AI has adequate capital to support its risk profile rests squarely with its Board and senior management.
2.5.5 The SRP includes a review of the appropriateness of the
minimum CAR of an AI. The minimum CAR is set on a solo basis to monitor the AI’s capital adequacy on a standalone basis, unless the MA’s prior approval is obtained for allowing the AI to consolidate some of its subsidiaries in the calculation of a solo-consolidated CAR (i.e. the AI is not required to deduct its investment in those subsidiaries from its solo capital base) subject to the meeting of certain conditions. If the AI has one or more subsidiaries that are to be consolidated for capital adequacy purposes under §3C of the Banking (Capital)

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Rules, the minimum CAR is also set on a consolidated basis.
2.5.6 The MA may involve third parties to assist him in
conducting the SRP. Under §59(2) of the Banking Ordinance, the MA has the power to require an AI, after consultation with the AI, to provide an auditors’ report on such matters as he may specify for the performance of his functions under the Ordinance. The MA may exercise this power to commission an auditors’ report when he considers that an independent assessment of the AI’s capital adequacy or risk management processes is warranted. To avoid any potential conflict of interest, the external auditor(s) appointed by the AI for the purpose of preparing this report will be approved by the MA, and the appointed auditor(s) may not necessarily be the AI’s existing auditor(s).
2.6 Application to local banking groups
2.6.1 The MA, as the home supervisor of a local banking
group 19, applies the SRP to the group as a whole, and monitors the group’s capital adequacy at the consolidated level.
2.6.2 The SRP assesses all the major risks of the local
banking group, whether arising from banking or nonbanking activities (such as securities dealing or insurance-related business). Other risks to the group will also be captured, for example, where services such as IT, accounting, or payment and settlement functions are being provided, or control functions are being exercised, from outside the group on an outsourced basis.
2.6.3 The MA may allow a local banking group to develop a
group CAAP covering the positions of its subsidiary AIs if their capital is centrally managed at the group level. In other words, such subsidiary AIs will not be required to

19 This refers to a banking group in which the holding company of the group (or group holding company) is a locally incorporated AI.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 establish their own CAAP on a standalone basis. However, subsidiary AIs that are operating independently will still be required to develop their own CAAP.
2.6.4 The MA determines the solo and (where applicable)
consolidated minimum CAR for each of the locally incorporated AIs within a local banking group based on their respective risk profile. It is however not uncommon for the MA to set the same CAR for a local banking group at both the solo and consolidated levels. This is generally reflective of the fact that the operations of a local banking group are often dominated by the AI that is the group holding company, and the risk profiles of AIs within the group are not materially different. If a local banking group does not have such characteristics, the solo and consolidated minimum CAR applicable to AIs within the group will likely be different, depending on the MA’s assessment of their individual risk profiles.
2.6.5 As an illustration, if the group holding company of a local
banking group is a retail bank with a fairly diversified risk profile but some of its significant subsidiary AIs are engaged in specialised and high risk business activities (e.g. foreign exchange and derivatives trading) with decentralised risk management systems, there may be a case for setting the solo minimum CAR of those subsidiary AIs at a level higher than that for the group holding company. Whether the consolidated minimum CAR of the group holding company will also be set at a higher level than its solo minimum CAR depends on the impact of the operations of the subsidiary AIs on the group’s consolidated financial position.
2.6.6 Where a local banking group has overseas branches or
subsidiaries the activities of which are significant to the group as a whole, the MA may seek the comments of relevant host supervisors on the financial and operating soundness of those branches or subsidiaries in their jurisdictions in the course of conducting the SRP for the consolidated banking group.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
2.7 Application to foreign bank subsidiaries
2.7.1 In the case of AIs which are subsidiaries of foreign
banks, the MA continues to exercise his legal duty under the Banking Ordinance, through the setting of minimum CAR, to require such AIs to maintain adequate capital resources in Hong Kong.
2.7.2 The evaluation of the capital adequacy of foreign bank
subsidiaries under the SRP however takes into account the strength and availability of parental support as well as other relevant information from the home supervisor of the foreign banking group. This may include, for example, the results of the home supervisor’s consolidated assessment (including an evaluation of the group CAAP or capital allocation systems and the group support of subsidiaries) of the banking systems and processes used at the group level and any developments or supervisory actions that may affect the calculation of regulatory capital requirements for the subsidiaries in Hong Kong.
2.7.3 A foreign bank subsidiary that is subject to the CAAP
standards may employ the CAAP methodology of its parent bank, but will need to explain and justify to the MA how the data and methodology have been adjusted to reflect its local business strategy and the risks to which it is exposed in Hong Kong (see subsection 4.6 for more details).
2.8 Review and notification of SRP results
2.8.1 The MA has established an internal mechanism for
ensuring the quality, objectivity and consistency of the assessments performed under the SRP in respect of the determination of the minimum CAR of individual AIs and for considering representations from AIs seeking a review of the determination. An outline of the mechanism is shown in Diagram 2 below.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Diagram 2 – Independent Review of SRP Results Proposal to vary AI’s minimum CAR under §97F of Banking Ordinance after conducting the SRP

Review of the proposal by the
SRP Approval Committee

Draft notice served on AI under
§97F(2) with contents required by §97F(3)(if its minimum CAR is to be varied)

Representations from AI? Yes
Consideration by the SRP
Approval Review Committee
No
Notice under §97F(1) issued (in substantially the same terms as the draft notice if no representation or with changes to take account of representations made by AI) Yes AI’s minimum CAR varied under §97F(1)?

No
Inform AI of the decision made
2.8.2 Pursuant to §97F(1) of the Banking Ordinance, the MA
may vary an AI’s minimum CAR if he is satisfied, on reasonable grounds, that it is prudent to make the variation, taking into account the risks associated with the AI. The SRP Approval Committee and SRP Approval Review Committee mentioned below contribute to ensuring that any variation made by the MA is in accordance with the §97F(1) requirements.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
2.8.3 The mandate of the SRP Approval Committee is to
review the assessments conducted on individual AIs under the SRP, and to advise the MA on the appropriateness of any proposed variation of the minimum CAR and/or supervisory measures. The Committee is chaired by an Executive Director, and includes at least two senior staff members within the Banking Departments of the HKMA who have not been involved in conducting the SRP in question.
2.8.4 The SRP Approval Committee evaluates all relevant
facts and arguments in support of any proposed variation, and analyses and compares the assessment results of different AIs to ensure the consistency and quality of assessments made. Before putting forward any recommendations for the MA’s consideration, the Committee may direct the relevant supervisory team to provide additional information or carry out further work to resolve any queries or concerns raised.
2.8.5 The mandate of the SRP Approval Review Committee is
to consider representations from individual AIs in respect of a proposed variation of their minimum CAR, and to recommend to the MA whether the minimum CAR should be so varied in the light of those representations and other relevant circumstances of each case. The Committee is chaired by a Deputy Chief Executive, and includes at least four senior staff members within the Banking Departments of the HKMA who have neither been involved in conducting the SRP in question nor in considering the SRP within the SRP Approval Committee.
2.8.6 If the MA proposes to vary the minimum CAR of an AI,
he is required under §97F of the Banking Ordinance to serve a draft notice on the AI specifying the proposed variation and the grounds for the proposed variation. The AI will be given 14 days to make written representations following the date of service of the MA’s draft notice. If necessary, the AI may request an extension of the time limit for submitting representations.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Any such request should be in writing, provide sufficient justification and be delivered to the MA within the original 14-day period. The MA may allow such extension as he considers appropriate having regard to the circumstances of each case.
2.8.7 To ensure that the Board and senior management of the
AI are fully engaged in the process and have fully considered the circumstances appertaining to the AI’s minimum CAR and the MA’s proposal to vary the same, the representations should be accompanied by a certified copy of the minutes of meeting in which the Board (or a designated committee) approved the submission of the representations.
2.8.8 The AI should set out clearly in its written
representations the grounds for seeking a review of the proposed §97F minimum CAR and provide all relevant facts and information that the AI wishes the MA to take into account when considering its representations. An AI may be permitted to make oral representations if the MA considers this helpful in elaborating upon the AI’s written representations.
2.8.9 As a general rule, the making of representations should
not delay or impede any other supervisory actions already in progress, or affect the MA’s authority to take any other supervisory actions against the AI concerned. Under exceptional circumstances, the MA may decide that the AI should be relieved from complying with certain other supervisory actions while the representations are being considered.
2.8.10 If the MA has not received any written representations
from the AI within the 14-day period (or an extended period approved by the MA) or if, after having considered the AI’s representations and the SRP Approval Review Committee’s recommendation, the MA supports a variation of the minimum CAR (no matter whether the variation is as originally proposed or in a revised form), the MA will, by notice in writing served on

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 the AI, vary the AI’s minimum CAR under §97F of the Banking Ordinance.
2.8.11 If the AI is still aggrieved by the MA’s decision to vary its
minimum CAR, it may apply to the Review Tribunal for a review of that decision under §101B of the Banking Ordinance. However, the making of an application to the Tribunal for a review of a decision does not operate to suspend the decision.
3. Supervisory review of capital adequacy
3.1 General
3.1.1 This section focuses on the major elements of the
assessment framework adopted by the MA under the SRP, including (i) the key assessment factors that are considered in evaluating AIs’ capital adequacy (see subsection 3.2); (ii) the setting of AIs’ Pillar 2 capital requirement (see subsection 3.3); (iii) the treatment of any overlap between such requirement and the capital buffers (see subsection 3.4); and (iv) the approach to determining AIs’ §97F minimum CAR (see subsection 3.5).
3.1.2 Conducted as part of the MA’s ongoing supervision of
AIs, the SRP is closely related to the risk-based supervisory framework currently adopted by the MA. Subsection 3.6 describes their relationship and how the assessment results under the SRP may be integrated with the risk-based supervisory process. Also relevant to the SRP are:

the MA’s approach to using stress tests in evaluating
an AI’s capital adequacy and its ability to withstand risk;
the emphasis placed by the MA on encouraging AIs
to adopt international risk management standards and best practices through the issue of supervisory guidance; and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

the process of monitoring AIs’ capital adequacy on a
continuing basis.
These aspects are respectively explained in subsections
3.7 to 3.9.
3.2 Key factors for assessing capital adequacy
3.2.1 Apart from credit, market and operational risks that are
covered under Pillar 1, the SRP takes into consideration other risks faced by AIs and how well those risks are being managed by AIs. Through the SRP, the MA evaluates the extent to which an AI is required to hold more capital to cover those risks (i.e. the Pillar 2 capital requirement). This subsection serves to specify the major risk and control factors that the MA considers under the SRP and the approach to assessing the impact of such factors on an AI’s Pillar 2 capital requirement (and in turn its §97F minimum CAR).
3.2.2 With the risk-based supervisory approach as its
foundation, the SRP has been developed to provide the MA with a comprehensive, systematic and consistent framework for determining the Pillar 2 capital requirement (and in turn the §97F minimum CAR) of individual AIs. Diagram 3 below outlines the key elements that constitute the assessment framework.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Diagram 3 – Key Elements of SRP Assessment Framework Risk-based supervision Inherent risk Systems and Capital strength Corporate Risk increasing Risk mitigating controls and CAAP governance factors factors

Default risk - Credit
Credit - Transaction risk concentration - Risk - Adequacy and - Corporate Examples Examples risk (CRM) risk management effectiveness governance system of CAAP and (compliance - Specific issues - IRB / AMA stress-testing and quality) arising from CRM capability for
Equity risk - Internal control capability / securitisation AIs using less
Commodity risk system and and credit advanced
FX risk environment derivatives approaches
Capital quality
Operational - Risk of loss - Residual and strength risk from internal operational - Infrastructure to - Residual - Insurance (including operations and and legal meet business - Capability to modelling risk cover legal risk) external events risks needs withstand risk recognisable (e.g. access to - Outliers in under AMA
Interest rate - Interest rate - Other support capital market, specific risks
risk in trading risk in banking systems strength of - Diversification book book (e.g. MIS and shareholders / - Other factors benefits anti-money parental not already or Liquidity laundering support, and adequately - Other factors risk controls) vulnerability dealt with under providing to business BCR relief capital Strategic cycle risk, etc.) minimum CAR risk and common assessment Reputation factors risk Banking (Capital) Rules Consideration under BCR minimum CAR Common assessment factors AI-specific assessment factors Other considerations Market risk Supervisory Assessment (case-by-case basis) MINIMUM CAR (Note) Interest rate risk Pillar 2 capital requirement
Liquidity risk
Strategic risk
Reputation risk
Supervisory Assessment
(through scoring system)
Note: Up to 31 December 2015, the entire Pillar 2 capital requirement will constitute the capital add-on (and form
part of the §97F minimum CAR). Effective from 1 January 2016, the §97F minimum CAR (derived from the
Pillar 2 capital requirement) will be adjusted to remove the effect of any overlap with the capital buffers (see subsections 3.4 and 3.5 for details).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
3.2.3 Central to the SRP is the MA’s assessment of the level of
capital that an AI should set aside for the eight inherent risks identified for the purpose of risk-based supervision, to which all the assessment factors under the SRP can be linked. These inherent risks (see column 1 of Diagram 3), i.e. credit, market, operational (and legal), interest rate, liquidity, strategic and reputation risks, are as defined in SA-1 “Risk-based Supervisory Approach”.
3.2.4 In determining the overall risk profile and Pillar 2 capital
requirement of an AI, the MA takes into account two types of assessment factors, i.e. those that are commonly applicable to all AIs (referred to as the “common assessment factors”) and those that are specific to the AI concerned (referred to as the “specific assessment factors”). Common assessment factors include those inherent risks set out in para. 3.2.5 and other assessment factors mentioned in para. 3.2.7. Specific assessment factors are explained in paras.
3.2.13 to 3.2.17 below. See also Annex B for a more
detailed description of the assessment factors.
Level of inherent risks
3.2.5 Out of the eight inherent risks, there are certain risks,
namely, credit risk (including counterparty credit risk), market risk and operational (and legal) risk, that are within the scope of Pillar 1 and hence are covered by the BCR minimum CAR (see column 2). The other inherent risks (including residual risks), as listed below, are to be assessed under the SRP (see column 3):

credit concentration risk (as a major source of
residual credit risk);
residual operational (and legal) risk;
interest rate risk in the banking book;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

liquidity risk 20;
strategic risk; and
reputation risk.
3.2.6 The MA assesses an AI’s level of inherent risks covered
under the SRP, taking into consideration all relevant qualitative and quantitative factors, including their respective significance to the AI’s overall risk profile and the degree of potential loss that may be posed by these risks in relation to the AI’s earnings and capital. The direction of such risks (i.e. “increasing”, “stable” or “decreasing”) 21 , including those arising from new products, services or business activities, in the next 12 months is also considered. The resultant level of inherent risk is categorised as “low”, “moderate” or “high”22 . Other common assessment factors
3.2.7 In addition to the level of inherent risks, the MA assesses
an AI’s performance under the following assessment factors (see columns 4 to 6) with a view to ascertaining the AI’s ability to manage and mitigate the inherent risks:
Systems and controls – this refers to the
assessment of an AI’s overall operating soundness, including the adequacy of:

20 Given that the liquidity coverage ratio, one of the two Basel III liquidity standards, is to be implemented on 1 January 2015, the MA will conduct a review nearer that time to assess whether there is scope for adjusting any of the liquidity risk assessment factors included in the SRP framework. 21 If the level of credit risk is “low” but the direction of this risk is “increasing”, the MA may consider whether there is a sufficient basis for increasing the level of credit risk to “moderate”. 22 By way of example, the credit concentration risk of an international bank with fairly diversified portfolios by counterparty, sector, or geographical location will likely be regarded as “low” whereas that of a domestic bank with a highly concentrated loan portfolio (e.g. with a few large or connected borrowers) will likely be regarded as “high”.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

risk management systems (i.e. systems used for
identifying, measuring, monitoring, controlling, mitigating and reporting the eight inherent risks);
internal control systems and environment
(including organisation structure, delegation of authority, segregation of duties, control culture, internal audit and compliance functions);
infrastructure to meet business needs (such as
IT capability, staff competence, and outsourcing); and
other support systems (such as management
information systems (“MIS”), accounting systems and anti-money laundering controls);
Capital strength and CAAP – this refers to the
assessment of:
the quality of capital held by an AI and its access
to additional capital and capability to withstand economic cycles and other external risk factors (e.g. the impact of mergers/acquisitions, competition or adverse events on the AI’s operations); and
the quality and effectiveness of an AI’s CAAP
(including capital planning and longer-term capital maintenance) for managing the AI’s capital adequacy in relation to its risk profile, the loss absorbency of its capital (e.g. the sufficiency of its CET1 capital) to protect itself from insolvency), the overall environment within which the CAAP operates, as well as its compliance with the CAAP standards (for AIs that are subject to the CAAP standards set out in section 4); and
Corporate governance – this refers to the
assessment of the adequacy of an AI’s corporate governance arrangements (see also paras. 3.2.8 and 3.2.9).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
3.2.8 In assessing the above factors, the MA pays particular
attention to the firm-wide risk oversight exercised by the AI’s Board and senior management, including their knowledge and experience in the AI’s major business activities and risk management systems, their participation and involvement in development of the AI’s CAAP and risk management processes, and their responsiveness to risk management and control issues raised by the MA. Their willingness and ability to promote and maintain prudent remuneration policies and practices within the organisation will also be a major factor for consideration.
3.2.9 With respect to new or complex products and activities
engaged in by an AI, the MA expects senior management to understand the assumptions regarding business models, valuation and risk management practices underlying those products and activities and to evaluate the potential risk exposure if such assumptions fail. The MA also takes into account senior management’s ability to detect and rectify issues or problems arising from internal operations and to react promptly to changes in the external environment (e.g. due to competition or deterioration in macroeconomic variables) that could adversely affect the AI’s overall condition.
3.2.10 In relation to the assessment of capital strength, an AI’s
prospects and ability to obtain additional capital readily and the likelihood of it doing so when under stress, the capital support potentially available from the AI’s shareholders, and the obligations and commitments which the AI may have towards its subsidiaries and affiliates (if any) are relevant factors to be considered. In the case of an AI which is a banking subsidiary or a member of a banking group (local or foreign), the MA will further consider whether the AI has strong parental support and whether the parent bank or holding company has the resources to provide such support when needed.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
3.2.11 In addition to an AI’s ability to maintain sufficient capital
for all material risks, the MA attaches importance to the AI’s strength in operating effectively throughout a severe and prolonged period of financial market stress or an adverse credit cycle. Particularly, the MA will have regard to whether the AI’s CAAP has, through stresstesting or otherwise, addressed both short-term and long-term capital needs and considered the prudence of building excess capital over benign periods of the credit cycle to enable the AI to withstand a severe and prolonged market downturn.
3.2.12 In evaluating the above factors, the MA takes into
account the business nature and scale of operations of AIs, their role in the financial system and their compliance with the supervisory standards and best practices contained in the relevant guidelines set out in
Annex A. The resultant level of performance of the
above factors is categorised as “strong”, “acceptable” or “weak”. 23 A “strong” performance on the above factors will have a positive impact on the overall risk profile of an AI, and vice versa. Specific assessment factors
3.2.13 There are two types of specific assessment factors, i.e.
risk increasing factors (see column 7) and risk mitigating factors (see column 8). They are used to cater for situations or circumstances specific to the AI concerned and which have not been dealt with, or adequately dealt with, under the BCR minimum CAR or common assessment factors. The MA will consider these factors on a case-by-case basis, having regard to their significance to individual AIs. The use of such factors is

23 For example, the MA may grade an AI’s risk management systems as “strong” if the AI’s past history indicates that its risk management policies, systems and controls address all material risks and are effectively implemented. However, if subsequent supervisory findings have identified significant flaws in the AI’s risk monitoring and reporting procedures to the extent that senior management is not given accurate or adequate information to evaluate the risks faced by the AI, there may be scope for downgrading the AI’s “risk management systems” to “weak”.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 however exceptional and subject to close scrutiny by the MA.
3.2.14 Risk increasing factors are specific factors that
negatively affect the risk profile of an AI and which may hence be indicative of a need for an increase in the AI’s minimum CAR. Examples of such factors include:

significant “outliers” identified in the review of
common assessment factors. These may relate to extremely high levels of inherent risk, substantial management or control weaknesses, or significant vulnerability to adverse economic events which warrant a full assessment of the additional capital required to cover the risks involved;
factors specific to the business and operations of
individual AIs, such as risk concentrations that may arise within each type of risk or through a combination of exposures across different types of risk, and other material non-banking risks (e.g. rapid expansion in non-banking activities without proper expertise and management systems); and
specific issues arising from the application of, or
compliance with, minimum standards or requirements stipulated under the capital adequacy framework. These issues may arise from:
residual credit risk (including counterparty credit
risk) associated with credit risk mitigation techniques, complex credit derivatives or securitization transactions;
use of internal models under the IRB approach,
IMM approach or IMM(CCR) approach (e.g. capital shortfall identified in stress tests, breach of qualifying criteria or certain modelling deficiencies pending rectification); or
operational risk capital charge not
commensurate with the scale and complexity of

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 an AI’s business operations (e.g. due to the AI’s operating losses or significant decline in earnings) 24 .
3.2.15 Risk mitigating factors are specific factors that have a
positive impact on an AI’s risk profile and which may hence be taken into account in considering whether there is any case for lowering the AI’s minimum CAR. They are used by the MA as incentives for AIs to improve their risk management so that the level of their inherent risks can be effectively mitigated. As an example, if an AI can demonstrate to the MA’s satisfaction its proficiency in managing credit, market or operational risk by having sophisticated risk management systems comparable to those required for adopting the advanced approaches promulgated under Basel II and Basel III 25 (although the systems may not have been used for regulatory capital treatment in Hong Kong 26), the MA may recognise this as a risk mitigating factor.
3.2.16 In considering an AI’s Pillar 2 capital requirement, the
MA will determine, in consultation with the AI concerned, whether there is any risk mitigating factor that can be recognised for capital adequacy purposes (although the hurdle for recognising any such factor will be high). To facilitate his assessment, the MA may require the AI to provide any such information or documentary evidence as is deemed necessary in the circumstances of the case. The MA will assess each case based on its own

24 This issue will be considered in the MA’s assessment of residual operational (and legal) risk under para. 3.2.5. See also subsection B2.2 of Annex B for more details. 25 These approaches refer to the IRB approach for credit risk, the IMM (CCR) approach for counterparty credit risk, the IMM approach for market risk, and the Advanced Measurement Approaches (“AMA”) for operational risk as set out in International Convergence of Capital Measurement and Capital Standards – A Revised Framework (Comprehensive Version) published by BCBS in June 2006 and the IMM(CCR) approach (update) and Advanced CVA method for counterparty credit risk as set out in Basel III: A global regulatory framework for more resilient banks and banking systems published by the BCBS in December 2010 (revised in June 2011). 26 An example of such situations is where a foreign-owned subsidiary AI may adopt in Hong Kong the standardised approach for the calculation of operational risk while using for risk management purposes the AMA system of its parent bank, which has been recognised for capital adequacy purposes by the relevant home supervisor.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 merits, taking into account the information provided by the AI to justify the risk mitigating effect of the factor under consideration.
3.2.17 The MA will determine the extent to which the Pillar 2
capital requirement of an AI can be increased or reduced due to the specific assessment factors, based on his assessment of the extent to which such factors can increase or mitigate the risks of the AI. Assessment approach
3.2.18 In conducting his assessment under the SRP, the MA
uses a combination of techniques and tools, which include:

quantitative and qualitative assessments;
scoring of key risk factors and trends;
statistical and sensitivity analyses;
stress and scenario tests;
benchmarking against industry performance; and
peer group comparisons.
In particular, the common assessment factors are evaluated based on a scoring system developed by the MA whereas the specific assessment factors are separately considered by the MA on a case-by-case basis, with the other techniques and tools incorporated where appropriate. Attached at Annex C is a set of scoring worksheets which help describe the manner in which the MA uses various techniques and tools to facilitate his assessment under the SRP. AIs should however note that the scoring worksheets are subject to periodic review by the MA, and are shown here for illustrative purposes only.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
3.2.19 Regardless of the approach taken, supervisory
judgement is still an important element in the overall assessment. The MA may also seek the views of the external auditors of an AI and, where applicable, its home or host supervisor on particular issues affecting the AI.
3.2.20 On the basis of the assessment results, the MA will
decide upon an AI’s overall risk profile (also categorised as “low”, “moderate” or “high”) to facilitate his determination of the AI’s Pillar 2 capital requirement (and §97F minimum CAR) and any other appropriate supervisory response to the AI’s condition (e.g. the scope and frequency of the next SRP or the need for any supervisory action to be taken in view of the weaknesses or deficiencies identified).
3.2.21 Diagram 4 below is an illustration of the risk profile
matrix which relates an AI’s overall risk profile to the level of inherent risks of the AI (with focus on those captured under the SRP) and its performance in other common assessment factors, i.e. systems and controls, capital strength and capability to withstand risk, CAAP (if applicable), and corporate governance. The effects of any specific assessment factors applicable to the AI will also be taken into account.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Diagram 4 – Risk Profile Matrix SYSTEMS AND CONTROLS / CAPITAL STRENGTH / CAAP / CORPORATE GOVERNANCE etc. (aggregate result of assessment) STRONG ACCEPTABLE WEAK HIGH Moderate risk profile Moderate / high risk profile High risk profile MODERATE Low / moderate risk profile Moderate risk profile Moderate / high risk profile INHERENT RISK LOW Low risk profile Low / moderate risk profile Moderate risk profile
3.2.22 In order to ensure the quality and consistency of the
assessments made, the MA aggregates the assessment results of individual AIs and compares the results among peer groups. The assessment results and recommendations will also be subject to the independent review procedures set out in subsection 2.8 before they are finalised.
3.2.23 The MA will discuss the assessment results in detail with
individual AIs and consult with them, if a variation of their minimum CAR is proposed, in accordance with §97F of the Banking Ordinance (see Diagram 2 under subsection 2.8).
3.3 Setting of Pillar 2 capital requirement
3.3.1 The Pillar 2 capital requirement, which is generated from
the assessment framework under the SRP, is a capital requirement that an AI is required to maintain in respect of its Pillar 2 risks. This requirement will form the basis for determining an AI’s §97F minimum CAR (see subsections 3.4 and 3.5 for details on how the determination is made).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
3.3.2 Although §97F of the Banking Ordinance sets no upper
limit for the variation of the BCR minimum CAR of individual AIs, the MA will continue to calibrate the Pillar 2 capital requirement under the SRP based on a maximum Pillar 2 capital requirement of 8%, which is considered appropriate in the light of past experience. The MA will, however, review the calibration from time to time to ensure that it remains suitable for the local banking sector. The MA also retains the right to impose a higher Pillar 2 capital requirement on particular AIs if this should be justified by the SRP results 27. This will of course be subject to the requirements set out in §97F of the Ordinance.
3.3.3 The Pillar 2 capital requirement of an AI generally reflects
the MA’s perception of its overall risk profile, taking into account all relevant assessment factors set out in subsection 3.2. The factors may have different levels of significance to different AIs, depending on their individual circumstances. For example, some AIs may be more affected by external factors while for others, management quality or internal controls may be the principal issues.
3.3.4 Broadly speaking, AIs are assigned with a Pillar 2 capital
requirement that falls within the following bands, depending on their assessment results under the SRP:
Overall risk profile Pillar 2 capital requirement Low <=1% Moderate >1% - 4% High >4% - 8% However, as discussed in para. 3.3.2, it should be noted that these indicative levels will not operate to constrain

27 For example, an AI may be assessed to be a significant outlier in some risk factors to the extent of affecting the AI’s solvency and the seriousness of the AI’s position cannot be accommodated by a maximum Pillar 2 capital requirement of 8%.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 the MA from imposing a higher Pillar 2 capital requirement if he is satisfied, on reasonable grounds, that it is prudent to impose such a requirement, taking into account the risks associated with the AI concerned.
3.3.5 The Pillar 2 capital requirement is to cater for the various
Pillar 2 risks and uncertainties faced by an AI. In determining whether additional capital is required to cover a particular type of risk, the MA will consider the level of that risk as well as the extent to which such level of risk can be reduced by applying appropriate risk mitigating measures. For example, if an AI’s residual counterparty credit risk is mainly caused by poor risk management controls, and the AI holds additional collateral from counterparties as a risk mitigating measure in the course of rectifying the counterparty credit risk management weaknesses identified, the MA will have regard to the effectiveness of the risk mitigating measure (i.e. the extent to which counterparty credit risk is effectively reduced by the additional collateral held by the AI) when considering whether the AI needs to hold additional capital for its counterparty credit risk management weaknesses. The MA will also take into account the AI’s progress in strengthening its counterparty credit risk management framework.
3.4 Treatment of overlap with capital buffers
3.4.1 The treatment set out in this subsection will only take
effect from 1 January 2016 (after the capital buffers begin implementation). Relationship with capital buffers
3.4.2 There are fundamental differences between the Pillar 2
capital requirement and the capital buffers.
3.4.3 The calculation of capital requirements in respect of
credit, market and operational risks (i.e. Pillar 1 risks) under the Banking (Capital) Rules is complemented by

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 the SRP conducted under Pillar 2 which determines the additional capital that should be maintained by AIs to address risks not covered (e.g. interest rate risk in the banking book), or not adequately covered (e.g. credit concentration risk), under Pillar 1. Such Pillar 2 risks may differ among AIs depending on their risk profiles and management systems. The requirement to hold additional capital to cover such risks not only underpins and supports those risks but also provides AIs with an impetus to improve their systems for managing specific risks.
3.4.4 In contrast, the capital buffers, to be implemented from 1
January 2016, are designed to ensure that (i) AIs build up capital outside periods of stress which can be drawn down as losses are incurred (in the case of the capital conservation buffer); and (ii) the level of AIs’ capital is reinforced during periods of excessive growth (in the case of the countercyclical capital buffer). Hence, instead of addressing AI-specific risks, the buffers are intended to be general cushions of capital above the minimum CAR to be available for use during periods of stress. Areas of potential overlap
3.4.5 As a general principle, to the extent that the Pillar 2
capital requirement generated from the SRP reflects AIspecific Pillar 2 risks, there should be no overlap with the capital buffers, and this portion of the Pillar 2 capital requirement should remain as a constituent part of the minimum CAR. To the extent however that there is any element within the SRP of a cushion of capital being added to bolster resilience generally without reference to a specific Pillar 2 risk, a degree of overlap may exist and such overlap should be removed to avoid any “doublecounting” of capital.
3.4.6 Based on a review of the SRP scorecards, the MA
considers that an overlap with the capital buffers only occurs in relation to the following assessment factors:

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

All factors assessed under “Capital Adequacy
Assessment Process” (i.e. SRP scorecard C1). As the determination of the Pillar 2 capital requirement remains very much a supervisor-driven process, the requirement for additional capital in response to assessment of an AI’s CAAP largely represents a cushion to bolster resilience and a means to motivate AIs’ enhancement of their CAAP capability; and
Certain factors assessed under “Capital Strength
and Capability to Withstand Risk” (i.e. SRP scorecard C2). These include (i) asset quality (which provides a cushion of capital for credit risk covered in Pillar 1); (ii) business expansion (which provides a cushion of capital during business expansion to cater for a downturn); (iii) stresstesting (which assesses an AI’s vulnerability during stressed situations); and (iv) qualitative assessment factors (such as access to additional funding in times of need, the potential impact of redemption of subordinated debt instruments in times of stress, and strength of parental support, etc.). All such factors are not directly associated with an AI’s inherent risks, but provide some cushion of capital to bolster resilience especially during stressed periods.
3.4.7 All other assessment factors relate to the inherent risks
to which an AI is exposed as well as to its underlying systems and controls and corporate governance arrangements for mitigating such risks, and should not result in additional capital requirements which constitute an overlap with the capital buffers.
3.4.8 The MA does not expect the overlap arising from the
assessment factors referred to in para. 3.4.6 to constitute a significant portion of AIs’ Pillar 2 capital requirement. Notwithstanding the overlap, these assessment factors will remain within the SRP as they serve to differentiate individual AIs’ performance for the

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 purpose of assessing and monitoring overall capital adequacy, so that supervisory measures can be taken where appropriate. For example, an AI’s CAAP may fall short of the required standards, prompting the MA to require remedial action from the AI.
3.4.9 The MA will however adjust the Pillar 2 capital
requirement to remove any duplication of capital requirements when the capital buffers begin operation from 1 January 2016. The portion of the overlap between the Pillar 2 capital requirement and the buffers will differ among AIs, depending on the SRP results and their individual circumstances. Methodology for addressing overlap
3.4.10 To remove any potential overlap between the Pillar 2
capital requirement and the capital buffers, effective from 1 January 2016, the Pillar 2 capital requirement will be restructured into two constituent parts, P2A and P2B, as described in para. 2.3.4.
3.4.11 P2A, the portion of the Pillar 2 capital requirement that
addresses AI-specific risks not covered, or not adequately covered, under Pillar 1 (re the SRP assessment factors referred to in para. 3.4.7), will continue to form a constituent part of the ongoing §97F minimum capital requirement. P2B, the portion of the Pillar 2 capital requirement that is intended to provide a cushion of capital to bolster resilience in times of stress (re the SRP assessment factors referred to in para. 3.4.6) and hence should be usable in such times, is more akin to the capital buffers and should be absorbed into the buffers when they come into effect (to the extent that P2B does not exceed the buffers). In addition, P2B, like the buffers, should be constituted solely by CET1 capital.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Illustration of methodology 28
3.4.12 Diagram 5 below illustrates the Pillar 1 / Pillar 2
constituents of the three minimum capital ratios and capital conservation buffer effective from 1 January 2016. Diagram 5 - Constituents of Minimum Capital Ratios and Capital Conservation Buffer (effective from 1 January 2016) Capital conservation buffer Minimum Capital Ratios Buffer (CET1 Capital) P2B (additional cushion for general risks) P2A ( risks not captured or not adequately captured in P1) Pillar 1 (credit, market, operational risks)
3.4.13 The operation of para. 3.4.11 can be further illustrated
by a mathematical example. Looking at the minimum Total capital ratio of 8%, if the Pillar 2 capital requirement of an AI is 2% (with the P2A / P2B split being 1.5% and 0.5% respectively), the AI’s minimum Total capital ratio would be 9.5% (i.e. 8% + 1.5%) (but see subsection 3.5 regarding the apportionment of the P2A requirement between the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio) with the P2B requirement of 0.5% being absorbed into the capital conservation buffer of 2.5%.
3.4.14 In most cases, the P2B requirement of an AI should be
less than the capital conservation buffer. In exceptional cases where the P2B requirement of an AI exceeds the capital conservation buffer, the AI should “top-up” the capital conservation buffer to the level of the P2B

28 For illustrative purposes, the diagrams and examples used in paras. 3.4.12 to 3.4.14 refer to the capital conservation buffer which is an ongoing buffer requirement. Nevertheless, the treatment should be extended (i) to the countercyclical capital buffer whenever it is triggered or (ii) to any other buffer that may be applicable to the AI concerned (e.g. higher loss absorbency requirements for systemically important banks when these are implemented), as if the buffers are one single buffer.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 requirement. For example, if the P2B requirement of an AI is 3%, the capital conservation buffer that the AI should maintain will be increased from 2.5% to 3% (i.e. effectively the size of the P2B requirement) while the minimum capital ratios would only include Pillar 1 and the P2A requirement (see Diagram 6 below). Again, the overlapping portion between the capital conservation buffer and the P2B requirement is not double-counted. In such cases, the enlarged buffer will be divided into four equal segment ranges for the application of the minimum capital conservation ranges suggested by the Basel Committee 29 . Diagram 6 - Total Capital Requirement under Different P2B scenarios
3.4.15 If and when the countercyclical capital buffer is triggered,
this will have the effect of extending the capital conservation buffer. In such a case, should the P2B requirement exceed the capital conservation buffer, it could be absorbed by the countercyclical capital buffer. However, if the P2B requirement exceeds the combined buffer (which should be extremely rare) then the AI should “top-up” the combined buffer to the level of the P2B requirement.

29 Paragraph 131 of Basel III: A global regulatory framework for more resilient banks and banking systems (revised in June 2011). Capital conservation buffer P2A Capital conservation buffer P1 P2A P2B P1 P2B Additional buffer Total capital requirement Scenario 1 Buffer>P2B Scenario 2 Buffer< P2B Total capital requirement Minimum ratio requirement

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
3.4.16 In cases where the P2B requirement of an AI is relatively
large compared with that of other AIs, this may be due to the AI’s relatively weaker performance under the P2B assessment factors. As a larger P2B requirement offers greater capital relief than a smaller P2B requirement when absorbed by the capital buffers, this might create an adverse incentive in terms of the P2B assessment factors. To counter this incentive, the MA will in any such case critically review the underlying components of the figures to determine whether and what action the AI concerned should be required to take to improve its performance under the relevant factors.
3.5 Determination of §97F minimum CAR
3.5.1 The Pillar 2 capital requirement of an AI generated from
the SRP will be used to derive the capital add-on applicable to the BCR minimum CAR (i.e. the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio) in accordance with the apportionment approach set out below. This approach also takes into account the phase-in arrangements for the BCR minimum CAR between 2013 and 2015 and the restructuring of the Pillar 2 capital requirement from 2016 onwards. Apportionment method
3.5.2 Before the capital buffers are implemented (i.e. 2013 to
2015), the MA will allocate the Pillar 2 capital requirement of an AI to the three minimum capital ratios on a proportionate basis, in synchronisation with the underlying BCR minimum CAR in force during the period. Hence, the apportionment between the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio will be based on the following splits:
at any time during 2013, the split of 3.5 / 4.5 / 8; at any time during 2014, the split of 4 / 5.5 / 8; and at any time during 2015, the split of 4.5 / 6 / 8.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
3.5.3 For example, if the Pillar 2 capital requirement of an AI
is determined to be 2% for 2014, in accordance with para. 3.5.2, the AI should observe a minimum CET1 capital ratio of 5% (i.e. 4%+2%*4/8), minimum Tier 1 capital ratio of 6.875% (i.e. 5.5%+2%*5.5/8) and minimum Total capital ratio of 10% (i.e. 8%+2%*8/8).
3.5.4 After the capital buffers are implemented (i.e. from 2016
onwards), only the P2A requirement will be allocated to the three minimum capital ratios according to the 4.5 / 6 / 8 split (as the P2B requirement will be absorbed into the buffers and require no additional capital). For example, assume the P2A requirement and P2B requirement of an AI are 1.5% and 0.5% respectively, its minimum capital ratios (not including the buffers) from 1 January 2016 are shown below. Minimum Capital Ratios CET1 Tier 1 Total BCR minimum CAR 4.5% 6% 8% Apportioned P2A (according to 4.5 / 6 / 8 split) 0.844% 1.125% 1.500% BCR minimum CAR + Apportioned P2A 5.344% 7.125% 9.500% P2B 0.5% (not included in minimum capital ratios)
3.5.5 The above apportionment approach will necessitate that
AIs closely monitor, plan for, and address any potential or resultant changes in the levels of capital required in each of the CET1 capital, Additional Tier 1 capital and Total capital ratios, whenever there is any change in the size of the Pillar 2 capital requirement, or any change in the Pillar 1 split (e.g. 3.5 / 4.5 / 8 for 2013) for the BCR minimum CAR during the phase-in period. Other considerations
3.5.6 To reduce frequent fluctuations in the minimum CAR of
an AI, the MA will consider whether the factors leading to

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 a change in the minimum CAR are temporary in nature or require further observation. For example, if there are reasonable expectations that certain system deficiencies will be quickly rectified by an AI, the MA may consider withholding temporarily the proposed increase in minimum CAR pending a review of the AI’s corrective actions. Conversely, if a reduction in an AI’s minimum CAR is proposed in the light of the AI’s actions taken to address supervisory concerns raised by the MA, the MA may consider withholding temporarily the proposed reduction until a more comprehensive assessment of whether the improvements have been effectively implemented is completed.
3.5.7 While the setting of an appropriate Pillar 2 capital
requirement for individual AIs is an important aspect of the SRP, the MA recognises that capital alone is not a substitute for sound risk management and control environments. In fact, certain risks (e.g. reputation or liquidity risk) may not be adequately addressed by holding additional capital alone. A more appropriate response would be to mitigate a risk by way of adequate systems and controls, or by a combination of adequate systems and controls and additional capital and resources (e.g. a larger liquidity buffer in the case of liquidity concerns).
3.5.8 In certain circumstances (e.g. during the period in which
system and control weaknesses have been identified but have yet to be fully remedied), the MA may make use of an increase in regulatory capital as a supervisory tool to focus the minds of management of an AI on the need for improving risk management and rectifying control deficiencies. Thus, the MA may increase the AI’s §97F minimum CAR temporarily and, where necessary, take other appropriate supervisory actions (e.g. requiring the AI to reduce the risk inherent in its activities, products and systems), pending corrective actions by the AI.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
3.6 Integration with risk-based supervisory process
3.6.1 Diagram 7 below illustrates the relationship between the
SRP and the risk-based supervisory process.
Diagram 7 – Relationship between SRP and Risk-based Supervision Risk-based supervision Supervisory review process To assess AIs’ overall risk profile To determine §97F minimum CAR of AIs Board and senior management oversight Board and senior management oversight / corporate governance Risk management systems Risk management systems Internal control systems and environment Comprehensive internal controls Infrastructure to meet business needs Other support systems Inherent risks (see Diagram 3 above) Inherent risks captured by BCR minimum CAR Direction of risk Inherent risks captured by Pillar 2 capital requirement Capital strength and capability to withstand risk (including CAAP where applicable) RISK PROFILE §97F MINIMUM CAR (Note) Note: From 2016 onwards when the capital buffers are implemented, the P2B requirement (i.e. the portion of the Pillar 2 capital requirement that relates to P2B risks) will be excluded from the §97F minimum CAR and will be absorbed into the buffers.
3.6.2 The MA’s assessment of an AI’s capital strength and
capability to withstand risk (including a review of the AI’s CAAP where applicable) conducted as part of the SRP, supplements the ongoing risk-based supervisory

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 process by providing detailed analyses on the AI’s capital strength and earning capacity.
3.7 Use of stress tests
Role of stress-testing under SRP
3.7.1 An important aspect of the SRP is to assess the potential
vulnerability of an AI to adverse events or other external factors affecting the AI (e.g. economic cycle risk) and the need for the AI to hold additional capital for such risk.
3.7.2 In performing this assessment under the SRP, the MA
will have regard to the results of stress tests conducted by an AI, which may provide useful information about the effects of “stressed” situations on the AI’s financial condition, particularly the impact on its asset quality, profitability and capital adequacy.
3.7.3 Stress tests include sensitivity tests and scenario
analyses. A sensitivity test typically involves shifting the values of individual risk factors (e.g. worsening of credit spreads or adverse changes in interest rates or other macroeconomic variables) and determining the effect of such changes on an AI’s business and financial positions.
3.7.4 A scenario analysis measures the combined effect of
adverse movements in a wider range of risk factors affecting an AI’s business operations at the same time (e.g. an economic recession coupled with a tightening of market liquidity and declining asset prices). Stress scenarios may be derived from stochastic models or historical events, and can be developed with varying degrees of precision, depth and severity.
3.7.5 Stress tests, which supplement other risk management
approaches and measures, help improve an AI’s understanding of the vulnerabilities that it faces under exceptional, but plausible, events, and provide the AI with an indication of how much capital might be needed to absorb losses if such events occur. These events can

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 be financial, operational, legal or relate to any other risk that may have an economic impact on the AI concerned.
3.7.6 The results derived from stress tests should be regularly
used by AIs in their determination of the appropriate appetite / tolerance for different types of risk, and in estimating the amount of capital that should be set aside to cover them. Stress-testing obligations on AIs
3.7.7 Under the SRP, AIs are expected to carry out regularly
rigorous and forward-looking stress tests, that are appropriate to the nature of their business and the major sources of risk faced by them, for risk management purposes. The MA assesses the effectiveness of an AI’s stress-testing programme in accordance with the general standards set out in IC-5 “Stress-testing”, and considers whether the use of stress-testing forms an integral part of the AI’s overall governance and risk management culture. The MA may challenge the key assumptions driving the stress-testing results and their continuing relevance in view of existing and potential changing market conditions. This will be done as part of his review of the AI’s risk management systems.
3.7.8 AIs should integrate relevant stress-testing results into
their CAAP so as to ensure that there is sufficient capital to withstand the impact of possible adverse events or changes in market conditions on them. In his review of an AI’s CAAP, the MA takes into account the stresstesting approach adopted by the AI (including the methodologies and assumptions used), examines the AI’s projected capital resources and capital requirements under adverse scenarios, and considers the extent to which the AI has provided for unexpected events in setting its capital level. See Annex D regarding the supervisory requirements on the application of stress tests for the assessment of capital adequacy.
3.7.9 In addition, AIs using the IRB approach to calculate
credit risk, the IMM approach to calculate market risk, or

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 the IMM(CCR) approach to calculate counterparty credit risk are required to conduct respectively credit risk, market risk or counterparty credit risk stress tests in compliance with the relevant minimum requirements in the Banking (Capital) Rules. The MA reviews the stress-testing results to ascertain whether AIs have sufficient capital to meet the minimum capital requirements in plausible but adverse stressed conditions.
3.7.10 If the MA is not satisfied with an AI’s capital adequacy
after taking into account its stress-testing results, the MA may consider increasing the AI’s minimum CAR and/or require the AI to reduce its risks. Where necessary, other appropriate supervisory measures may also be taken. Supervisory stress tests
3.7.11 In reviewing AIs’ capability to withstand risk, the MA
conducts sector-wide stress tests regularly to assess and compare individual AIs’ vulnerability to the same set of severe market shocks or crisis situations (e.g. based on hypothetical scenarios that are similar to, or more severe than, those experienced during the 1997/1998 Asian Crisis or the 2007/2008 global financial crisis), making use of the statistical data provided by AIs or results generated from their stress tests.
3.7.12 Other stress tests will also be applied where appropriate.
For example, the MA applies liquidity stress tests to retail banks based on the quarterly cash flow data submitted by them to assess their vulnerability to liquidity crises or bank-run situations when determining the level of their liquidity risk.
3.7.13 The MA will consider whether those “outlier” AIs that
show significant vulnerability to “stressed” situations compared with their peers warrant a higher minimum CAR and/or a reduction in risk exposures.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
3.8 Supervisory guidance on risk management practices
3.8.1 A key feature of the SRP lies in its emphasis on the
comprehensive recognition of risk in an AI’s capital planning and management processes. Apart from requiring AIs to maintain adequate capital to support the risks associated with them, the SRP encourages them to develop and use better risk management techniques for monitoring and controlling such risks, especially those specific risks not directly or fully addressed under Pillar 1.
3.8.2 The MA will continue to develop or enhance supervisory
guidelines on risk management and control standards applicable to the SRP (see Annex A for a list of relevant supervisory guidelines) with a view to:

encouraging AIs to adopt international standards
and best practices in managing their risks;
enabling them to be better prepared for meeting the
relevant standards under the SRP; and
ensuring a consistent application of the standards.
3.9 Ongoing monitoring of capital adequacy
3.9.1 The MA monitors and evaluates AIs’ capital adequacy
on an ongoing basis, including their compliance with the qualifying criteria for the relevant approaches adopted by them under the Banking (Capital) Rules. For example, these may relate to the use of the IRB approach for calculating credit risk, the IMM approach for calculating market risk, the IMM(CCR) approach for calculating counterparty credit risk, or the recognition of credit risk mitigation techniques and securitization transactions for capital adequacy purposes.
3.9.2 If an AI is found to have a continuing decline in its capital
levels, the MA will require the AI to provide a capital restoration plan and the timetable for achieving the necessary capital restoration. The MA will establish an

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 action plan to monitor the AI closely. If the AI’s capital is not maintained or restored within the specified timeframe, the MA is likely to take other supervisory actions he considers appropriate, such as restricting the AI from business expansion or limiting its business, operations or network, pending restoration of the capital to an adequate position.
3.9.3 If the findings gathered from ongoing offsite reviews or
onsite examinations reflect concerns about an AI’s compliance with certain qualifying criteria or conditions under the Banking (Capital) Rules, the MA may seek further explanations from the AI or conduct a more detailed examination to assess the concerns. If necessary, the MA may commission a special review under §59(2) of the Banking Ordinance.
3.9.4 As AIs have an obligation to manage their capital and
ensure that it is sufficient to cover the risks undertaken by them, they are expected to maintain adequate and effective internal monitoring systems (e.g. through internal validations or audits) to ensure that their capital does not fall below prudent levels, and that they continue to meet the minimum standards and eligibility criteria required for the use of particular approaches or methodologies under the Banking (Capital) Rules.
3.9.5 The MA would expect AIs to advise him of any
significant decline in capital levels or non-compliance with the standards or criteria under the Banking (Capital) Rules referred to in para. 3.9.4 (and the causes of such decline or non-compliance) and the remedial actions to be taken as soon as practicable. In the event that an AI’s capital falls below the §97F minimum CAR or the non-statutory trigger ratios (before the latter’s removal from 1 January 2016), the AI should set out a plan for restoring its capital position. Depending upon the circumstances and frequency with which these situations occur, the MA may regard them as indicative of system and control weaknesses.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
4. Supervisory standards on CAAP
4.1 General
4.1.1 Under the SRP, AIs are expected to have a CAAP for
assessing their overall capital adequacy in relation to their risk profile and a strategy for maintaining their capital levels, unless otherwise exempted by the MA (see para. 4.1.2). The CAAP should fit their individual circumstances and needs, having regard to the risk profile and level of sophistication of their operations. The MA has the responsibility of evaluating AIs’ CAAP and their capital adequacy through the SRP, the results of which will be taken into account in determining their Pillar 2 capital requirement and, ultimately, their §97F minimum CAR.
4.1.2 This section sets out the MA’s approach to reviewing AIs’
CAAP and the supervisory standards expected of such CAAP. The requirements for conducting CAAP are applicable to all AIs except for the following:

AIs that have the MA’s approval for adopting the
basic approach for credit risk permanently are not subject to the CAAP standards in the light of their small and simple operations. Nevertheless, they remain responsible for ensuring that there is sufficient capital to meet their business and operational needs; and
AIs that are subsidiaries of a local banking group are
not required to establish their own CAAP if their capital is managed on a group basis and incorporated into the group CAAP.
4.1.3 The MA recognises that there is no single correct
approach to conducting the CAAP. As such, the focus of the MA is on providing high level guidance rather than prescriptive criteria on CAAP methodologies or techniques that should be employed. This also takes into account the fact that market practices for conducting the CAAP, and the development of relevant

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 methodologies and techniques (e.g. on how nonquantifiable risks such as reputation and strategic risks are to be measured), are still evolving. The onus, therefore, is on AIs to explain and demonstrate how their CAAP meets supervisory standards, and why they consider their capital targets appropriate given the scale and complexity of their business.
4.1.4 The MA assesses the reasonableness of the outcome of
an AI’s CAAP in his review. Whilst the MA will not seek to reconcile precisely the §97F minimum CAR set by the MA with the outcome of the AI’s CAAP (which will likely reflect economic capital as opposed to regulatory capital), it is the case that with the greater focus under Basel III on capital of higher loss-absorbing quality (i.e. CET1 capital), the minimum CET1 capital ratio and the minimum Tier 1 capital ratio set by the MA within the §97F minimum CAR will be expected to be more comparable to the outcome of the AI’s CAAP than hitherto. 30
4.1.5 AIs may have different capital adequacy goals (e.g.
some may target a certain credit rating and some may seek to hold sufficient capital for long-term sustainable growth). At a minimum, the MA would expect an AI to establish a CAAP to assess the capital needed to cover all material risks, achieve its business plan and enable it to continue to operate its business on a going concern basis (with sufficient Tier 1 capital to protect itself from insolvency). The CAAP should also enable an AI to measure its risks and allocate capital against such risks more precisely.
4.1.6 As mentioned in para. 1.4.4, the MA’s assessment of an
AI’s CAAP will feed into the MA’s overall assessment of

30 Generally speaking, economic capital is more concerned with shareholders’ funds than with other sources of subordinated funding (i.e. the amount of losses that can be absorbed before shareholders’ funds are exhausted) and hence is more akin to the nature of Tier 1 capital. Nevertheless, the approach to evaluating economic capital may differ among AIs depending on the capital objective or the desired level of confidence interval set. Regulatory capital goes beyond the amount needed for survival and includes Tier 2 capital (which serves as an additional protective cushion for depositors).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 the AI’s capital adequacy, including the setting of the AI’s Pillar 2 capital requirement, and may result in the institution of supervisory measures if significant weaknesses are observed in the CAAP. It is therefore in the interest of AIs to enhance their CAAP capabilities on a continuing basis.
4.2 Board and senior management oversight
General responsibilities for CAAP
4.2.1 The Board and senior management of an AI have the
primary responsibility for ensuring that the AI has adequate capital to support its risks. At a minimum, the capital required should enable the AI to operate as a going concern and be sufficient to provide for business growth.
4.2.2 The Board and senior management should ensure that
the AI has in place a strategic plan which clearly outlines its current and future capital needs, anticipated capital expenditures, desirable capital level, and external capital sources. This analysis of capital requirements in relation to an AI’s strategic objectives is a vital element of the strategic planning process. In addition, the Board and senior management should ensure that the AI has in place an effective capital planning process (see paras.
4.3.11 to 4.3.13 for more details) in order to achieve the
desired strategic objectives, and that all staff are fully aware of the AI’s corporate goals and objectives.
4.2.3 A sound firm-wide risk management framework is the
foundation for an effective assessment of the adequacy of an AI’s capital position. The Board and senior management should ensure that such a framework is in place, enabling the AI to set its appetite and tolerance for risks, and supporting the ability of the Board and senior management to manage the AI’s risks from an integrated, firm-wide perspective and to identify and react to emerging and growing risks in a timely and effective manner.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
4.2.4 To achieve a sound firm-wide risk management
framework, the Board and senior management should:

have a thorough understanding of the AI’s risks on a
firm-wide basis, especially the risks associated with new or complex products and activities (e.g. those arising from new business models (in the 2007/2008 Global Financial Crisis the risks arising from the “originate-to-distribute” business model became apparent) or from securitization activities), and how such risks interact with other risks and relate to adequate capital levels under both normal and stressed conditions;
ensure that the AI’s risk management framework
includes detailed policies that set specific firm-wide prudential limits on the AI’s activities, which are consistent with its risk-taking appetite and capacity;
ensure that the infrastructure, systems and controls
necessary to manage the AI’s risks are in place, and are effective and commensurate with its overall risk profile;
ensure that accountability and lines of authority are
clearly delineated and effectively communicated throughout the organisation;
provide specific guidance for the implementation of
the AI’s business strategies, and monitor compliance with internal policies and limits established for managing the various types of risk associated with the AI;
establish adequate operating and control procedures
to ensure that the AI is operating in compliance with regulatory capital and disclosure standards and requirements and to monitor the performance of staff in administering and controlling the capital position of the AI; and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

remain adequately informed on an ongoing and
timely basis about the AI’s risks as financial markets, risk management practices and the AI’s activities evolve. Definition of capital used
4.2.5 It is important for the Board and senior management to
ensure that the definition of the AI’s capital used in its CAAP is stated clearly and consistently applied, particularly as there are various definitions of capital that may be used within the banking industry. For example, some AIs may for internal purposes choose a narrow definition for capital, such as confining it to ordinary shares, while others may define capital more broadly. The Board and senior management should understand such differences and their implications. As the components of capital are of varying quality, have varying characteristics and do not all have the same ability to absorb losses on a going concern basis, the Board and senior management should thoroughly comprehend the relationship between the AI’s capital definition and its assessment of capital adequacy. Any changes in the AI’s internal definition of capital and the reason for those changes should be properly documented. Capital planning and management policies
4.2.6 It is likewise important that the Board and senior
management should, among other things, ensure that internal policies including, at a minimum, those set out below are in place for capital planning and management purposes, and meet the standards and criteria required in the relevant supervisory guidelines (see Annex A for more details):
a capital policy which, at a minimum, includes :
− the AI’s short-term and long-term capital adequacy goals in relation to its risk profile,

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 taking into account its strategic focus and business plan; − the approach for determining the AI’s overall capital adequacy in relation to its risk profile; − the approved capital targets that are consistent with the AI’s overall risk profile and financial position; and − measures that would be taken in the event capital falls below a targeted level;

other management policies to supplement the
capital policy in relation to:
− firm-wide risk management, which takes into account all material risks (both quantifiable and non-quantifiable) 31 as well as risks that do not appear to be significant in isolation, but when combined with other risks could lead to material losses or consequences 32; − stress-testing, which should adequately address economic cycle risk and measure the AI’s ability to withstand adverse conditions (see subsection
3.7 for more details);
− valuation practices, which should apply to all positions (including complex, structured products and financial instruments) that are measured at fair value and cover different circumstances, especially during times of stress;

31 Apart from the eight inherent risks identified for the purpose of risk-based supervision, other material risks, such as those posed by concentrations, securitization and off-balance sheet exposures that are relevant to the AI, should also be considered. 32 For example, the direct loss of an AI arising from an operational risk event (e.g. loss of confidential customer data) may be limited in itself. However, if this event affects a large number of customers and attracts substantial adverse market publicity, there may be significant damage to the AI’s reputation, apart from the potential claims for damages filed by the customers and other regulatory consequences for the AI for breaching data privacy rules and client confidentiality obligations.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 − remuneration systems, which should consider risk-adjusted performance measures and focus on achieving longer-term capital preservation and financial strength rather than focusing on, and thereby potentially encouraging, the generation of short-term accounting profits; − dividend payout, which should neither hinder the AI from capital formation to support business growth nor weaken its capital position or financial soundness; − provisioning levels and provisioning methodology, which should ensure that the level of provisions established and maintained by the AI is adequate to absorb estimated losses inherent in the AI’s asset portfolios, binding commitments and contingent liabilities; and − income recognition and associated methodology, which should, among other things, clearly define under what situations the AI can or cannot recognise income and set out the details of the methodologies adopted.
4.2.7 The Board and senior management should also review
the AI’s capital planning and management policies, with changes to those policies approved by the Board, at least annually or whenever such review is prompted by specific events (e.g. an opportunity for a significant acquisition has emerged), and establish additional policies where necessary, to ensure that all such internal policies are always in compliance with the applicable supervisory and regulatory requirements.
4.2.8 Failure to adhere to the above requirements may call into
question whether the Board and senior management have adequately discharged their responsibility under para. 4.2.1.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
4.3 Key elements of CAAP
General
4.3.1 AIs are expected to develop a CAAP that is:

comprehensive in terms of the identification and
measurement of the risks associated with an AI’s business and the assessment of how much capital is needed to support these risks;
risk-based and forward-looking, with emphasis on
the importance of capital planning, management and other qualitative aspects of risk management and controls, and takes into account the AI’s strategic plans and how these relate to macroeconomic factors;
integrated into the management process and
decision-making culture of the AI. For more sophisticated AIs, the CAAP should be integrated into their day-to-day management process. For example, in addition to allocation of capital to business units, the CAAP would likely play a part in making credit decisions or other general business decisions (e.g. expansion plans and budgets). The results of the CAAP may also feed into the process of determining business strategies and risk appetite / tolerance levels. Although smaller AIs tend to have less sophisticated capital planning and assessment systems, their CAAP should at least produce results that enable the ongoing assessment and management of their risk profile (e.g. the results may influence their lending behaviour or use of risk mitigants) and inform the setting of risk appetite / tolerance; and
capable of producing a reasonable outcome on the
overall level of capital required and the assessment supporting such outcome.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
4.3.2 The CAAP should capture all material risks of an AI,
including the eight inherent risks covered under the MA’s risk-based supervisory framework, and the interactions of these risks under both normal and stressed conditions. The overall environment within which the CAAP should operate is also important. AIs should, in particular, be able to identify other external risk factors that may arise from the regulatory, economic or business environment. In addition, adequate corporate governance and proper risk management and internal control arrangements constitute the foundation of an effective CAAP.
4.3.3 The basic elements of a sound CAAP should include:

policies and procedures to identify, measure, monitor,
control, and report the risks inherent in an AI’s activities;
a process to relate the AI’s internal capital to its risks;
a process to state the AI’s capital adequacy goals in
relation to risks, taking into account its strategic focus and business plan; and
a process of internal controls, independent reviews
and audits to ensure the integrity of the overall management process. Risk management policies and procedures
4.3.4 The policies and procedures to identify, measure,
monitor, control, and report the risks inherent in an AI’s activities should meet the following standards:
risk measurement systems should be sufficiently
comprehensive and rigorous to capture the nature and magnitude of the risks faced by the AI, while differentiating risk exposures consistently among risk categories and levels of riskiness. Such systems should also be capable of performing risk

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 aggregation 33 across different risk types or business lines;

adequate controls should be in place to ensure the
objectivity and consistency of risk identification and measurement and that all material risks (both onand off-balance sheet) are adequately addressed;
detailed analyses should be conducted to support
the accuracy or appropriateness of the risk measurement techniques used;
inputs used in risk measurement should be of good
quality;
those risks that are not easily quantifiable should be
evaluated using qualitative assessment and management judgement. Nevertheless, AIs should recognise the biases and assumptions embedded in, and the limitations of, the qualitative approaches used;
the economic substance of risk exposures, including
reputation risk and valuation uncertainty, should be fully recognised and incorporated into the risk management process;
changes in the AI’s risk profile should be promptly
incorporated into risk measures, whether the changes are due to new products or new businesses, increased volumes, changes in concentrations, the quality of the portfolio or the overall economic environment;

33 Risk aggregation is the summation of different risk types into a single risk measure. An effective CAAP should use this aggregate risk measure to estimate the amount of capital required. AIs are therefore expected to perform risk aggregation when conducting the CAAP, regardless of whether they use risk-modelling techniques to assess capital adequacy or not. If an AI uses risk-modelling techniques to assess capital adequacy, the AI should comply with the additional requirements set out in subsection 4.4.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

when measuring risks, comprehensive and rigorous
stress tests should be performed to identify possible events or market changes that could have serious adverse effects or significant impact on the AI’s capital and operations (see Annex D for more details); and
adequate consideration should be given to
contingent exposures arising from loan commitments, securitization and other transactions or activities that may create such exposures (see
Annex E for more details).
4.3.5 To facilitate firm-wide risk management and oversight,
AIs should have in place appropriate infrastructure and MIS that contain, at a minimum, the following key elements:
For aggregation of risks
allow for the aggregation of exposures and risk
measures across business lines and platforms (including the banking and trading books) in managing risks and monitoring limits;
support customised identification of concentrations
and emerging risks;
support the ability to evaluate the impact of various
types of economic and financial shocks that affect the whole organisation;
offer sufficient flexibility to incorporate hedging and
other risk mitigating actions to be carried out on a firm-wide basis while taking into account the various related basis risks; To enable proactive risk management
should be capable of providing regular, accurate and
timely information on the AI’s aggregate risk profile

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 as well as the main assumptions used for risk aggregation;

should be adaptable and responsive to changes in
the AI’s underlying risk assumptions;
should incorporate multiple perspectives of risk
exposure to account for uncertainties in risk measurement; and
should be sufficiently flexible so that the AI can
generate forward-looking firm-wide scenario analyses that capture management’s interpretation of evolving market conditions and stressed conditions.
4.3.6 If AIs use third-party inputs or other tools (e.g. credit
ratings, risk measures and models, etc.) to produce risk management information, they should have adequate procedures in place to ensure that such inputs and tools are subject to initial and ongoing validation.
4.3.7 If AIs employ risk mitigating techniques, they should
understand the risk to be mitigated and the potential effects of that mitigation (including its enforceability and effectiveness), and have in place appropriate policies and procedures to control risks associated with these techniques (see subsection B6.2 under Annex B for more details).
4.3.8 AIs should understand that it is often difficult to quantify
measurement errors that may exist in risk measurement. As a result, the level of capital maintained should cater for an increase in uncertainty related to modelling and business complexity. AIs should suitably account for measurement errors when calculating capital requirements, and be able to demonstrate the adequacy of capital to address such errors.
4.3.9 AIs conducting risk aggregation among various risk types
or business lines should understand the challenges in such aggregation. They should seek to address any

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 potential concentrations across more than one risk dimension, recognising that losses could arise in several risk dimensions at the same time, stemming from the same event or a common set of factors. For example, a localised natural disaster could generate losses from credit, market and operational risks at the same time. (See Annex F for more details.) Internal capital allocation process
4.3.10 The process of relating an AI’s internal capital to its risks
should meet the following requirements:

the amount of capital held should reflect not only the
measured amount of risk but also an additional amount to account for potential uncertainties in risk measurement (e.g. measurement error or modelling risk) (see also para. 4.3.8);
the AI’s capital should reflect the perceived level of
precision in the risk measures used, the potential volatility of exposures and the relative importance of the activities producing the risk;
capital levels should reflect the fact that historical
correlation among exposures can change rapidly; and
the AI should be able to demonstrate that its
approach to relating capital to risk is conceptually sound and that outputs and results are reasonable. Setting of capital adequacy goals
4.3.11 There should be a process to state the AI’s capital
adequacy goals in relation to risks, taking into account its strategic focus and business plan:
explicit goals and targets need to be established for
evaluating the AI’s capital adequacy with respect to its risks;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

the AI should develop an internal strategy for
maintaining capital levels which should not only reflect the desired level of risk coverage but also incorporate factors such as loan growth expectations, future sources and uses of funds, and dividend policy. There may be other considerations that the AI considers relevant or important in determining how much capital it should hold (e.g. external rating goals, market image, strategic goals, etc.). If these other considerations are included in the CAAP, the AI will be required to show how the considerations have influenced its decisions concerning the amount of capital to be held;
the AI should have an explicit, approved capital plan
that should state its objectives and time horizon for achieving them, and set out in broad terms the capital planning process and the responsibilities for that process. The capital plan should recognise that accommodating additional capital needs requires significant lead time, and take into account the potential difficulties of raising additional capital during downturns or other times of stress. It should also set out how the AI will comply with regulatory capital requirements, any relevant limits related to capital, and a general contingency plan for dealing with divergences and unexpected events (e.g. raising additional capital, restricting business activities or using risk mitigating techniques for risk management purposes, etc.);
the AI should conduct stress tests that take into
account the risks of the environment and the prevailing stage of the economic cycle in which it is operating, to assess the impact of possible adverse events or scenarios on its capital. The AI should analyse what impact new legislation or competitors’ actions may have on its performance, in order to ascertain what changes in the environment it could sustain. The requirements and scenarios for stresstesting should be proportionate to the nature, size,

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 risk profile and complexity of the AI’s business activities;

the AI should evaluate whether its long-run capital
targets might differ from its short-run goals, based on current and planned changes in its risk profile and the lead time for raising new capital;
it is not necessary for the AI to use formal economic
capital models for setting capital goals and targets and assessing its capital adequacy, although it is expected that more sophisticated AIs will elect to do so (in which case the additional criteria set out in subsection 4.4 have to be satisfied);
the capital goals and targets should be reviewed and
approved by the Board regularly (at least annually) to ensure their appropriateness; and
appropriate adjustments to the CAAP should be
promptly initiated if changes in the business, strategy or operational environment suggest that the CAAP is no longer adequate.
4.3.12 AIs should recognise that the §97F minimum CAR
imposed on an AI represents a regulatory floor requirement below which the AI’s overall capital level must not fall, even if the AI’s management believes that a lower capital level is justified.
4.3.13 AIs should ensure that adequate capital is held against
all material risks not just at a point in time, but over time, to account for changes in their strategic direction, evolving economic conditions and volatility in the financial environment. Internal controls and audits
4.3.14 There should be a process of internal controls,
independent reviews and audits to ensure the adequacy, effectiveness and reliability of the overall CAAP, and to monitor the actual performance against the approved

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 capital goals and targets as well as the conformity with the strategy and objectives stated in the CAAP. The frequency of the independent reviews and audits may vary depending on the size and complexity of individual AIs but should not be less than once every year.
4.3.15 The CAAP and risk management process should be
subject to periodic reviews to ensure their integrity, accuracy and reasonableness. Areas that should be reviewed include:

the appropriateness of risk appetite / tolerance
levels and capital planning, the effectiveness of the CAAP, and the strength of internal control infrastructure given the nature, scope and complexity of the AI’s business;
where applicable, the appropriateness and validity of
third-party inputs or other tools used for management information purposes (e.g. credit ratings, risk measures and models);
the identification of large exposures and risk
concentrations;
the accuracy and completeness of data input into
the AI’s assessment process;
the reasonableness and validity of scenarios used in
the assessment process; and
the use of stress-testing, including an analysis of the
underlying assumptions and inputs.
4.3.16 All deficiencies and weaknesses identified in the CAAP,
as well as any non-compliance with approved internal policies and management guidelines on capital adequacy or the Banking (Capital) Rules, must be promptly reported to the Board and senior management for early rectification.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
4.3.17 Special attention should be paid to reviewing those areas
of the CAAP that may be affected by changes in the operational or business environment, such as the introduction of new products and activities. Design of CAAP
4.3.18 AIs may design their CAAP in different ways to cater for
their individual needs and circumstances. The following are some options that AIs may have reference to:

using the BCR minimum CAR as a starting point and
adding considerations which are not captured, or not adequately captured, by the BCR minimum CAR. For many small and less complex AIs, a relatively simple CAAP is entirely acceptable. One possibility might be to base their CAAP primarily on the methodology set out in the Banking (Capital) Rules, supplemented as necessary for any other generic factors which have a particular bearing on their risk profile (e.g. in terms of size, sector or products). For example, to obtain a capital goal, an AI may simply take the BCR minimum CAR and adjust it with a self-determined “capital surcharge” 34 which is calibrated from elements outside the consideration of the BCR minimum CAR and from other forwardlooking elements (including the effect of stressed conditions). The AI should be able to demonstrate that it has adequately analysed all material risks outside the BCR minimum CAR and found that all such risks were covered by the “capital surcharge”;
using different methodologies for different risk types
(including all risks captured by the BCR minimum CAR and the self-determined “capital surcharge”) and then calculating a simple sum of the resulting capital “needs”;

34 The term “capital surcharge” referred to in para. 4.3.18 covers the situation in which an AI determines the additional capital it should maintain on top of the BCR minimum CAR based on its own internal capital assessment.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

using a more sophisticated and complex system,
e.g. “bottom-up” transaction-based approaches with integrated correlations; or
using a combination of the above.
4.3.19 AIs should ensure that decisions regarding the design
and operation of the CAAP should not be unduly influenced by competing business objectives.
4.3.20 AIs should enhance and refine their CAAP over time,
taking into account changes in their risk profile and activities as well as advances in risk measurement and management practices. Documentation of CAAP
4.3.21 AIs should have complete documentation covering the
CAAP. Such documentation should at least include:
a description of the overall process;
all related policies and management guidelines;
all committees and individuals involved in the CAAP,
including their responsibilities;
the methodologies, assumptions and procedures
used in the CAAP, covering all aspects ordinarily expected for the sound use of quantitative methods, including model selection, limitations, data selection and maintenance, controls and validation;
the frequency of CAAP-related reporting; and
the procedures for the periodic evaluation of the
appropriateness and adequacy of the CAAP.
4.3.22 The documentation of the CAAP should be subject to
periodic review and approval by the Board (at least annually).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
4.3.23 The CAAP and related policies, management guidelines
and procedures should be communicated and implemented firm-wide and supported by sufficient authority and resources.
4.4 Additional criteria for use of risk-modelling techniques
4.4.1 Larger and more sophisticated AIs may prefer using riskmodelling techniques (e.g. economic capital or other
models) to perform risk aggregation and to assess capital adequacy within a certain degree of confidence. Nevertheless, this approach is not mandatory.
4.4.2 AIs using risk-modelling techniques to assess capital
adequacy should ensure that their CAAP is a comprehensive process seeking to identify their capital needs on the basis of both quantifiable and nonquantifiable risks. AIs should not rely on quantitative methods alone to assess capital adequacy. Nonquantifiable risks, if material, should also be included using qualitative assessment and management judgement. For example, in modelling the potential consequences of individual risks, account needs to be taken not only of the immediate direct profit and loss impact of possible loss events, but also of their potential consequential cost in terms of damage to AIs’ reputation and future earning capacity.
4.4.3 Under no circumstances should the CAAP be a process
which focuses only narrowly on the calculation and use of allocated capital or economic value added for individual products or business lines for internal profitability analysis. This approach can be important to an AI in targeting activities for future growth or retrenchment. However, the AI is required to first determine (by whatever methods are deemed most appropriate to the AI’s circumstances) the amount of capital necessary for each activity or business line as a tool for evaluating the overall capital adequacy of the AI. Thus, the process for determining the necessary capital should not be confused with the related management efforts to measure relative returns of the AI or of

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 individual business lines, given an amount of capital already invested or allocated.
4.4.4 AIs must have in place adequate policies, controls and
procedures to validate, on a regular basis, the methodology and data and the robustness of the systems and processes involved in modelling the probabilities of occurrence, and the potential consequences of individual risks and their aggregation. Such policies, controls and procedures should be appropriate for their nature of business and level of sophistication, as well as the relative importance of each component of the CAAP. The internal validation process should encompass, but should not be limited to, the collection and review of developmental evidence, process verification, benchmarking, outcomes analysis, and monitoring activities used to confirm that processes are operating as designed. AIs should also be able to demonstrate that their validation process is adequate to enable them to assess the performance of the riskmodelling techniques consistently and meaningfully.
4.4.5 The MA will assess whether the overall assessment and
validation processes are commensurate with the nature, size and complexity of the AI’s business and whether the outcomes generated from the processes are reasonable. The MA will also assess the extent to which the riskmodelling techniques, and the risk-adjusted performance measurement they support, are actually employed in managing the AI’s business. Obviously it will be difficult to assign much credibility to a model in respect of which an AI lacks either the confidence, or the perceived need, to use it for the purpose of making its business decisions.
4.5 Requirements for consolidated capital
4.5.1 AIs are required to conduct their CAAP on a consolidated
basis if they have any subsidiary that is subject to §3C of the Banking (Capital) Rules.
4.5.2 AIs conducting their CAAP at the group level should
ensure that their consolidated capital is adequate to:

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

support the volume and risk characteristics of all
parent and subsidiary activities; and
provide a sufficient cushion to absorb potential
losses arising from such activities.
4.5.3 AIs should also be able to demonstrate to the satisfaction
of the MA that:
their CAAP has been conducted on a consolidated
basis and the total capital estimated as appropriate for the group has been allocated to each group member, according to their risk profile;
all group members, including the AI itself, have fully
evaluated the risks they face (including reputation risk arising from the failure of another group member, and the risks they face due to exposure to, or dependence on, other group members);
capital is freely transferable within the group (even in
situations where the group is under financial stress, especially in relation to the group’s cross-border operations where jurisdictional issues come into play); and
in case there is capital that is not, or that is unlikely
to be, freely transferable between legal entities within the group, the CAAP has been adjusted to exclude such capital from the consolidated capital adequacy assessment.
4.5.4 In assessing the capital adequacy of the consolidated
position, the MA will apply the same standards and requirements as he applies for assessing the capital adequacy of an AI on a solo basis.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
4.6 Application to subsidiary AIs
4.6.1 Unless otherwise specified in paras. 2.6.3 35 and 4.6.2, all
subsidiary AIs are required to ensure that they are adequately capitalised on a stand-alone basis and have their own CAAP, commensurate with, and proportionate to, the nature, size and complexity of their business in Hong Kong, for supervisory review purposes. The MA will continue to exercise his legal duty under the Banking Ordinance to monitor their capital adequacy and their compliance with the Banking (Capital) Rules through the SRP.
4.6.2 Where appropriate, subsidiary AIs of a foreign banking
group may adopt the CAAP methodology used by their parent bank at the group level or, if their capital is centrally managed at the group level, rely on the group CAAP for assessing their capital adequacy. This is on the basis that the group CAAP is conducted in accordance with supervisory standards and criteria that are comparable with those required by the MA, and that the CAAP outcome for the subsidiary AIs has taken into account their local business strategies and associated risks.
4.6.3 Any foreign-owned subsidiary AIs that apply the group
CAAP for assessing their capital adequacy should be able to explain and demonstrate to the satisfaction of the MA how the capital assessment or allocation is made and how the assessment process meets supervisory standards and criteria comparable to those of the MA. They have the primary responsibility for providing the MA with any information, documentation and evidence that he may require for conducting the SRP. For example, the MA may require a subsidiary AI to provide an independent review or audit report in relation to the adequacy and integrity of the overall assessment

35 Under para. 2.6.3, a local banking group may develop a group CAAP covering the positions of its subsidiary AIs if their capital is centrally managed at the group level.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 process and/or the validity of the models used for the assessment.
4.6.4 If a foreign-owned subsidiary AI is unable to satisfy the
above-mentioned criteria, the AI will be required to establish and maintain its own CAAP in Hong Kong to meet the MA’s supervisory standards.
4.6.5 In reviewing the capital adequacy of foreign-owned
subsidiary AIs, the MA will also take into account the strength and availability of parental support and other relevant input from the home supervisor. For example, the MA may request the home supervisor to provide information and comments in respect of the capital adequacy of the parent bank or the results of its evaluation of the group CAAP systems.
4.6.6 The Board and senior management of subsidiary AIs
should note that their responsibility as mentioned in para.
4.2.1 remains unchanged irrespective of whether a group
CAAP methodology is adopted by a subsidiary AI.
4.7 Review by the MA
4.7.1 In reviewing and evaluating an AI’s CAAP, the MA will
have regard to the supervisory standards set out in this
section. Key factors to be considered include:

the soundness of the overall CAAP given the nature
and scale of the AI’s business activities;
the degree of management involvement in the
process, for example, whether the target and actual capital levels are properly monitored and reviewed by the Board (or a designated committee) and senior management;
the extent to which the internal capital assessment is
used routinely within the AI for decision-making purposes;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

the extent to which the AI has provided for
unexpected events in setting capital levels; and
the reasonableness of the outcome of the CAAP in
terms of whether:
− the amount of capital required as demonstrated by the CAAP is sufficient to support the risks faced by the AI; and − whether the levels and composition of capital chosen by the AI are comprehensive, relevant to the current operating environment, and appropriate for the nature and scale of the AI’s business activities.
4.7.2 AIs should be able to explain and demonstrate to the
satisfaction of the MA:
how their CAAP meets supervisory requirements;
how their material risks are defined, categorised and
measured (if their own terminology is adopted), and how their approach relates to their obligations under the Banking (Capital) Rules; and
how the internal capital targets are determined and
how these targets are consistent with their overall risk profile and the current operating environment as well as current and planned business needs. AIs are also expected to explain the similarities and differences between the level of capital calculated under their CAAP and their regulatory capital requirements.
4.7.3 The MA expects that AIs with complex operations should
have a more structured and well-defined risk management framework to monitor the effectiveness of internal control processes and risk exposures in comparison to AIs with simple organisational structures and less complex operations and activities, for which a

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 less sophisticated firm-wide risk management framework may be more appropriate.
4.7.4 In assessing whether AIs have sufficient capital to enable
them to continue to operate their business on a going concern basis, the MA will place particular importance on, among other things, the capacity of an AI’s capital structure to absorb losses and how this structure could be adversely affected by changes in performance 36. The MA recognises that Tier 1 capital is an important component of an AI’s capital structure because it allows AIs to absorb losses on an ongoing basis and is permanently available for this purpose. It also allows AIs to conserve resources when they are under stress as AIs have discretion as to the amount and timing of dividends and other distributions 37 . Therefore, AIs should determine the optimal level of Tier 1 (in particular CET1 capital) and Tier 2 capital to be maintained to meet their capital goals. AIs should also note that the capital structure implied by the BCR minimum CAR is only a minimum standard. AIs should attach more weight to CET1 and Tier 1 capital components in their capital structure if it is prudent to do so.
4.7.5 If an AI’s CAAP does not meaningfully link the
identification, evaluation and monitoring of the risks that arise from the AI’s business activities to the determination of its capital needs, the MA will require the AI to improve the CAAP for better integration with internal risk measurement and analysis. The MA will

36 For example, an AI experiencing a net operating loss (perhaps due to realisation of unexpected losses) will not only face a reduction in its retained earnings but also possible constraints on its access to capital markets. These constraints could be exacerbated if detrimental conversion options are exercised. These adverse effects could be further accentuated if adverse events take place at critical junctures for raising or maintaining capital (e.g. as term capital instruments are approaching maturity or new capital instruments are being issued). 37 In fact the Basel III capital framework has leveraged on this characteristic and imposed earnings conservation requirements for banks to observe when their capital level falls within the capital buffer range. The MA intends to adopt this requirement and further guidance will be issued in respect of the implementation of capital buffer requirements from 1 January 2016.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 monitor the progress made by the AI in implementing the corrective actions.
4.7.6 Where the amount of capital which the MA considers that
the AI should hold is not the same as that generated from the AI’s CAAP (particularly where the amount of capital generated is lower than that expected by the MA), the MA will discuss the difference with the AI. The MA will take into consideration the results of the CAAP and any explanations from the AI in relation to the outcome and appropriateness of the CAAP when determining the AI’s §97F minimum CAR.
4.7.7 To facilitate his review, the MA will ask for information
such as the results of an AI’s CAAP, together with an explanation of the process used. The MA will require the AI to provide information not only on the amount of capital it considers appropriate, but also on the composition of that capital. In the case of a group CAAP, there should be a breakdown of group capital so as to facilitate evaluation of the extent to which diversification benefits have been incorporated into the underlying assumptions.
4.7.8 The MA may seek other additional information from the
AI where necessary.
—————————
Contents Glossary Home Introduction

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Annex A: List of major supervisory guidelines applicable to
assessment of capital adequacy
A1 Introduction
A1.1 This annex sets out the major supervisory guidelines applicable to the assessment of AIs’ capital adequacy under the SRP. The MA will have regard to AIs’ compliance with the relevant supervisory standards and best practices contained in these guidelines (particularly in relation to systems and controls and corporate governance) when considering the impact of various assessment factors on an AI’s capital adequacy. A1.2 This list is provided for AIs’ reference only, and should not be regarded as a complete and exhaustive list. With a view to promoting the adoption of international standards and best practices within the banking sector, the MA will continue to issue new, and update existing, supervisory guidelines to provide guidance to AIs on various risk and control factors covered under the SRP. A1.3 AIs should refer to the Supervisory Policy Manual and other guidelines and circulars issued by the MA for a complete set of supervisory guidelines issued to the banking industry. A2 Guidelines under Supervisory Policy Manual by subject Supervisory approach SA-1 Risk-based supervisory approach SA-2 Outsourcing Corporate governance CG-1 Corporate governance of locally incorporated authorized institutions CG-2 Systems of control for the appointment of managers CG-3 Code of conduct CG-5 Guideline on a sound remuneration system

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 CG-6 Competence and ethical behaviour Internal controls IC-1 General risk management controls IC-2 Internal audit function IC-4 Complaint handling procedures IC-5 Stress-testing IC-6 The sharing and use of consumer credit data through a credit reference agency IC-7 The sharing and use of commercial credit data through a commercial credit reference agency Capital adequacy CA-G-1 Overview of capital adequacy regime for locally incorporated authorized institutions CA-G-3 Use of internal models approach to calculate market risk CA-G-4 Validating risk rating systems under the IRB approaches CA-S-4 Capital adequacy requirements for investment guarantees under mandatory provident fund schemes CA-S-5 Use of internal models to measure market risks for investment guarantees under MPF schemes CA-S-10 Financial instrument fair value practices Consolidated supervision CS-1 Group-wide approach to supervision of locally incorporated authorized institutions Credit risk management Risk management CR-G-1 General principles of credit risk management CR-G-2 Credit approval, review and records CR-G-3 Credit administration, measurement and monitoring CR-G-5 Country risk management CR-G-6 Interest recognition CR-G-7 Collateral and guarantees CR-G-8 Large exposures and risk concentrations CR-G-9 Connected lending

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 CR-G-10 Problem credit management CR-G-12 Credit derivatives [To be expanded and retitled “Credit risk transfer”] CR-G-13 Counterparty credit risk management Specific lending activities CR-S-2 Syndicated lending CR-S-4 New share subscription and share margin financing CR-S-5 Credit card business Interest rate risk management IR-1 Interest rate risk management Liquidity risk management LM-1 Liquidity risk management LM-2 Sound systems and controls for liquidity risk management Operational risk management OR-1 Operational risk management Reputation risk management RR-1 Reputation risk management Strategic risk management SR-1 Strategic risk management Trading activities TA-1 Market risk management [Under development] TA-2 Foreign exchange risk management Technology risk management General technology risk management TM-G-1 General principles for technology risk management TM-G-2 Business continuity planning

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Electronic banking TM-E-1 Supervision of e-banking TM-E-2 Regulation of advertising material for deposits issued over the internet Securities and leveraged foreign exchange business SB-1 Supervision of regulated activities of SFC-registered authorized institutions SB-2 Leveraged Foreign Exchange Trading – Conduct of Unsolicited Calls Mandatory Provident Fund MP-2 Provisioning requirements for investment guarantees under Mandatory Provident Fund Schemes Prevention of money laundering and terrorist financing ML-1 Guideline on Anti-Money Laundering and CounterTerrorist Financing Disclosure CA-D-1 Guideline on the application of the Banking (Disclosure) Rules A3 Other Guidelines and Circulars A3.1 Other relevant guidelines and circulars are available for AIs’ access on the HKMA’s public website (http://www.hkma.gov.hk/eng/key-information/guidelines-andcirculars/circulars/2012/) and private website. The major subjects covered by guidelines and circulars not included in
section A2 above are highlighted for reference:
Consumer protection;
Specific lending activities, e.g. property lending, etc; Debt collection; Liquidity risk management in relation to RTGS;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Market risk management; RMB business and associated risk management; and Risk management of securities, insurance and MPF activities.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Annex B: Factors for assessing capital adequacy under SRP
B1 Introduction
B1.1 The purpose of this annex is to illustrate the MA’s approach to assessing the capital adequacy of AIs by setting out the key assessment factors used by the MA under the SRP. This list of factors is compiled for AIs’ reference, and should not be regarded as a complete and exhaustive list. B1.2 Broadly speaking, the MA’s assessment under the SRP focuses on the following aspects:

the level of inherent risks faced by an AI (in particular those
risks that are not captured, or not adequately captured, under Pillar 1);
the adequacy of the AI’s systems and controls relating to
each type of inherent risk;
the AI’s capital strength and capability to withstand risk
(including, where applicable, the effectiveness of its CAAP);
the adequacy of the AI’s corporate governance
arrangements; and
any other factors (risk increasing or risk mitigating) that are
specific to the AI concerned.
Given their common applicability to AIs, the first four items listed above are referred to as “common assessment factors”. The last item is referred to as “specific assessment factors”, which will be considered by the MA on a case-by-case basis. B1.3 In reviewing the common assessment factors (particularly in respect of systems and controls and CAAP), the MA places special emphasis on an AI’s ongoing compliance with the Banking (Capital) Rules, including those qualifying criteria and minimum requirements to which the AI is subject (e.g. relating to the adoption of the IRB approach, IMM approach or IMM(CCR) approach), and the extent to which the supervisory standards

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 and best practices contained in the relevant guidelines issued by the MA (see Annex A) have been complied with. The MA also considers the quality of the AI’s systems and controls (including the level of firm-wide oversight exercised by the Board and senior management), the manner in which business risks and activities are aggregated (and any resultant risk concentrations are identified and controlled), and senior management’s track record in responding to emerging or changing risks. B1.4 The MA takes into account the business nature and the scale of operations (i.e. size, risk profile and complexity) of individual AIs and their significance to financial stability or other supervisory objectives in determining whether a factor is applicable or material to the assessment. B1.5 The MA employs a variety of methodologies and techniques to assess the effects of these factors, including the adoption of a scoring system for the common assessment factors, which, where appropriate, incorporates the use of stress-testing, peer group comparisons, benchmarking against industry performance and other relevant qualitative and quantitative analyses. The specific assessment factors are separately considered by the MA on a case-by-case basis, using similar methodologies and techniques. B2 Inherent risks not captured or not adequately captured under Pillar 1 B2.1 Credit concentration risk

Generally, a risk concentration is any single exposure or
group of similar exposures to the same borrower or counterparty (who may be a protection provider), geographical area, industry, economic sector or other risk factors with the potential of producing losses large enough (relative to an AI’s capital, earnings, total assets, or total risk exposures) to threaten the AI’s financial position or ability to maintain its core operations, or of producing a material change in the AI’s risk profile.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

Because lending is the primary activity of most AIs, credit
concentration risk is often the major source of risk concentration for an AI. As such, credit concentration risk is separately assessed under the common assessment factors. Other sources of risk concentration (e.g. those arising from funding sources or through a combination of exposures across different risk factors), if material, are assessed under specific assessment factors (see subsection B6.1 and Annex F for more details).
Credit concentration risk is normally driven by some
common or correlated risk factors (e.g. changes in economic or market conditions affecting specific industries or sectors), which, in times of stress, will increase the likelihood of default of, or credit deterioration in, individual counterparties or groups of related counterparties making up the concentration. Such concentration risk arises from direct exposures to counterparties and may also occur through exposures to the same credit protection provider or in relation to the obtaining of the same type of credit protection (e.g. the collateral obtained for share margin financing may be concentrated on a few listed stocks).
In assessing the level of credit concentration risk, the MA
pays particular attention to the sources of risk concentration arising from:
large exposures to individual counterparties or groups of
related counterparties (including credit protection providers);
“clustered” loan portfolios (i.e. portfolios with a large
number of sizable single exposures);
business activities (including lending, trading and
investment);
exposures to particular economic sectors or
geographical locations;
concentration of exposures by product, service, market
or collateral; and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

other concentrations, such as those arising from
concentration on a particular type of off-balance sheet exposure (e.g. credit derivatives or other complex financial instruments). B2.2 Residual operational (and legal) risk
Gross income, used in the basic indicator approach and the
standardized approach for the calculation of operational risk capital charge under the Banking (Capital) Rules, is only a proxy for the scale of operational risk exposures of an AI and can, in some cases (e.g. for AIs with low earnings or profit margins), underestimate the capital which should be held against operational risk.
There is thus a need to determine any residual risk of
operational loss resulting from an AI’s internal processes, staff and systems, or from external events (including lawsuits).
In conducting the SRP, the MA considers whether the level
of operational risk capital imposed on individual AIs under the Banking (Capital) Rules can adequately reflect their operational risk exposures, for example, in comparison with other AIs of similar size and with similar operations. The MA pays particular attention to risk factors that may not be fully accounted for in the estimation of such capital. These include incomplete identification of risks, the adoption of higher risk business models, and the existence of significant contingent liabilities.
The MA also reviews the nature, frequency, and materiality
of operational loss events incurred by AIs, and has regard to any of their business activities, functions or operational processes that may pose a higher level of operational risk (e.g. undue reliance on outsourced activities or significant operations in politically unstable areas). B2.3 Interest rate risk in the banking book
This is the risk to an AI’s financial condition resulting from
adverse movements in interest rates. The MA assesses the

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 level of interest rate risk in the banking book associated with an AI’s business activities from two separate but complementary perspectives, i.e. earnings and economic value.

In assessing the level of an AI’s interest rate repricing risk,
the MA, among other things, models a standardised 200- basis-point parallel rate shock to the AI’s interest rate risk exposures to measure the impact of the shock on its earnings over the next 12 months and on its economic value. The MA is particularly attentive to those AIs where the impact of the shock on their economic value is more than 20% of their capital base. Where appropriate, the MA will apply stress-testing techniques, especially in assessing an AI’s basis, options and yield curve risks.
The MA will determine whether AIs whose interest rate
exposures may lead to a significant decline in their earnings or economic value are exposed to a higher level of interest rate risk. B2.4 Liquidity risk
Liquidity is crucial to the ongoing viability of an AI. AIs’
capital positions can have an effect on their ability to obtain liquidity, especially in a crisis.
When evaluating an AI’s capital adequacy, the MA takes into
account its liquidity risk profile and the liquidity of the markets in which it operates under both normal and stressed conditions.
Factors to be considered include the level, trend and
volatility of the AI’s liquidity ratio, its loan-to-deposit ratio and maturity profile, the stability and concentration of its funding sources and other relevant qualitative factors such as its borrowing capability and access to money markets (particularly during emergency or crisis situations), its potential exposure to contingent liquidity obligations, and the availability of liquidity support from its major shareholders in case of need.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

In addition, the MA assesses the adequacy and quality of an
AI's stock of liquid assets to weather severe stress events (including prolonged market stresses), having regard to the results of liquidity stress tests conducted by the AI. In the case of retail banks, their ability to withstand bank-run scenarios will be further considered, based on the results of applying liquidity stress tests to the quarterly cash flow data submitted by these banks. B2.5 Strategic risk
This is the risk of current or prospective impact on an AI's
earnings, capital, reputation or standing arising from changes in the environment in which the AI operates and from adverse strategic decisions, improper implementation of decisions, or lack of responsiveness to industry, economic or technological changes.
Strategic risk is a function of the compatibility of an AI’s
strategic goals, the strategies developed to achieve these goals, the resources deployed to meet these goals, and the quality of implementation. The resources needed to implement an AI's strategies are both tangible and intangible. They include capital and funding, communication channels, staffing and operating systems, delivery networks, and managerial resources and capabilities.
In assessing an AI’s level of strategic risk, the MA considers
a number of factors, including:
– the compatibility or suitability of the AI’s strategic goals and objectives (e.g. relative to its size and complexity); – the AI’s responsiveness to changes in the environment (including those developments resulting in economic, technological, competitive or regulatory changes); – the adequacy of resources (both tangible and intangible) provided by the AI to carry out strategic decisions; – the AI’s track record in implementing strategic decisions (such as past performance of overseas operations and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 joint ventures and in offering new products and services); – any adverse impact on the AI (e.g. reputation or financial position) arising from its strategic decisions; and – any other warning signals of high potential strategic risk. B2.6 Reputation risk

This is the risk that an AI's reputation is damaged by one or
more than one reputation event 38, as reflected from negative publicity regarding the AI’s business practices, conduct or financial condition. Such negative publicity, whether true or not, may impair public confidence in the AI, result in costly litigation, or lead to a decline in its customer base, business or revenue.
The major factors that the MA takes into account in
assessing an AI’s level of reputation risk are listed below. These are not necessarily all-inclusive, but will serve as a guide for assessment purposes:
− the market or public perception of the financial strength of the AI’s major shareholders, its management and financial stability, and the prudence of its business practices; − management’s willingness and ability to adjust, where necessary, the AI’s strategies to enhance its reputation and standing (e.g. in response to changes in market perception, rules and regulations, or legal barriers) ; − the AI’s history of formulating business strategies and making commercial decisions that affect its financial position, business conduct and reputation, including those that reflect on the fairness and integrity of its

38 A reputation event includes any action, incident or circumstance in relation to an AI which induces, or is likely to induce, reputation risk for the AI. For example, such an event may arise from market rumours, severe regulatory sanctions, or heavy financial losses. Some of these events, if not acted upon swiftly and effectively, may turn into a full-blown crisis (such as a bank run).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 business dealings (e.g. in relation to the provision of banking services, charging of fees, etc.); − the AI’s history of, and plans for, analysing risk in new products and services, developing relevant policies and conducting due diligence; − the nature and volume of customer complaints and management’s willingness and ability to respond to those complaints; − management’s ability to handle any scandal or negative publicity to minimise damage to the AI’s reputation; − the existence of highly visible or conspicuous litigation (and historical losses arising from such litigation); − the level of the AI’s exposures associated with offbalance sheet vehicles (e.g. exposures to sponsored securitization structures), and its history of, or potential for, providing implicit support to such vehicles in times of stress due to reputation considerations (see Annex E for more details); − the existence of appropriate fiduciary or other liability insurance to mitigate potential losses arising from litigation or claims; and − the AI’s history with respect to conduct of business practices and compliance with laws and regulations, and management’s willingness and ability to address concerns uncovered in internal or regulatory reviews.

For AIs that are subsidiaries of a banking group (local or
foreign) or are branches of foreign-owned banks, the MA will additionally consider whether the financial position, reputation or conduct of the parent bank or head office, or any other member of the group could undermine confidence in the AI through “contagion”. The risk of contagion is not confined to financial weaknesses. Adverse publicity about illegal or unethical conduct by these entities may also damage the AI’s reputation.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 B3 Systems and controls relating to each type of inherent risk B3.1 Under the SRP, the MA evaluates the adequacy and effectiveness of systems and controls for managing the eight types of inherent risk (i.e. credit, market, interest rate, liquidity, operational, legal, reputation and strategic) identified for the purposes of risk-based supervision. B3.2 The MA’s assessment of an AI’s systems and controls for managing the inherent risks generally includes the following factors:

Risk management systems – the MA reviews the adequacy
of the AI’s risk management policies, procedures and limits as well as the effectiveness of its risk identification, measurement, monitoring and reporting processes to ensure compliance with the established policies, procedures and limits. The AI’s level of compliance with risk management standards set out in the MA’s supervisory guidelines in respect of different types of risk will also be a basis for assessment;
Internal control systems and environment – the MA
assesses the appropriateness of the AI’s organisation structure, the adequacy of its internal control systems (e.g. segregation of duties and responsibilities, risk and quality control and fraud detection) and the effectiveness of its audit and compliance functions;
Infrastructure to meet business needs - the MA reviews the
capability and reliability of the AI’s IT systems, the adequacy, competence and stability of management and staff resources, the appropriateness and adequacy of outsourcing arrangements as well as management oversight and controls over back-office or supporting functions located outside Hong Kong (if any); and
Other supporting systems - these normally include
accounting and management information systems, compilation of prudential returns and information, and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 systems and controls for prevention of money laundering and terrorist financing activities. The MA assesses the adequacy of these supporting systems. B3.3 The MA reviews an AI’s systems and controls based on the findings and results gathered from his offsite reviews or onsite examinations, and makes use of any information obtained from various sources such as banking returns, prudential interviews, tripartite meetings and routine supervisory contacts. The MA will also pay attention to the timeliness and effectiveness of corrective actions taken by the AI to address deficiencies identified, whether by supervisors or other independent reviewers (e.g. internal and external auditors). B3.4 The MA will have regard to the size, complexity and geographical diversity of an AI’s business operations in determining whether the systems and controls in place are adequate and commensurate with such operations. B4 Capital strength and capability to withstand risk (including CAAP) B4.1 Review of CAAP

The MA assesses the CAAP of AIs that are subject to the
CAAP standards set out by him against those standards. Among other things, the MA will:
assess the degree to which the AI’s CAAP and internal
capital targets have incorporated the full range of material risks faced by it;
review the adequacy of risk measures used in assessing
internal capital adequacy and the extent to which these risk measures are used operationally in setting limits, evaluating business line performance, and evaluating and controlling risks more generally;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

consider, in particular, whether the AI’s remuneration
and valuation practices have any adverse effects on its capital adequacy 39;
determine whether capital targets are comprehensive
and relevant to the current operating environment, and are properly monitored and reviewed by senior management;
determine whether the composition of capital is
appropriate for the nature and scale of the AI’s business; and
consider the extent to which the AI has provided for
unexpected events in setting its capital levels, whether the analysis covers a wide range of external factors, conditions and scenarios, and whether the stress-testing techniques and scenarios used are commensurate with the AI’s activities.
For AIs that are not subject to the CAAP standards, the MA
assesses their capital planning and management processes, taking into account their business size and complexity. B4.2 Review of capital strength and capability to withstand risk
An overall assessment of capital adequacy should take into
account all factors that affect an AI’s financial condition. Therefore, apart from those mentioned in subsection B4.1 above, the MA will consider the following factors:
Capital structure, level and trends
The MA compares the level and trend of an AI’s actual
CAR with the §97F minimum CAR assigned to the AI and with the average levels of CAR maintained by its peers to determine if its CAR has been kept at prudent levels. In addition, the projected asset growth and earnings

39 For example, remuneration policies that encourage excessive short-term profit-taking may pose longer-term risks to the AI, while the lack of robust valuation methodologies and procedures may understate the potential risks arising from illiquid positions.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 performance should reasonably support an AI’s ability to maintain its capital levels without undue reliance on capital injections. For a newly authorized AI, the level of its CAR should be reasonable in relation to its business plans and competitive environment.

The MA also reviews the quality of an AI’s capital by
analysing the composition of its capital base (e.g. the level of CET1 / Tier 1 capital in relation to total capital base). Strategic planning − The MA assesses whether an AI’s capital planning is supported by an effective strategic plan which should clearly outline the AI’s capital needs, anticipated capital expenditures, desirable capital level, and external capital sources. The Board and senior management should regard capital planning as a crucial element for achieving the desired strategic objectives, and should effectively communicate the AI’s corporate goals and objectives throughout the organisation. Business expansion − The MA assesses whether an AI has adequate capital resources to support its business growth. The MA will pay particular attention to situations where rapid lending growth may become a cause for concern if this is achieved by reducing the AI’s underwriting standards and increasing its risk profile. Dividends − Excessive cash dividend payments may weaken an AI’s capital adequacy. The MA reviews an AI’s dividend policy as well as its historical and planned cash dividend payout ratios to determine whether dividend payments are impairing capital adequacy.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Access to additional capital − AIs that do not generate sufficient capital internally may require external sources of capital. Large, independent AIs may solicit additional funding from the capital markets to support their business growth or acquisition plans. Smaller AIs may rely solely on their parent banks or major shareholders to provide additional funds, or on the issue of new capital instruments to existing or new investors. − The MA assesses an AI’s ability to obtain additional funding from the capital markets in times of need, taking into account the potential difficulties in raising additional capital during downturns or other times of stress, and the strength and availability of its parental support in the provision of new capital. If the AI has subsidiaries and affiliates, the MA will review its commitment and responsibility to provide capital to these subsidiaries and affiliates. − The MA also expects an AI to have a plan that enables it to operate effectively throughout a severe and prolonged period of financial market stress or an adverse credit cycle, as well as contingency plans that address unexpected capital or liquidity needs during crisis situations. Asset quality and provisions − The MA takes into account the potential impact of an AI’s asset quality, particularly the severity of its problem and classified assets and the adequacy of its bad debt provisions, on its capital adequacy. Earnings − The MA assesses an AI’s earning ability to ascertain the stability of its capital. Poor earnings or losses can adversely affect an AI’s capital adequacy by preventing the AI from replenishing its capital internally in the case

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 of poor earnings or by depleting its CET1 capital in the case of losses. Off-balance sheet items − Once funded, off-balance sheet items become subject to the same capital requirements as on-balance sheet items. The MA reviews an AI’s off-balance sheet activities (including securitization transactions) to assess whether its capital levels are sufficient to support the onbalance sheet assets that would result from a significant portion of the off-balance sheet items being funded within a short time, and to evaluate the possibility of the AI having to bring a portion of securitized assets (e.g. in respect of the AI’s sponsored securitization structures) onto its balance sheet and the likely impact of this on its capital and financial positions (see Annex E for more details). Market value of an AI’s stock − For a listed AI, its stock price is reflective of investors’ confidence in, and support for, the AI, the lack of which could impair the AI’s ability to raise additional capital. If an AI’s stock is trading at low prices, it may indicate investors’ lack of confidence in the AI, or that there are other problems besetting the AI. The MA reviews whether the stock of the AI or, where applicable, its listed parent bank or holding company has been trading at reasonable prices (e.g. in terms of a reasonable multiple of its earnings or a reasonable percentage (or multiple) of its book value) in order to identify whether there are any concerns that warrant his attention. Capital instruments with redemption features

The MA assesses the potential performance of an AI’s
capital instruments during times of stress and the ability of the instruments to absorb the AI’s losses and support its ongoing business operations.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

The MA will pay particular attention to the impact of
redemption (including early redemption) of capital instruments with redemption features on an AI’s overall capital structure. The AI should thoroughly assess such impact if the redemption could have a material effect on the level or composition of its capital base. If an AI plans to redeem a capital instrument with the proceeds of, or replace it by, a like amount of a similar capital instrument, the AI should consider the likelihood that it will actually be able to do so within the time planned.
In reviewing an AI’s funding and financial condition, the
MA also takes into account the potential impact of redemption of capital instruments that are not eligible for inclusion in the calculation of the AI’s §97F minimum CAR. Unrealised asset values
AIs may have assets on their books that are carried at
significant discounts below current market values. The excess of the market value over the book value (historical or acquisition cost) of assets such as investment securities or bank premises may represent capital to the AI.
The Banking (Capital) Rules allow certain amounts of
unrealized gains on asset values to be included in the calculation of the regulatory capital base. In some cases, such as for example unrealized gains on real property revaluation, the amount which can be included is subject to restriction, which effectively results in a certain amount of unrealized gain being “disallowed” from inclusion. In the SRP review of an AI’s overall capital adequacy, the MA however takes these asset values into account, considering in particular the nature of the assets, the reasonableness of their valuation, their marketability, and the likelihood of their sale. Whilst adopting this broader view, the MA is nevertheless concerned to identify cases where there appears to be undue reliance on unrealised gains to satisfy actual and projected capital requirements. Even though Basel III

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 allows unrealised gains on securities to be recognized in the regulatory capital base, the MA will expect AIs not to place undue reliance on unrealised gains in constituting their CET1 capital.

In assessing an AI’s capability to withstand risk, the MA
conducts sector-wide stress tests to assess individual AIs’ vulnerability to severe market shocks or crisis situations (e.g. based on hypothetical scenarios that are similar to, or more severe than, those experienced during the 1997/1998 Asian Crisis or the 2007/2008 Global Financial Crisis). The MA also considers whether “outlier” AIs that show significant vulnerability to “stressed” situations, compared with their peers, warrant a higher §97F minimum CAR and/or a reduction in risk exposures. B5 Corporate governance B5.1 A sound risk management process, strong internal controls and well documented policies and procedures are the foundation for ensuring the safety and soundness of an AI. As such, the Board and senior management of an AI are expected to have a reasonable understanding of the nature and level of risks being taken by the AI and how such risks relate to adequate capital levels. They should also be responsible for ensuring that the formality and sophistication of the firm-wide risk management and control processes are appropriate in the light of the AI’s risk profile and business plans. B5.2 The Board and senior management of an AI should promote continuous and robust dialogue and information sharing among members of senior management and across business lines and risk management and control functions so that sources of significant risk to the AI as a whole can be promptly identified, analysed and mitigated. B5.3 When assessing the quality of an AI’s corporate governance, the MA reviews the above aspects in addition to other relevant requirements detailed in various guidelines issued by the MA. In particular, the Board and senior management will be evaluated in terms of:

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

their risk management knowledge and experience;
their participation and involvement in development of the
AI’s risk management processes;
their awareness of, and responsiveness to, risk
management and control issues raised by the MA; and
their willingness and ability to promote and maintain prudent
remuneration policies and practices within the organisation. B6 Risk increasing factors B6.1 General
Risk increasing factors are specific factors that negatively
affect the risk profile of an AI and which may hence be indicative of a need for an increase in the AI’s minimum CAR. Such factors may relate to:
Material risks specific to the AI’s business and operations
or material risk concentrations identified within the AI’s business activities. For example, an AI may be exposed to business concentration risk by relying heavily on a particular business activity, or the risk posed by its nonbanking activities (such as securities dealing or insurance-related activities) is becoming increasingly high, as a result of rapid expansion in the absence of adequate expertise and management systems;
Significant “outliers” identified in the review of common
assessment factors. These may relate to extremely high levels of inherent risk, substantial management problems or control weaknesses, or significant vulnerability to adverse economic events which warrant a full assessment of the additional capital required to cover the risks involved; and
Specific issues arising from the application of the capital
adequacy framework. In particular, these issues relate to an AI’s ongoing compliance with various minimum

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 standards and requirements applicable to it for the purpose of calculating regulatory capital for credit, market or operational risk. The MA will consider such issues under the SRP if they are not adequately catered for under Pillar 1. Such issues may result in an AI being required to rectify deficiencies by improving its systems and controls or reducing its risk exposures, or to hold additional capital pending rectification of the deficiencies. See subsections B6.2 and B6.3 for a consideration of such issues in relation to credit risk (including counterparty credit risk) and market risk. Those relating to operational risk are mentioned under subsection B2.2.

The MA should determine the extent to which the minimum
CAR of an AI should be increased under §97F of the Banking Ordinance due to a risk increasing factor based on his assessment of the extent to which such a factor has the potential to increase the risk of the AI. B6.2 Specific issues in relation to credit risk Credit risk mitigation
An AI may be exposed to residual credit risk associated with
credit risk mitigation if the techniques used give rise to risks that could render the overall risk reduction less effective. Examples of these risks include:
inability to seize, or realise in a timely manner, collateral
pledged (on default of the obligor);
refusal or delay by a guarantor to pay;
ineffectiveness of untested documentation; and
high cost credit protection transactions where there is an
immediate regulatory capital benefit but a delayed recognition of losses or costs of protection in earnings by an AI. The relevant supervisory requirements and guidance relating to high cost credit protection transactions are set out in Annex G.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 There may also be specific wrong-way risk if there is a high correlation in the creditworthiness of a credit protection provider and the obligor due to their performance being dependent on common economic factors.

The MA will determine if there are instances suggesting the
lack of appropriate policies and procedures on the part of the AI to control these residual risks, and assess the need for taking appropriate action (e.g. increasing the AI’s Pillar 2 capital requirement). IRB approach
An AI’s adoption of the IRB approach may give rise to some
issues which will be subject to the MA’s review in determining the appropriate supervisory actions to be taken (including whether the AI’s minimum CAR should be increased pending rectification of deficiencies). Examples include:
deficiencies or flaws identified in the risk quantification or
back-testing methodologies or processes associated with IRB models;
deviations from the reference definition of default used
for risk estimation (e.g. use of external data or historical internal data not fully consistent with the reference definition of default prescribed by the MA);
weaknesses arising from the application of credit risk
stress tests under the IRB approach, such stress-testing being a requirement for using this approach. For example, the stress-testing processes or methodologies employed may not be appropriate to an AI’s circumstances or a capital shortfall (i.e. capital insufficient to cover the minimum capital requirements under the IRB approach according to the credit risk stress tests performed) is identified but not adequately addressed; and
inadequate systems and controls (applicable to AIs
adopting double default treatment) in monitoring the

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 deterioration in the credit quality of protection providers and in assessing the impact of protection providers falling outside the eligibility criteria (due to rating changes) on their capital requirements at the time of default. Basic approach

AIs using the basic approach are not subject to a higher
capital charge for their past due exposures. If such exposures have reached a significant level compared with an AI’s peers, the MA may consider whether a capital adjustment under the SRP is necessary to reflect the higher risk associated with the problem exposures. Standardized approach
AIs should have methodologies that enable them to assess
the credit risk involved in exposures to individual borrowers or counterparties as well as at the portfolio level. AIs should assess exposures, regardless of whether they are rated or unrated, and determine whether the risk weights applied to such exposures are appropriate for their inherent risk.
In those instances where an AI determines that the inherent
risk of a credit exposure, particularly if it is unrated, is significantly higher than that implied by the risk-weight to which it is assigned, the MA expects the AI to consider the higher degree of credit risk in the evaluation of its overall capital adequacy.
For more sophisticated AIs, the MA expects the credit
review assessment of capital adequacy conducted as part of their CAAP, at a minimum, to cover four areas: risk rating systems, portfolio analysis / aggregation, securitization / complex credit derivatives, and large exposures and risk concentrations. Securitization
The MA will be alert for any indication that may call into
question an AI’s compliance with the relevant requirements

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 on the recognition of risk transference for its securitization transactions. If the MA determines that the level of risk transfer for a particular transaction has been overstated and does not justify the capital relief granted, it may lead to an increase in capital requirements for the transaction concerned or, where necessary, an increase in the overall level of capital the AI is required to hold.

Similarly, if there is indication that an AI has provided implicit
support to transactions that it has securitized, the MA will consider the appropriateness of taking one or more supervisory actions (including an increase in the AI’s §97F minimum CAR) as specified in Part 7 of the Banking (Capital) Rules.
In the event that an AI is engaged in complex securitization
transactions the risks of which are not adequately accounted for under Pillar 1 (e.g. as a result of market innovations introducing new features to a securitization), the MA may consider imposing a specific capital treatment for such transactions or adjust the AI’s §97F minimum CAR to account for the additional risk incurred.
The MA will also review any other issues arising from an AI’s
compliance with the securitization requirements (e.g. in relation to call options and early amortization provisions) to determine the need for a capital adjustment or other supervisory actions.
Annex E provides further discussion on the various risks
associated with securitization and other off-balance sheet activities and the MA’s expectations of how such risks should be addressed by AIs in their CAAP and managed, as well as the MA’s approach to assessing such risks under the SRP. The MA will consider the need for additional capital or supervisory measures if there are major concerns in the way an AI addresses these risks.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Counterparty credit risk

The MA will focus substantially on an AI’s systems of control
to manage the AI’s counterparty credit risk in assessing its capital adequacy in relation to such risk under the SRP.
For an AI that uses the IMM(CCR) approach to calculate
counterparty credit risk, where it is apparent to the MA that the estimates from the calculation do not adequately reflect the AI’s exposure to such risk, the MA will determine the appropriate action to be taken, which may include directing the AI to (i) revise its estimates; (ii) apply higher estimates of exposure or exposure at default (“EAD”) under the IMM(CCR) approach; or (iii) not recognise internal estimates of EAD for regulatory capital purposes.
The MA will also assess AIs’ exposures to central
counterparties under the SRP. In particular, an AI should review, and the MA will assess, whether there is a need for the AI to hold additional capital against such exposures, including any unlimited funding commitments arising from an AI’s default fund contributions (which are not entirely prefunded) to a central counterparty.
Detailed supervisory requirements and guidance in relation
to counterparty credit risk are set out in Annex H. B6.3 Specific issues in relation to market risk IMM approach
A variety of issues may arise from an AI’s adoption of the
IMM approach for the calculation of market risk. These include:
deficiencies or flaws identified in the risk quantification or
back-testing methodologies or processes associated with market risk internal models;
deficiencies arising from valuation issues, such as
inappropriate valuation adjustments to less well

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 diversified portfolios or portfolios consisting of less liquid cash instruments;

weaknesses arising from the application of market risk
stress tests under the IMM approach, such stress-testing being a requirement for using this approach. For example, the stress-testing assumptions or methodologies may not be appropriate or commensurate with an AI’s trading activities or a capital shortfall (i.e. capital insufficient to cover the minimum capital requirements under the IMM approach according to the market risk stress tests performed) is identified but not adequately addressed; and
weaknesses arising from capturing specific risk under the
IMM approach. For example, model effectiveness is undermined by positions with limited price transparency or by illiquid positions, or the approach to capturing incremental risks 40 is inadequate.
The MA will determine the appropriate supervisory actions to
be taken in respect of these issues (including whether the AI’s §97F minimum CAR should be increased pending rectification of weaknesses). B7 Risk mitigating factors B7.1 Risk mitigating factors are specific factors that will have a positive impact on the risk profile of an AI and hence may reduce the need for, or amount of, any Pillar 2 capital requirement. They are used by the MA as incentives for AIs to improve their risk management so that the level of their inherent risks can be effectively mitigated. Risk mitigating factors may include:
AIs using less advanced approaches for calculating
regulatory credit or operational risk capital requirements, but possessing IRB/AMA capabilities for risk management purposes; and

40 These include default risk and credit migration risk that are incremental to the risks captured in the VaR-based capital charge calculations.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

risk mitigating effect of insurance cover recognisable under
AMA.
B7.2 The MA will conduct a stringent review to determine whether an AI has any risk mitigating factors that can be recognised for capital adequacy purposes, in consultation with the AI concerned. Each case will be considered based on its own merits. To facilitate his assessment, the MA may require the AI to submit any such information or documentary evidence as is deemed necessary to justify the risk mitigating effect of any particular factor under consideration. B7.3 The MA will determine the extent to which the minimum CAR of an AI can be reduced due to a recognised risk mitigating factor based on his assessment of the extent to which such factor can generally mitigate the risk of the AI in all circumstances.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Annex C: Scoring worksheets to facilitate assessment
under SRP

Concentration in lending activities
1a. Credit concentration in industry / economic sectors Return item O/S Balance As % of Benchmark Risk- RW Exposure Aggregate of Concentration criteria for 1a:
HK$m T.L. T.A. C.B. exceeded? weight HK$m RW exposure (a) Residential mortgages H5(a) & H5(b) from 1a Residential mortgages (b) Credit card advances H5(c) Credit card advances (c) Other loans to professional H5(d) & H5(e) PLUS Loans to professional & private individuals and private individuals Property development and investment (d) Property dev. and inv. B1(e) & B2(e) Aggregate of Taxi and PLB loans (e) Taxi and PLB loans G3 & G4 additional Share financing (f) Share financing H3(c) & H4(c) RW exposure Trade financing (g) Trade financing J from 1b Other economic sectors (individual) (h) Others (if concentrated) : - Return items : A1(c), 2, 3, 4, 5(c), 6, 7, 8, 9; B3; C; D; E3; F; G1, 2, 5; H1, 2(e), 6; and K 1b. Business concentration arising from lending activities T.L. as % of total assets RW Additional Concentration criteria for 1b with reference to:
Return item Exposure As % Multiplier RW Exposure HK$m of T.L. HK$m (a) Total loans (T.L.) as percentage of total (a) Residential mortgages H5(a) & H5(b) assets; (b) Credit card advances H5(c) (b) Exposures in each sector as percentage (c) Other loans to professional H5(d) & H5(e) of T.L.; and and private individuals (c) Sum of exposures in two or more sectors (d) Property dev. and inv. B1(e) & B2(e) exceeding certain percentage of T.L. (e) Taxi and PLB loans G3 & G4 (f) Share financing H3(c) & H4(c) (g) Trade financing J (h) Others (if concentrated) :
HK$m
Criteria met?
Sectoral exposures
O/S Balance

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 CREDIT CONCENTRATION RISK (A1) Position as at HK$m % of Score Maximum Exposures / claims considered concentrated Benchmarks (% of) DD/MM/YYYY C.B. obtained score / large if any of the benchmarks is exceeded T.L. T.A. C.B.
2. Concentration in negotiable debt instruments held
2a. Credit concentration in negotiable debt instruments (NDIs) held O/S Balance As % of Benchmark Risk- RW Exposure Aggregate of Concentration criteria for 2a:
HK$m T.L. T.A. C.B. exceeded? weight HK$m RW exposure (a) Negotiable certificate of deposits (NCDs) N.A. from 2a NCDs N.A. (b) NDIs other than NCDs (Other NDIs) N.A. Other NDIs N.A. Total PLUS Additional 2b. Business concentration arising from trading or investment in NDIs RW exposure Total NDIs as % of total loans from 2b Concentration criteria for 2b:
Total RW Additional Total NDIs held N.A. N.A.
Exposure Multiplier RW Exposure
HK$m HK$m
Total NDIs held
3. Geographical concentration
(a) Large cross-border claims on countries with sovereign rating equal Aggregate Claims on individual countries N/A N/A to or above A- (S&P) / A3 (Moody's) / A- (Fitch) Largest (b) Large cross-border claims on countries with sovereign rating below Aggregate Claims on individual countries N/A N/A A- (S&P) / A3 (Moody's) / A- (Fitch) / without ratings Largest
4. Concentration of exposure to non-bank Chinese entities Aggregate Total exposure N/A N/A
5. Concentration of exposure to counterparties
(a) Non-exempt large exposures No. of large exposures Aggregate Non-exempt exposures under S.81 of BO N/A N/A Largest (b) Large bank exposures No. of large exposures Aggregate Bank exposures N/A N/A Largest (c) Aggregate of large exposures to non-bank connected parties Aggregate Exposures to non-bank connected parties N/A N/A
6. Other concentrations
Score obtained
No. of countries
Portfolio mix
NCDs Other NDIs
% %

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 INTEREST RATE RISK IN THE BANKING BOOK (A2) Score Maximum obtained score

Repricing risk
Scenario : 200 basis point parallel interest rate movement for all currencies (a) Impact on AI's earnings (absolute sum of all currencies) Position End-Q1 End-Q2 End-Q3 End-Q4 Average Score Impact amount HK$'m Impact obtained Impact on earnings

As % of average annual operating results before provision for the past 3 years (i) - Average score of
As % of capital base at reporting date (ii) (i) and (ii)
(b) Impact on AI's economic value (absolute sum of all currencies) Position End-Q1 End-Q2 End-Q3 End-Q4 Average Score Impact amount HK$'m Impact obtained
As % of capital base at reporting date Impact on econ. value

Basis risk
(a) Scenario : All rates except fixed and managed rates on interest-bearing assets rise by 200 basis points and last for 12 months. Position End-Q1 End-Q2 End-Q3 End-Q4 Average Score Impact amount on AI's earnings (absolute sum of all currencies) HK$'m Impact obtained

As % of average annual operating results before provision for the past 3 years
As % of capital base at reporting date
Average score obtained (iii)
(b) Scenario : Managed rates on interest-bearing assets drop by 200 basis points and last for 12 months while other rates remain unchanged. Position End-Q1 End-Q2 End-Q3 End-Q4 Average Score Impact amount on AI's earnings (absolute sum of all currencies) HK$'m Impact obtained
As % of average annual operating results before provision for the past 3 years
As % of capital base at reporting date Impact on earnings
Higher score between
Average score obtained (iv) (iii) and (iv)

Options risk
Condition (a) : RML > 20% of total loans Condition (b) : Weighted average yield of RML > Yield of 1-year Exchange Fund Bills RML amount HK$'m Weighted average yield of RML Total loans HK$'m Yield of 1-yr Exchange Fund Bills % of RML Yield differential If both (a) and (b) are met, assume 30% of RMLs are repaid before maturity date Position DD/MM/YYY Impact amount on AI's earnings (i.e. RML amount x 30% x Yield differential) HK$'m Score obtained Impact on earnings

As % of average annual operating results before provision for the past 3 years (v) - Average score of
As % of capital base at reporting date (vi) (v) and (vi)

Yield curve risk (Please assess the impact of yield curve risk, if material, on the AI's earnings. Details of assessment should be shown below or separately.)
Impact on earnings
Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Assessment results

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 LIQUIDITY RISK (A3) P.1 of 3 Score obtained Maximum score

Statutory liquidity ratio ("liquidity ratio") and its volatility
Position 1st month 2nd month 3rd month 4th month 5th month 6th month Average in the past Liquidity ratio 12 months (liquidity ratio) Lowest liquidity ratio Position 7th month 8th month 9th month 10th month 11th month 12th month Volatility in the past Liquidity ratio 12 months Lowest liquidity ratio Notes:
(a) For large AIs with total assets after provision > HK$100 billion, no score will be assigned to them under liquidity ratio if the average of their monthly liquidity ratios in the past 12 months is greater than 50%. (b) For AIs with high liquidity (i.e. their lowest liquidity ratio in the past 12 months > 100%), no score will be assigned to them under liquidity volatility. Position DD/MM/YYYY Total Assets After Provision (HK$'m) Lowest liquidity ratio in past 12 months
Trend of the liquidity ratio
Observation period MM/YY - MM/YY * t-value calculated * No t-test is required Monthly decline Monthly decline t-critical value in case of increase
Adjusted loan-to-deposit ratio for HK Office (Applicable to banks except those exempted by HKMA)
Position DD/MM/YYYY Adjusted L/D ratio Adjusted loan-to-deposit ratio in all currencies
Stress test on cash flow position (Applicable to banks except those exempted by HKMA)
Stressed position DD/MM/YYYY Number of days AI can Scenario with highest withstand deposit withdrawals Score obtained score obtained :
Scenario : Daily deposit run-off at (higher % *) Case (a) : Without LOLR support No. of days AI can Case (b) : With LOLR support withstand deposit withdrawals Scenario : Daily deposit run-off at (lower % *) Case (c) : Without LOLR support Case (d) : With LOLR support

To be determined by HKMA
Sub-total c/f
Assessment results

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 LIQUIDITY RISK (A3) P.2 of 3 Score obtained Maximum score Sub-total b/f
5. Maturity mismatches (Applicable to exempt banks under items 3 and 4, RLBs and DTCs)
Position DD/MM/YYYY From AI's internal MIS report (HK$'m) < 1 month 1 - 3 months > 3 months Net position (including on- and off-balance sheet items) Negative cumulative Cumulative position position with highest score If cumulative position is -ve, check which of the following cases is applicable Score obtained (maximum to be given if no information available for assessment) Cases :
(a) negative position fully covered by the amount due to parent bank (b) negative position fully covered by : (i) the amount due to other group companies / connected parties; or (ii) the combined funding sources from (a) & (b)(i) (c) negative position fully covered by : (i) irrevocable funding sources; or (ii) the combined funding sources from (a), (b)(i) & (c)(i) (d) negative position not covered or fully covered by the above funding sources
6. Concentration of funding sources As % of
total
Position DD/MM/YYYY HK$'m As % of total liabilities liab. Total amount of 10 largest customer deposits Largest customer deposit Total amount of 10 largest bank borrowings Largest bank borrowing
7. Qualitative assessment
Rating 1 2 3 4 5 Overall rating
Highly capable Capable Slightly difficult Difficult and at high cost Very difficult and at very high cost Very strong Strong Marginal Difficult Impossible Highly capable Capable Slightly difficult Difficult and at high cost Very difficult and at very high cost Very low Low Marginally acceptable High Very high Stability of customer deposits Highly stable Stable Some degree of volatility Unstable Highly unstable Assessment results Factors for assessment Access to capital, money markets or other sources of cash (including perception of market analysts on AI's name and financial standing) Strength of parental support Borrowing capability Cost of funds

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 LIQUIDITY RISK (A3) P.3 of 3 Score obtained Maximum score
7. Qualitative assessment (continued)
Rating 1 2 3 4 5
Very low correlation Low correlation Acceptable correlation High correlation Very high correlation None or very minimal Minimal Some Heavy Very heavy None or very minimal Minimal Some Heavy Very heavy Very low Low Moderate High Very high More than enough Adequate Marginally adequate Slightly inadequate Large shortage or test results not reliable / unreasonable Very high High Marginally acceptable Low Very low None or not identified A few but insignificant Some but insignificant Some and significant Many and significant Score obtained Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Reliance on specific types of providers / products (e.g deposits solicited at high rates and internet deposits) / activities (e.g. secured funding / securitization) to generate funds Warning signals for a potential liquidity problem Assessment results Quality of stock of liquid assets maintained Overall rating Factors for assessment Whether major fund providers are linked by common investment objectives or economic influences (e.g. deposits from large corporates or private banking clients more sensitive to credit risk and interest rates) Reliance on specific markets to obtain liquidity (e.g. interbank and wholesale markets) Potential for providing liquidity support for contingent liquidity obligations (whether contractual or non-contractual) (e.g. exposures to SIVs / conduits etc.) Adequacy of stock of liquid assets to withstand stress events (including prolonged market stress) as indicated by AI's internal stresstesting results or other relevant sources

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 REPUTATION RISK (A5) P.1 of 2 Rating Low (L) Moderate (M) High (H) Comments Annex

Market / public perception Strong Acceptable Weak
(a)
(b)
(c)
(d)
New business development Strong Acceptable Weak
(a)
(b)
(c)
(d)
(e)
Nature and volume of customer complaints Insignificant Moderate Serious
(a)
(b)
(c)
(d)
Litigation Insignificant Moderate Serious
(a)
(b)
Are there any customer complaints that are indicative of serious supervisory concern? Are there any customer complaints that have resulted (or likely to result) in substantial compensation or an adverse impact on the AI's reputation? Is the AI's management willing and able to respond to customer complaints? Factors for assessment Is there a general perception that the financial position Is the AI's management willing and able to adjust business strategies based on market perception? Does the AI have a well developed plan for introducing or acquiring new business activities? of the AI's major shareholders is adequate or strong? Is there a general perception that the management and financial position of the AI is adequate or strong? Is there a general perception that the complexity and riskiness of the AI's business activities are commensurate with its size and operations and risk management capacity? Does the AI have a successful track record in:

launching new business lines, products or services; or
Is there any highly visible or conspicuous litigation? Are there any litigation cases that have resulted (or are likely to result) in substantial financial losses or an adverse impact on the Does the AI have a successful track record in formulat AI's reputation? ing business strategies and making commercial decisions that bolster its financial position, business conduct and reputation (including the fairness and integrity of its business dealings)?
acquiring new subsidiaries / businesses (e.g. a mortgage or
credit card portfolio)?
Is the volume of customer complaints acceptable based on the Is the AI's management willing and able to adjust business strategies based on regulatory changes or legal barriers AI's size and complexity of business? ? Is the AI's management willing and able to analyse risk in new products and services, develop relevant policies and conduct due diligence? The factors listed below should be used when assessing the overall level of reputation risk. The suggested questions are not necessarily all-inclusive, but should serve as a guide to be used in determining the risk rating for each factor.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 REPUTATION RISK (A5) P. 2 of 2 Rating Low (L) Moderate (M) High (H) Comments Annex
5. Negative publicity No Insignificant Serious
(a)
(b)
6. Compliance with laws and regulations Strong Acceptable Weak
(a)
(b)
(c)
(d)
7. Fiduciary or other liability insurance Highly adequate Adequate Inadequate
8.
None or not Moderate Serious
Please itemise the signals below : identified significance significance Overall rating Maximum score Maximum score Maximum score Score obtained Overall comment on reputation risk :
Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Other warning signals of high potential reputation risk (e.g. does the AI have a high level of exposures to off-balance sheet vehicles (SIVs/conduits etc.) that may put pressure on it to provide implicit support in times of stress for reputation considerations?) Are there any cases of non-compliance that are indicative of serious supervisory concern? Have significant findings about the AI's regulatory compliance, conduct and business practices been uncovered in internal and regulatory reviews? Is the AI's management willing and able to respond to these findings? Factors for assessment Is there appropriate fiduciary or other liability insurance to cover the AI's potential exposure? Are there frequent cases of non-compliance with laws and regulations (particularly in the conduct of asset management, investment advisory and securities dealing activities as well as the compliance with regulatory requirements to combat money Has the AI experienced any scandal or negative publ laundering and terrorist financing)? icity that has resulted in substantial financial losses or an adverse impact on its reputation? Has the AI's management properly handled such events and taken adequate remedial actions to minimise the damage to reputation caused?

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 STRATEGIC RISK (A6) Rating Low (L) Moderate (M) High (H) Comments Annex

Compatibility / suitability of strategic goals & objectives Strong Acceptable Weak
(a)
(b)
(c)
Responsiveness to changes in business environment High Medium Low
Adequacy of resources to carry out business strategies Highly adequate Adequate Inadequate
(a)
(b)
Implementation of business strategies Strong Acceptable Weak
(a)
(b)
Impact of strategic decisions Low Moderate High
(a)
(b)
(c)
Other warning signals of high potential strategic risk None or not Moderate Serious
Please itemise the signals below : identified significance significance Overall rating Maximum score Maximum score Maximum score Score obtained Overall comment on strategic risk :
Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Have there been any strategic decisions, or external pressures arising from such strategic decisions, that resulted in a significant adverse impact on the AI's financial position? Have there been any strategic decisions that could not be reversed without significant cost or difficulty? Is the AI's business fairly diversified (e.g. by product, geography or customer demographics) that will help reduce the overall Does the AI have adequate resources to carry out bu impact of adverse market conditions? siness strategies in terms of such factors as management resources and capabilities, capital and funding, staffing and operating systems, communication channels and delivery networks? Are the AI's business strategies and decisions indicative of its responsiveness to changes in the external environment (such as industry, economic, technological, competitive, regulatory, and other environmental changes)? Are the AI's strategic goals and decisions compatible with its corporate mission, goals, culture, values, business direction and risk tolerance? Are the AI's financial objectives consistent and commensurate with its short and long term goals? Are the AI's strategic decisions generally prudent or overly aggressive relative to its size and complexity? The factors listed below should be used when assessing the overall level of strategic risk. The suggested questions are not necessarily all-inclusive, but should serve as a guide to be used in determining the risk rating for each factor. Have the AI's major business units and operations, including overseas branches, banking subsidiaries and associates, achieved satisfactory performance in line with their business

offering new products and services;
shifting of business focuses (including re-focuse
targets? s);
conducting strategic investments / forming joint ventures; and
Factors for assessment
Does the AI have the potential or capability to ent
implementing merger and acquisition plans?
er to new markets, businesses or products?
Does the AI have a successful track record in :

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 INTERNAL CONTROL SYSTEM AND ENVIRONMENT (B2) Total Firm-wide rating rating* Credit Market Interest rate Liquidity Operational Legal Reputation Strategic 1. 2. 3. (a) (b) (c) (d) (e) 4. S : Strong A : Acceptable W : Weak

A firm-wide rating reflects an AI's ability to integrate and manage all material risks from a firm-wide perspective.
Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Individual rating
Annex
Rating
Fraud detection
Result / progress of implementation of the recommendations from regulators, internal and external auditors on internal controls Overall rating Score obtained Quality and effectiveness of the Board and senior management oversight Maximum score Appropriateness of organisation structure and adequacy of control environment Factors for assessment External audit Internal audit Centralised compliance Centralised risk & quality control Adequacy and effectiveness of individual components within the internal control system Comments

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 INFRASTRUCTURE TO MEET BUSINESS NEEDS (B3) Total Firm-wide rating rating* Credit Market Interest rate Liquidity Operational Legal Reputation Strategic 1. 2. 3. 4. 5. 6. S : Strong A : Acceptable W : Weak

A firm-wide rating reflects an AI's ability to integrate and manage all material risks from a firm-wide perspective.
Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review.
Annex
Rating
Result / progress of implementation of the recommendations from regulators, internal and external auditors on infrastructure Overall rating IT capability, reliability and stability Comments Individual rating Score obtained Appropriateness and adequacy of outsourcing arrangements Maximum score Factors for assessment Staff competence, sufficiency and stability Maintenance of sufficient office space to ensure adequacy of internal controls and efficient operations Adequacy and effectiveness of management oversight and controls over "back office operations / support functions" outside Hong Kong

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 CAPITAL ADEQUACY ASSESSMENT PROCESS ("CAAP") (C1)
Part I - Applicable to AIs which are required to comply with the CAAP standards
Rating Strong (S) Acceptable (A) Weak (W) Comments Annex 1. (a) Highly competent Acceptable to competent Marginally acceptable or weak (b) Proportional Marginally proportional Not in proportion (less than required) (c) Satisfactory Acceptable Less than satisfactory (d) Adequate Acceptable Inadequate (e) High Moderate Low 2. (a) Satisfactory Acceptable Less than satisfactory (b) Capable Marginally capable Incapable (c) Clear and reasonable Acceptable Unclear or with doubt (d) All the time Most of the time Sometimes 3. (a) Not necessary Minor with minimal concerns Significant with serious concerns (b) Not applicable Satisfactory Less than satisfactory Overall rating Maximum score Maximum score Maximum score Score obtained Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Identifying and measuring all material risks Adequacy and effectiveness of the overall CAAP Competence of the board and senior management in discharging their responsibilities in CAAP Proportionality of the CAAP to the risk profile and level of sophistication of the AI's operations Usefulness and effectiveness of the CAAP in the AI's risk management and decision-making processes New supervisory actions required Results of rectification of previous supervisory actions Factors for assessment Capability of relating capital to the level of risk Stating explicit capital adequacy goals / targets with respect to risk Conformity to the AI's stated capital adequacy goals / targets / objectives Supervisory actions required / taken Adequacy of controls over the integrity and functionality of the CAAP Ability of the CAAP to ensure the AI's compliance with the regulatory capital requirements Adequacy and effectiveness of individual elements in the CAAP (including stress-testing on capital adequacy)

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 CAPITAL ADEQUACY ASSESSMENT PROCESS ("CAAP") (C1)
Part II - Applicable to AIs which are not required to comply with the CAAP standards (assessment based on individual AIs' business size and complexity)
Rating Strong (S) Acceptable (A) Weak (W) Comments Annex 1. (a) Accurate and complete No significant weaknesses Unsatisfactory (b) Accurate and complete No significant weaknesses Unsatisfactory (c) Very good Generally satisfactory Poor (d) Adequate and effective No significant weaknesses Unsatisfactory 2. (a) Formal and with adequate policy and procedures Informal although generally satisfactory Unsatisfactory / not commensurate with AI's operations (b) Adequate consideration Acceptable Inadequate / no consideration (c) Clear, appropriate and well documented Informally defined although acceptable Unclear (d) Adequate and well documented Informal although acceptable Insufficient / no consideration 3. (a) Not necessary Minor with minimal concerns Significant with serious concerns (b) Not applicable Satisfactory Less than satisfactory Overall rating Maximum score Maximum score Maximum score Score obtained Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Factors for assessment Adequacy and effectiveness of controls over compliance with capital requirements Accuracy and completeness in categorising and reporting all components of capital base Accuracy and completeness in risk-weighting and reporting all on- and off-balance sheet items Documentation of categorisation and reporting procedures for regulatory capital measurement purposes Adequacy and effectiveness of internal monitoring systems in ensuring that actual CAR does not fall below regulatory minimum and trigger ratio Capital planning and management processes Consideration of all material risks and capital needs in capital planning and management Responsibilities in capital planning and management Contingent capital planning Supervisory actions required / taken New supervisory actions required Results of rectification of previous supervisory actions Adequacy and effectiveness of capital planning and management

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Annex D: Supervisory requirements on application of stress
tests under CAAP
D1 General requirements
D1.1 AIs should conduct rigorous, forward-looking stress tests that can alert them to adverse unexpected outcomes related to a broad variety of risks and provide them with an indication of how much capital might be needed to absorb losses should severe stress events occur. D1.2 AIs should regularly conduct stress tests (especially firm-wide stress tests) that are appropriate for their size and nature of operations to assess their vulnerabilities to possible adverse events or changes in market conditions and the need for them to hold additional capital should such events or changes occur. Recognising that market conditions can change rapidly, AIs are normally expected to conduct stress tests on a quarterly basis. Depending on the nature of the major sources of risk identified and their possible impact on AIs’ financial conditions, some stress tests (e.g. those relating to trading activities) may need to be carried out more frequently (say, daily or weekly). D1.3 Stress-testing should form an integral part of an AI’s overall governance and risk management culture. The Board and senior management should have active involvement in setting stress-testing objectives, defining scenarios, discussing the results of stress tests, assessing potential actions and making decisions in response to concerns identified. Senior management should take an active interest in the development and operation of stress-testing. The Board and senior management should also be informed of, and should fully understand, the limitations of an AI’s stress tests. Any stresstesting results should be reported to the Board and senior management in a timely and appropriate manner (so as to facilitate comprehension and understanding) and communicated within an AI appropriately so that the results can contribute to strategic decision-making, foster internal debate regarding assumptions (such as the cost, risk and speed with which new capital could be raised or positions could be hedged

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 or sold), and facilitate the development of risk mitigation or contingency plans across a range of stressed conditions. D1.4 Stress tests should be used to identify existing, or potential, firm-wide risk concentrations. They should also be used to provide an independent risk perspective and complement other risk management tools, such as those that are based on complex, quantitative models using historical data and estimated statistical relationships. In particular, stress-testing outcomes for a particular portfolio should provide insights about the validity of statistical models (e.g. VaR models) at high confidence intervals. D1.5 AIs should feed stress-testing results into their capital and liquidity planning processes, and take these results into account when evaluating the adequacy of their capital and funding sources and examining future capital resources and liquidity requirements under adverse scenarios in order to ensure that they have the ability to raise funds at reasonable cost, when necessary. D1.6 AIs’ regulatory capital requirements may vary as economic conditions fluctuate over time. Such requirements will also depend on where in the economic cycle AIs find themselves at any given time. Deterioration in business or economic conditions, in particular, may result in the need for an AI to raise capital or, alternatively, to contract its business activities, at a time when market conditions are most unfavourable to raising capital. To reduce the impact of cyclical effects, an AI should aim at maintaining an adequate capital buffer during the upturn in an economic cycle such that it has sufficient capital available to protect itself from a severe market downturn. D1.7 To assess their expected capital requirements over an economic cycle, AIs may wish to project their financial position, taking account of their business strategy and expected growth, according to a range of assumptions as to the state of the economic or business environment which they may face. For example, the CAAP of an AI may include an analysis of the impact that the actions of the AI’s competitors could have on its performance, in order to see what changes in its environment the AI could sustain. Projections over a one to three year

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 period would likely be appropriate in most circumstances. The AI may then calculate its projected capital requirements and assess whether they could be met from expected financial resources. D1.8 AIs should have regard to the general standards set out in IC-5 “Stress-testing” for more guidance on the use of stress-testing techniques. D2 Specific requirements D2.1 The purpose of stress tests is to identify potential risks under stressed conditions and analyse the adequacy of an AI’s capital in response to such conditions. The nature, depth and detail of the analysis will depend, in part, upon the AI’s risk profile and its vulnerabilities to adverse changes in the external environment as well as the robustness of its risk prevention, detection and mitigating measures. D2.2 In carrying out stress tests, AIs should take reasonable steps to identify an appropriate range of risks and the circumstances and events in which those risks would crystallise. Such circumstances and events should reflect severe, but plausible, scenarios. Possible correlations among risk types should be identified together with the interaction between different risk factors and the potential feedback effects. D2.3 Particular attention should be paid to developing stress scenarios to address, where applicable, the following types of risk:

an AI which is engaged in originating securitization
transactions should manage warehouse and pipeline risk by including exposures held for prospective securitization purposes in its regular stress tests, regardless of the probability of such exposures being securitized. This is because many of the risks associated with these exposures are likely to emerge when the AI is unable to access the securitization market due to either AI-specific or more general market stress;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

an AI should carefully assess the risks with respect to
commitments to off-balance sheet vehicles and third-party institutions related to structured credit securities and the possibility that assets will need to be taken onto the balance sheet for reputation reasons. Therefore, in its stress-testing programme, the AI should include scenarios assessing the size and soundness of such vehicles and institutions relative to its own financial, liquidity and regulatory capital positions. This analysis should cater for structural, solvency, liquidity and other risk issues, including the effects of covenants and triggers; and
an AI should also assess the effect of reputation risk in
terms of other risk types, namely credit, liquidity, market and other risks, to which the AI may be exposed. This could be done by including reputation risk scenarios in regular stress tests. For example, the provision of noncontractual support (capital and/or liquidity) by an AI to the off-balance sheet vehicles sponsored by the AI due to reputation concerns may be included in the stress tests to determine the impact of such support on its credit, market and liquidity risk profiles. D2.4 In applying stress tests, AIs are expected to determine an appropriate time horizon to be covered by the tests. This will depend upon:
how quickly an AI would be able to identify events or
changes in circumstances that might lead to a risk crystallising resulting in a loss; and
after the AI has identified such event or circumstance, how
quickly and effectively it could act to prevent or mitigate any loss resulting from the risk crystallising and to reduce exposure to any further adverse event or change in circumstances. D2.5 The time horizon over which stress tests would need to be carried out for market risk arising from the holding of investments, for example, would depend upon:

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

the extent to which there is a regular, open and
transparent market for those assets, which would allow fluctuations in the value of the investment to be more readily and quickly identified; and
the extent to which the market for those assets is liquid
(and would remain liquid in the changed circumstances contemplated in the stress tests), which would allow AIs, if needed, to sell their holdings so as to prevent or reduce the exposure to future price fluctuations. D2.6 In identifying stress scenarios, and assessing their impact, AIs should take into account, where material, how changes in circumstances might impact upon:
the nature, scale and mix of their future activities; and
the behaviour of counterparties, and of the AIs themselves,
including the exercise of choices (e.g. options embedded in financial instruments or contracts of insurance). D2.7 In determining whether there would be adequate capital in the event of each identified stress scenario, AIs should:
only include capital that could reasonably be relied upon
as being available in the circumstances of the identified scenario; and
take account of any legal or other restriction on the use of
capital.
D2.8 AIs should conduct stress tests which enable them to assess their exposures not only in their current position in the economic cycle, but also with respect to possible changes in the cycle which might be expected over the next few years. D2.9 AIs may consider scenarios in which expected future profits will provide capital reserves against future risks. However, it would be appropriate to take into account only those profits that can be foreseen with a reasonable degree of certainty as arising before the risk against which they are being held could possibly

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 arise. In estimating future reserves, AIs should deduct future dividend payment estimates from projections of future profits. D2.10 AIs may substitute more sophisticated modelling techniques for traditional stress tests. This approach is acceptable providing that major risks are identified and the modelling is capable of estimating the impact on their financial position where the risks crystallise, or are assumed to crystallise, with a particular probability.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Annex E: Assessment of securitization risk and off-balance
sheet exposures under CAAP / SRP E1 Introduction E1.1 Securitization has increasingly been used by banks as an alternative source of funding and as a mechanism to transfer risk to investors. While the risks associated with securitization are not new to banks, the 2007/2008 Global Financial Crisis highlighted some aspects of credit risk, concentration risk, market risk, liquidity risk, legal risk and reputation risk, which certain banks had previously failed to adequately address. For instance, a number of banks that were not contractually obligated to support sponsored securitization structures were unwilling to allow these structures to fail due to concerns about reputation risk and future access to capital markets. Their support of these structures exposed the banks to additional and unexpected credit, market and liquidity risks as they brought assets onto their balance sheets, imposing significant pressure on their financial position and capital ratios. E1.2 In the light of the wide range of risks arising from securitization activities, which can be compounded by rapid innovation in securitization techniques and instruments, the regulatory capital requirements under Pillar 1 may not be sufficient to cover all risks arising from such activities. These risks usually include:

credit, market, liquidity and reputation risks in respect of
each securitization exposure;
potential delinquencies and losses associated with the
underlying exposures of securitization transactions;
exposures from credit enhancement or liquidity facilities
provided to special purpose entities; and
exposures from guarantees provided by monoline insurers
and other third parties.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 E1.3 This annex sets out the MA’s expectation on how AIs should manage specific risks arising from any securitisation exposures they incur and assess such risks in their CAAP. The MA’s approach to reviewing AIs’ securitization transactions and addressing issues associated with such transactions under the SRP are also explained. E2 Supervisory requirements General E2.1 To help ensure that the Board and senior management understand the implications of securitization exposures for liquidity, earnings, risk concentration and capital, AIs should cover all relevant exposures and potential exposures (both contractual and non-contractual) in their risk management processes and MIS and address such exposures in their CAAP. E2.2 AIs adopting an “originate-to-distribute” business model, or using securitization to enhance credit intermediation and profitability, are expected to have risk management processes that meet the supervisory requirements under this section. Other AIs are also expected to meet the supervisory requirements, where applicable. E2.3 The MA will take into account the compliance of an AI with the relevant supervisory requirements set out in this annex when assessing the AI’s risk management processes and CAAP under the SRP. Approach to supervisory review E2.4 The MA will monitor, as appropriate, whether AIs have taken adequate account of the economic substance of securitization transactions in their determination of capital adequacy under the CAAP. In cases where the regulatory capital requirements under Pillar 1 would not sufficiently reflect the risks to which an AI is exposed in respect of its securitization exposures, the MA may consider the need to increase the AI’s capital requirements under the SRP.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 E2.5 Among other things, the MA may review where relevant:
an AI’s own assessment of its capital needs and how that has been reflected in the capital calculation as well as the documentation of securitization transactions to determine whether the capital requirements accord with its risk profile (e.g. substitution clauses); the manner in which an AI has addressed the issue of maturity mismatch in relation to retained securitization positions in its economic capital calculations as well as any structuring of maturity mismatches in transactions to artificially reduce capital requirements; and an AI’s economic capital assessment of actual correlation between underlying exposures in the pool and how that has been reflected in the capital calculation. Where the MA considers that an AI’s approach is not adequate, he will determine what appropriate action should be taken, which may include denying capital relief in the case of originated assets or increasing the AI’s capital requirements against securitization exposures acquired by the AI. Risk evaluation and management E2.6 During the 2007/2008 Global Financial Crisis, weaknesses in certain banks’ risk management of securitization and offbalance sheet exposures resulted in large unexpected losses. To help mitigate these risks, an AI’s on- and off-balance sheet securitization activities should be included in its risk management disciplines, such as product approval, risk concentration limits, and assessments of risks associated with such activities, including credit, market, operational, reputation and liquidity risks. E2.7 AIs should conduct their own analyses of the underlying risks when investing in structured products and should not solely rely on the external credit ratings assigned to such products, including securitization exposures, by the credit rating agencies. AIs should be mindful that, whilst external ratings are a useful starting point for credit analysis, they are no

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 substitute for a full and proper understanding of the underlying risks, especially where the ratings for certain asset classes have a short history or have been shown to be volatile. AIs should also be alert to, and cautious of, situations where deterioration in the quality of an investment product may not be promptly and properly reflected in the rating. As such, AIs should conduct credit analysis of a securitization exposure at the time of acquisition and on an ongoing basis, and have in place the necessary quantitative tools, valuation models and stress tests of sufficient sophistication to reliably assess all relevant risks. E2.8 To facilitate their assessment of securitization transactions, AIs should have the necessary procedures in place to capture in a timely manner updated information on such transactions, including market data, if available, and updated performance data from the securitization trustee or servicer. In addition, AIs should ensure that they fully understand the credit quality and risk characteristics of the underlying exposures in securitization and structured credit transactions generally, including any risk concentrations. They should also review the maturity of the exposures underlying securitization and structured credit transactions relative to the issued liabilities in order to assess potential maturity mismatches. E2.9 AIs should track credit risk in securitization exposures at the transaction level, within each business line and across business lines, and produce reliable measures of aggregate risk. They should also track all meaningful concentrations in securitization exposures, such as name, product or sector concentrations, and feed this information into firm-wide risk aggregation systems that track, for example, credit exposure to a particular obligor. E2.10 AIs’ own risk assessments need to be based on a comprehensive understanding of the structure of securitization transactions. In performing such assessments, AIs should identify the various types of triggers, credit events and other legal provisions that may affect the performance of their onand off-balance sheet exposures and integrate these triggers, credit events and provisions into their credit, liquidity and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 balance sheet management. The impact of the events or triggers on their liquidity and capital positions should also be considered. E2.11 As market-wide disruptions may pose difficulty to the securitization of warehoused or pipeline exposures, AIs should, as part of their risk management processes, consider and, where appropriate, mark-to-market warehoused positions as well as those in the pipeline. They should also consider scenarios which may prevent them from securitizing their assets as part of their stress-testing, and identify the potential effect of such exposures on their liquidity, earnings and capital adequacy. E2.12 AIs should develop prudent contingency plans specifying how they would respond to funding, capital and other pressures that may arise when access to securitization markets is reduced. Contingency plans should also address how AIs would address valuation challenges for potentially illiquid positions held for sale or for trading purposes. The risk measures, stress-testing results and contingency plans should be incorporated into AIs’ risk management processes and CAAP, and should result in an appropriate level of capital in excess of the minimum capital requirements under Pillar 1. E2.13 AIs that employ risk mitigating techniques to reduce their risks arising from off-balance sheet and securitization activities should fully understand the risks to be mitigated, the potential effects of risk mitigation, whether the mitigation is fully effective and the risks which may arise from the risk mitigation itself. This is to help ensure that they do not understate the true level of risk in their capital assessment (see Annex G for guidance on high cost credit protection transactions which may be relevant to securitization exposures). In particular, AIs should consider whether they would realistically be compelled to provide support to the securitization structures in stressed scenarios due to their reliance on securitization as a funding tool or for other reputational or strategic reasons.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 Reputational risk and implicit support 41 E2.14 Prior to the 2007/2008 Global Financial Crisis, many banks failed to recognise the reputation risk associated with their offbalance sheet vehicles. In order to preserve their reputation, some of them felt compelled to provide liquidity support, going beyond their contractual obligations, to their structured investment vehicles (“SIVs”) or to purchase asset-backed commercial paper (“ABCP”) issued by their sponsored vehicles. By providing this implicit support, these banks signalled to the market that the risks inherent in the securitized assets were essentially still held by them and, in effect, had not been transferred. As a result of the provision of the support, the banks not only assumed additional credit, market and liquidity risks, but also put pressure on their capital ratios. E2.15 Consequently AIs should incorporate exposures that could give rise to reputation risk into their assessment of whether the requirements for recognition of risk transference under the securitization framework within Pillar 1 have been met and the potential adverse impact of providing implicit support. Their processes for approving new products and strategic initiatives should also consider the potential provision of implicit support. Further, they should incorporate the risks arising from such exposures into their risk management processes and appropriately address them in their CAAP and liquidity contingency plans. E2.16 To support the process described in subsection E2.15, AIs should have effective policies and procedures in place to identify potential sources of reputation risk in respect of any securitization and off-balance sheet exposures to which they are exposed. In identifying such potential sources, AIs should pay particular attention to the following situations:

an AI’s sponsorship of securitization structures such as
ABCP conduits and SIVs, as well as the sale by the AI of

41 Implicit support arises when an AI provides post-sale support to a securitization transaction in excess of its contractual obligations. Such non-contractual support exposes the AI to the risk of loss, such as loss arising from deterioration in the credit quality of the transaction’s underlying exposures.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 credit exposures to securitization trusts. Reputation risk may arise as described in subsection E2.14;

an AI’s involvement in asset or fund management,
particularly when financial instruments are issued by entities owned or sponsored by the AI, and are distributed to the customers of the AI. In the event that the instruments are not correctly priced or the main risks underlying the instruments are not clearly or adequately disclosed, the AI may face legal action from its customers or other pressure to cover losses suffered by them; and
an AI’s sponsorship of money market mutual funds, inhouse hedge funds and real estate investment trusts. In
these cases, the AI may decide to support the value of shares or units held by investors on reputation grounds even though it is not contractually required to provide the support. E2.17 AIs should take account of the sources of reputation risk mentioned above in conducting their stress tests in order to enable the Board and senior management to have a firm understanding of the consequences and second-round effects of reputation risk arising from securitization and off-balance sheet activities (see Annex D for details). E2.18 AIs should also remain mindful of the potential regulatory consequences of providing implicit support to investors in securitization transactions that they have originated. Under §230(1) of the Banking (Capital) Rules, if an AI is found to have provided implicit support in contravention of that subsection, the MA may, after having had regard to the materiality of the contravention, take one or more of the measures prescribed in §230(2) of the Banking (Capital) Rules (e.g. public disclosure of the contravention, increase in minimum §97F CAR, etc.). Significance of risk transfer E2.19 If an AI wants to obtain the capital relief provided under §229(1) of the Banking (Capital) Rules in respect of a securitization transaction that the AI has originated, it should demonstrate to the satisfaction of the MA that the requirements set out in

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Schedule 9 or 10 of the Rules, as the case requires, are met.
In particular, the transfer of credit risk associated with the underlying exposures in the transaction from the AI to third parties must be significant. If the MA is not satisfied that the risk transfer is significant, he will deny capital relief under §229(1). The MA may also consider the need for increasing the AI’s capital requirements to cover any additional risk not already accounted for in the capital requirements calculated under Pillar 1. E2.20 In assessing the degree of credit risk transfer associated with a securitization transaction originated by an AI, the MA is likely to have concerns in any cases where it appears that a significant amount of risk is retained or repurchased by the originating AI. The MA will expect a significant portion of credit risk to be transferred to at least one independent third party, both at the inception of the transaction and on an ongoing basis. The MA will, for this purpose, have regard to all relevant factors, including whether a significant portion of the nominal value of the pool of underlying exposures has been transferred in the process. Where AIs repurchase risk for market-making purposes, the repurchase should be confined to part of a transaction and should not, for example, extend to the repurchase of a whole tranche. Moreover, positions repurchased for market-making purposes should be resold within an appropriate period. E2.21 The MA will have concerns if an originating AI retains or repurchases significant securitization exposures in a securitization transaction, especially if this relates to unrated exposures. In this situation, it is likely that both the poorer quality unrated assets (usually the originator retains the first loss) and most of the credit risk embedded in the underlying exposures will remain with the originating AI. Market innovations E2.22 As the Pillar 1 requirements for securitization exposures (re
Part 7 of the Banking (Capital) Rules) may not be adequate to
address all potential issues associated with such exposures, the MA will consider new features of securitization transactions as they arise, and determine as part of the SRP whether

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 additional capital needs to be maintained by AIs for such transactions. The MA’s assessment will include any potential impact that the new features of securitization transactions may have on credit risk transfer. Call provisions E2.23 The MA expects an AI not to make use of clauses that entitle the AI to call a securitization transaction, or allow a credit protection to lapse, prematurely if this would increase the AI’s exposure to losses or deterioration in the credit quality of the underlying exposures. E2.24 In addition, the MA expects AIs to only execute clean-up calls 42 for economic business purposes, such as when the cost of servicing the underlying credit exposures exceeds the benefit of servicing the exposures. E2.25 AIs should also be aware that certain clean-up calls may constitute implicit support, and hence be subject to the measures set out in §230(2) of the Banking (Capital) Rules. Under §230(4) of the Banking (Capital) Rules, a clean-up call in a securitization transaction will be treated as implicit support if the exercise of the call by the originating AI has the effect of providing credit enhancement to the transaction. Early amortization 43 E2.26 The MA will assess how AIs internally measure, monitor, and manage risks associated with securitizations of revolving credit

42 As defined in §227(1) of the Banking (Capital) Rules, “clean-up call”, (i) in relation to a traditional securitization transaction, means an option which permits the originator in the transaction to repurchase the outstanding securitization issues of the transaction once the amount of the outstanding securitization issues, or of the underlying exposures that have not been repaid, has fallen below a level specified in the documentation for the transaction; or (ii) in relation to a synthetic securitization transaction, means an option which permits the person providing credit protection under the documentation for the transaction to extinguish the credit protection once the amount of the reference pool of underlying exposures has fallen below a level specified in the documentation. 43 As defined in §227(1) of the Banking (Capital) Rules, "early amortization provision", in relation to a securitization transaction in which the underlying exposures are revolving in nature, means a mechanism which, once triggered, allows investors in the securitization issues to be paid out prior to the originally stated maturity of the issues held by them.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 facilities. In particular, the MA will place significant emphasis on internal management and controls, as well as risk monitoring activities, with respect to securitization transactions with early amortisation features, including how an AI assesses the risk and likelihood of early amortization of such transactions. E2.27 The MA expects the sophistication of an AI’s system for monitoring the likelihood and risks of an early amortization event to be commensurate with the size and complexity of the AI’s securitization activities that involve early amortization provisions. E2.28 At a minimum, AIs are expected to (i) implement reasonable methods for allocating economic capital against the economic substance of the credit risk arising from revolving securitizations; and (ii) have adequate capital and liquidity contingency plans that evaluate the probability of an early amortization occurring and address the implications of both scheduled and early amortization. In addition, the capital contingency plan should address the possibility that an AI will face higher levels of required capital under the early amortization provisions set out in the Banking (Capital) Rules (e.g. §245 and §257). E2.29 Specifically, in relation to controlled early amortization provisions (see §245(5) and §257(5) of the Banking (Capital) Rules), the MA may also review the process by which an AI determines the minimum amortization period required to pay down 90% of the outstanding balance at the point of early amortization. Where the MA does not consider the process adequate, he will determine appropriate action to be taken, such as increasing the AI’s capital requirements and/or directing the AI to take remedial measures. E2.30 Because most early amortization triggers are tied to excess spread 44 levels, the factors affecting these levels should be well

44 The term “excess spread” is defined in §227(1) of the Banking (Capital) Rules. It refers to future interest and other income derived by the special purpose entity in a securitization transaction from the underlying exposures in the transaction in excess of the transaction costs specified in the documentation for the transaction, expressed as a percentage of the underlying exposures.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 understood, monitored, and managed, to the extent possible, by originating AIs in securitization transactions with early amortization features. For example, the following factors affecting excess spread should generally be considered:

interest payments made by obligors of the underlying
exposures;
other fees and charges to be paid by obligors of the
underlying exposures (e.g. late payment fees, cash advance fees and over-limit fees);
gross charge-offs;
principal payments;
recoveries on charged-off loans;
interchange income;
interest paid on investors’ certificates; and
macroeconomic factors such as bankruptcy rates, interest
rate movements, unemployment rates, etc.
E2.31 AIs should consider the effects that changes in portfolio management or business strategies may have on the levels of excess spread and on the likelihood of an early amortization event. For example, marketing strategies or underwriting changes that result in lower finance charges or higher chargeoffs, might also lower excess spread levels and increase the likelihood of an early amortization event. E2.32 AIs should use techniques such as static pool cash collections analyses and stress tests to better understand pool performance. These techniques can highlight adverse trends or potential adverse impacts. AIs should have policies in place to respond promptly to adverse or unanticipated changes. The MA will take appropriate action where he does not consider these policies adequate, such as directing an AI to obtain a dedicated liquidity line or increasing the AI’s capital requirements.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Annex F: Assessment of risk concentrations under CAAP
F1 Introduction
F1.1 Risk concentrations can arise in an AI’s assets, liabilities or offbalance sheet items, through the execution or processing of transactions (either product or service), or through a combination of exposures across these broad categories. Unmanaged risk concentrations are an important cause of major banking problems. AIs should have comprehensive policies and procedures in place to identify and assess risk concentrations, and incorporate an appropriate level of capital for risk concentrations in their CAAP. F1.2 An AI’s assessment of risk concentrations under its CAAP should not be a mechanical process. The AI should determine how to conduct this assessment, having regard to its business model and its own specific vulnerabilities. F1.3 AIs are expected to comply with the supervisory requirements set out in section F2 when assessing and managing their risk concentrations. As part of the SRP, the MA reviews AIs’ compliance with the supervisory requirements and evaluates the appropriateness of the level of capital they have set aside for risk concentrations. F2 Supervisory requirements F2.1 AIs should consider not only the obvious “traditional concentrations”, but also concentrations based on common or correlated risk factors that reflect more subtle or more situationspecific factors than traditional concentrations, such as correlations between credit, market and liquidity risks. The typical situations in which risk concentrations can arise include:

exposures to a single counterparty, borrower or group of
connected counterparties or borrowers;
exposures to industry or economic sectors, including
exposures to both regulated and non-regulated financial institutions such as hedge funds and private equity firms;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

exposures to geographical regions;
exposures arising from credit risk mitigation techniques,
including exposure to similar collateral types or to credit protection providers whose creditworthiness is closely related to the performance of assets or exposures for which credit protection is purchased due to “wrong-way risk”;
trading or market risk exposures;
exposures to counterparties (e.g. hedge funds and hedge
counterparties) through the execution or processing of transactions (either product or service);
undue reliance on particular funding sources;
holding of assets in the banking book or trading book, such
as loans, derivatives and structured products; and
off-balance sheet exposures, including guarantees,
liquidity facilities and other commitments.
F2.2 AIs should have effective internal polices, systems and controls in place to identify, measure, monitor, control and mitigate their risk concentrations in a timely manner. In identifying and assessing risk concentrations, not only should normal market conditions be considered, but also the potential build-up of concentrations under stressed market conditions, economic downturns and periods of general market illiquidity. Where applicable, AIs should assess scenarios that consider possible concentrations arising from contractual and non-contractual contingent claims. AIs with significant involvement in originating exposures for securitization or other structured credit product related purposes should assess scenarios that combine the potential build-up of pipeline exposures together with the loss of market liquidity and a significant decline in asset values.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 F2.3 AIs should be able to identify and aggregate similar risk exposures across the organisation, including across business lines 45 , asset types (e.g. loans, derivatives and structured products), risk areas (e.g. the trading book) and geographical regions through their risk management processes and MIS. The Board and senior management of AIs should analyse and understand the firm-wide risk concentrations identified. In the case of a local banking group which adopts a CAAP covering the positions of their subsidiary AIs, risk concentrations should be analysed on both solo and consolidated bases, as an unmanaged concentration at a subsidiary AI may appear immaterial at the consolidated level, but could threaten the viability of the subsidiary operation. F2.4 While risk concentrations often arise due to direct exposures to borrowers and obligors, an AI may also incur a concentration on a particular asset type indirectly through investments backed by such assets (e.g. collateralised debt obligations) as well as exposure to protection providers which guarantee the performance of the specific asset type (e.g. monoline insurers). AIs should have adequate, systematic procedures in place for identifying high correlations between the creditworthiness of a protection provider and the obligors of the underlying exposures due to their performance being dependent on common factors beyond general systemic risk (i.e. “wrong-way risk”). F2.5 AIs should employ a number of techniques, as appropriate, to measure risk concentrations. These techniques include sensitivity analysis by applying shocks to various risk factors, use of business level and firm-wide scenarios, and use of integrated stress-testing and economic capital models. Identified concentrations should be measured in a number of ways, including for example consideration of gross versus net exposures, use of notional amounts, and analysis of exposures with and without counterparty hedges.

45 An example from the 2007/2008 Global Financial Crisis would be subprime exposure in lending portfolios, counterparty exposures, conduit exposures and structured investment vehicles, contractual and non-contractual exposures, trading activities, and underwriting pipelines.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 F2.6 When conducting regular stress tests, AIs should incorporate all major risk concentrations and identify and respond to potential changes in market conditions that could adversely impact their performance and capital adequacy. F2.7 AIs should establish internal position limits for concentrations to which they may be exposed. Similar exposures should be aggregated across business platforms (including the banking and trading books) to determine whether there is a concentration or a breach of an internal position limit. Procedures should also be in place to identify any limit breaches and promptly report such breaches to senior management, as well as to ensure that appropriate follow-up actions are taken. F2.8 AIs should have credit risk mitigation strategies in place that have senior management approval. This may include altering business strategies, reducing limits or increasing capital buffers in line with the desired risk profile. While implementing risk mitigation strategies, AIs should be aware of possible concentrations that might arise as a result of employing risk mitigation techniques. F2.9 AIs should have an appropriate infrastructure and MIS that allow for the aggregation of exposures and risk measures across business lines and support customised identification of concentrations and emerging risks. Procedures should also be in place to communicate risk concentrations to the Board and senior management in a manner that clearly indicates where in the organisation each segment of a risk concentration resides.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Annex G : Assessment of high cost credit protection
transactions under SRP
G1 Introduction
G1.1 Credit risk mitigation techniques are recognised in the calculation of credit risk under the capital adequacy framework. However, potential for regulatory capital arbitrage has been identified through the use of high cost credit protection transactions. This annex:

highlights the issues associated with such transactions;
sets out the factors that AIs should take into account in
analysing any such transactions that they may use for the purpose of credit risk mitigation or transfer of credit risk; and
describes the MA’s approach to scrutiny of any such
transactions entered into by an AI in his assessment of the AI’s capital adequacy under the SRP. G2 High cost credit protection transactions G.2.1 High cost credit protection transactions typically involve (i) a delay in recognising losses and the costs of protection in earnings by an AI which has purchased the credit protection; and (ii) an immediate regulatory capital benefit being received by that AI in the form of a lower risk weight on an exposure on which it is nominally transferring risk. G2.2 In some of these transactions, the premiums or fees and other direct or indirect costs paid for credit protection, combined with other terms and conditions, call into question the degree of credit risk mitigation or credit risk transfer of the transaction. Rather than contributing to a prudent risk management strategy, the primary effect of such transactions may be to embed a high percentage of expected losses into the premiums and fees paid, under the premise that the transaction would receive favourable risk-based capital treatment in the short

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 term and defer recognition of losses over an extended period, without meaningful risk mitigation or transfer of risk. G2.3 As an example, assume that an AI purchases credit protection on a first loss retained securitization position where the cost of protection is equal to the recorded value of the securitization tranche on which protection is being purchased or where the terms and conditions of the contract ensure that the premiums paid throughout the life of the contract will equal the amount of the realised losses. Regulatory capital arbitrage may exist where the immediate capital relief recognised for the purchased credit protection ultimately will be offset by the premiums paid and recognised in earnings over the life of the contract. G2.4 While the above example focuses on the use of credit risk mitigation in a securitization transaction, arbitrage opportunities exist more generally under the credit risk mitigation framework. However, arbitrage opportunities are more likely to occur when credit risk mitigation techniques are used for securitization transactions where the difference in the risk weight before and after purchasing protection can be significant. G3 Supervisory requirements General G3.1 AIs should consider the relevant costs of any credit protection they purchase, whether in the context of the securitization framework or within the credit risk mitigation framework, when assessing their capital adequacy. G3.2 In the case of credit protection transactions that have unusually high cost or innovative features, AIs should further analyse and document the economic substance of such transactions to assess the degree of risk transference and the associated impact on their overall capital adequacy. The analysis should also specify how such transactions align with their overall risk management strategy.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 G3.3 AIs should bring to the attention of the MA any high cost or innovative transactions that fall within subsection G2.2 to ensure they are subject to appropriate prudential treatment. Specific factors to be considered G3.4 In evaluating the degree of credit risk mitigation or credit risk transfer of a transaction, an AI should consider, among other things:

a comparison of the present value of premiums and other
costs not yet recognised in capital relative to the expected losses in respect of the protected exposures over a variety of stress scenarios;
the pricing of the transaction relative to market prices,
including appropriate consideration of non-cash premium payments;
the timing of payments under the transaction by the
protection buyer, including potential timing differences between the AI’s provisioning for, or write-downs of, the protected exposures and payments by the protection seller;
a review of applicable call dates to assess the likely
duration of the credit protection relative to the potential timing of future credit losses;
an analysis of whether certain circumstances could lead to
the AI’s increased reliance on the counterparty at the same time that the counterparty’s ability to meet its obligations is weakened; and
an analysis of whether the AI can prudently afford the
premiums given its earnings, capital, and overall financial condition. Supervisory assessment G3.5 An AI’s analysis of its credit protection transactions will be assessed by the MA under the SRP. In particular, the MA may review any internal memos or records outlining the rationale for

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 a credit protection transaction and the AI’s analysis of the anticipated costs and benefits of the transaction. G3.6 The MA will pay particular attention to credit protection transactions that exhibit the characteristics stated below.

Protection premiums are high relative to the amount of the
exposures being protected – for example, when the cost of protection over the life of the protection contract equals, or exceeds, the amount of the exposures for which protection is being purchased. Rebate mechanisms (i.e. where the protection seller agrees to refund parts of the premium to the protection buyer according to the performance / deterioration of the protected exposure) will, prima facie, be regarded as an indication of excessive premium and, consequently, regulatory arbitrage.
Transactions where the exposure being protected has not
been fair valued and losses on the exposure have not been recognised in earnings – this situation can increase the potential for a transaction to involve regulatory capital arbitrage in the form of deferral of loss recognition.
Transactions where the potential for reduction in risk
weight or regulatory capital as a result of the transaction is greatest – this is most likely in transactions where the exposures for which protection is purchased would otherwise be assigned a high risk weight, for example, exceeding 150%. Nevertheless, the potential for arbitrage still exists for relatively lower risk-weighted reference exposures, and the MA will also focus on individual transactions that raise concerns due to unique deal features.
Protection premiums are not proportional to the exposures
being protected – this can occur, for example, when (i) premiums are guaranteed over time without respect to write-downs or default of the reference exposure (i.e. the premium payments are not a proportion of the amount of positions of the protected portfolio that are still performing);

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 or (ii) upfront premiums or premiums payable at termination have not been recognised in retained earnings.

Structural features of the transaction that can increase the
total cost of credit risk mitigation – these features can include (i) high transaction costs for the protection buyer; (ii) obligations of the protection buyer to the counterparty to post additional collateral; (iii) additional payments at maturity required of the protection buyer; and (iv) early termination of the transaction at the option of the protection buyer. Other features that should lead to increased scrutiny include pre-agreed mechanisms, for example “atmarket unwinds”, where the protection seller and protection buyer agree that the transaction can be terminated in the future at an agreed upon “market” value where calculation of the “market” value is pre-specified. G3.7 The MA will also review the appropriateness of an AI’s approach to the recognition of credit protection for first loss credit enhancements in respect of securitization transactions (see the example in subsection G2.3). In such cases it is likely that expected loss on the first loss positions will still be retained by the AI even if it has bought credit protection given that the pricing for such protection will reflect the higher risk involved. Therefore the MA will expect an AI’s policies to take account of this in determining its economic capital.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12
Annex H : Assessment of counterparty credit risk under CAAP
/ SRP
H1 Introduction
H1.1 While counterparty credit risk (“CCR”) is a type of credit risk, it differs from traditional credit risk in that an economic loss would only occur to an AI if a transaction, or a portfolio of transactions, with a counterparty has a positive economic value to the AI at the time of default of that counterparty. Hence, unlike an AI’s exposure to credit risk through a loan, where the exposure to credit risk is unilateral and only the lending AI faces the risk of loss, CCR creates a bilateral risk of loss, i.e. the market value of the transaction can be positive or negative to either counterparty to the transaction. The market value is uncertain and can vary over time with the movement of underlying market factors. H1.2 Under the Banking (Capital) Rules, AIs are required to maintain regulatory capital for two major aspects of CCR, viz. counterparty default risk (i.e. the risk of the default of the AI’s counterparties) and CVA risk (i.e. the risk of mark-to-market losses in a transaction with a counterparty arising from credit value adjustments 46). Subject to the MA’s approval, AIs may adopt a modelling approach (i.e. the IMM(CCR) approach) to the calculation of counterparty default risk. H1.3 In assessing an AI’s CCR under the SRP, the MA will focus substantially on the adequacy and effectiveness of the AI’s CCR management systems, especially in respect of the key elements mentioned in subsections H2.1 to H2.9 of this annex. The MA’s approach to assessing AIs’ use of the IMM(CCR) approach, and dealing with any issues identified, is also highlighted in this annex.

46 Credit valuation adjustments, in relation to the calculation by an AI of its CCR in respect of a counterparty, refer to those adjustments made by the AI to the valuation of a netting set (as defined in §2(1) of the Banking (Capital) Rules) with the counterparty to reflect the market value of the credit risk of that counterparty.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 H1.4 Another area of assessment under the SRP relates to an AI’s exposure to central counterparties, which may be a potential source of CCR for the AI’s centrally cleared trade exposures. This annex provides guidance on AIs’ assessment of such exposures under their CAAP, as well as the MA’s approach towards such exposures under the SRP. H2 Supervisory requirements CCR systems and controls H2.1 An AI should have CCR management policies, processes and systems that are conceptually sound and implemented with integrity and that are proportionate to the sophistication and complexity of the AI’s holdings of exposures that give rise to CCR. A sound CCR management framework should include the identification, measurement, management, approval and internal reporting of CCR, with designated units for independent risk control and collateral management. See CRG-13 “Counterparty Credit Risk Management” for more details. H2.2 An AI’s risk management policies should take account of the market, liquidity, legal, operational and other risks that can be associated with CCR and, to the extent practicable, interrelationships among those risks. The AI should not undertake business with a counterparty without assessing its creditworthiness and should take due account of both settlement and pre-settlement credit risk. These risks should be managed as comprehensively as practicable at the counterparty level (aggregating counterparty exposures with other credit exposures) and at the firm-wide level. H2.3 The Board and senior management of an AI should be actively involved in the CCR control process and should regard this as an essential aspect of the business to which significant resources need to be devoted. H2.4 An AI should prepare daily reports on its exposures to CCR, which should be reviewed by a level of management with sufficient seniority and authority to enforce both reduction of

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 positions taken by individual credit managers or traders and reduction in the AI’s overall CCR exposure. H2.5 An AI’s CCR management system should be used in conjunction with the AI’s internal credit and trading limits which should be related to its risk measurement model in a manner that is consistent over time and that is well understood by credit managers, traders and senior management. H2.6 The measurement of CCR should include monitoring daily and intraday usage of credit lines. An AI should measure current exposure (gross and net of collateral held) where such measures are appropriate and meaningful (e.g. for OTC derivatives, margin lending, etc.). The AI should take account of large or concentrated positions, including concentrations by groups of related counterparties, by industry, by market, customer investment strategies, etc. H2.7 An AI should have a routine and rigorous programme of stresstesting in place as a supplement to the CCR analysis based on the day-to-day output of its risk measurement model. The results of stress-testing should be reviewed periodically by the Board and senior management and be reflected in the CCR policies and limits set by senior management and the Board. Where stress tests reveal particular vulnerability to a given set of circumstances, management should explicitly consider appropriate risk management strategies (e.g. by hedging against that outcome, or reducing the size of the AI’s exposures). H2.8 An AI’s internal policies, controls and procedures concerning the operation of the CCR management system should be well documented, for example, through a risk management manual that describes the basic principles of the risk management system and that provides an explanation of the empirical techniques used to measure CCR. These policies and procedures should be subject to periodical review to ensure they remain adequate and appropriate. H2.9 An AI should conduct an independent review of the CCR management system (including any internal models used for CCR management and/or capital calculation purposes)

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 regularly through its internal auditing process (ideally not less than once a year). This review should include both the activities of the credit and trading units and of the independent CCR control unit 47 , and should specifically address, at a minimum, the following aspects:

the adequacy of the documentation of the CCR
management system and process;
the organisation and effectiveness of the independent
CCR control unit and collateral management unit 48 mentioned in subsection H2.1;
the integration of CCR measures into daily risk
management;
the approval process for risk pricing models and valuation
systems used by front and back-office personnel;
the validation of any significant change in the CCR
measurement process;
the scope of CCR captured by the risk measurement
model;
the integrity of the MIS produced for risk monitoring and
reporting purposes;
the accuracy and completeness of CCR data;
the accurate reflection of legal terms in collateral and
netting agreements into exposure measurements;
the verification of the consistency, timeliness and reliability
of data sources used to run internal models, including the independence of such data sources;

47 The maintenance of this control function for CCR management purposes is generally required under CR-G-13 “Counterparty Credit Risk Management” (see paras. 4.6.7 to 4.6.9 of this module for a detailed description of this function and its responsibilities). 48 This unit performs the function of collateral management and margining related operation (see also para 4.3.6 in CR-G-13 “Counterparty Credit Risk Management”).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12

the accuracy and appropriateness of volatility and
correlation assumptions;
the accuracy of valuation and risk transformation
calculations; and
the verification of the model’s accuracy through frequent
back-testing.
In the case of AIs which adopt the IMM(CCR) approach, the review should also cover relevant requirements set out in
Schedule 2A of the Banking (Capital) Rules.
Use of (IMM)CCR approach
H2.10 An AI that uses an internal model to estimate its exposure amount or EAD for CCR exposures should monitor the appropriate risks and have processes to adjust its estimation of expected positive exposure (“EPE”) 49 , when those risks become significant. This includes the following:
the AI should identify and manage its exposures to specific
wrong-way risk;
for exposures with a rising risk profile after one year, the AI
should compare on a regular basis the estimate of EPE over one year with the EPE over the life of the exposure; and
for exposures with a short-term maturity (below one year),
the AI should compare on a regular basis the replacement cost (current exposure) and the realised exposure profile, and/or store data that allow such comparisons. H2.11 Senior management of an AI should be aware of the limitations and assumptions of the internal model used for CCR and the

49 EPE refers to the weighted average over time of expected exposures where the weights are the proportion that an individual expected exposure represents of the entire time interval.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 impact these can have on the reliability of the model output. They should also consider the uncertainties of the market environment (e.g. the timing of realisation of collateral) and operational issues (e.g. pricing feed irregularities) and how these are reflected in the model. H2.12 In assessing an internal model used to estimate EPE, the MA will review the characteristics of the AI’s portfolio of exposures that give rise to CCR, in particular:

the diversification of the portfolio (number of risk factors to
which the portfolio is exposed);
the correlation of default across counterparties; and
the number and granularity of counterparty exposures.
H2.13 The MA expects an AI to have a robust limit monitoring system that includes the measurement and monitoring of peak exposure or potential future exposure at a confidence level chosen by the AI at both the portfolio and counterparty levels. H2.14 The MA will assess whether an AI using the IMM(CCR) approach continues to comply with Schedule 2A to the Banking (Capital) Rules, which specifies the minimum requirements to be satisfied for approval under §10B(2)(a) of the Rules to use the IMM(CCR) approach (see also subsection B1.3 of Annex B). H2.15 The MA will determine the appropriate action to be taken where an AI’s estimates of exposure or EAD under the IMM(CCR) approach do not adequately reflect the AI’s exposure to CCR. Such action might include directing the AI to revise its estimates, directing it to apply a higher estimate of exposure or EAD under the IMM(CCR) approach, or disallowing it from recognising internal estimates of EAD for regulatory capital purposes. Exposures to central counterparties H2.16 A central counterparty (“CCP”) is a clearing house that interposes itself between counterparties to contracts traded in

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 one or more financial markets, becoming the buyer to every seller and the seller to every buyer and thereby ensuring the future performance of open contracts. H2.17 Given the significance of CCPs to financial markets, it is important for individual CCPs to have robust risk management systems and be subject to adequate regulations 50 in jurisdictions in which they are based and prudentially supervised. Under the Banking (Capital) Rules, the capital treatment for an AI’s exposures to a CCP differs depending on whether that CCP is a qualifying CCP (“QCCP”). Generally, a QCCP is an entity that is licensed to operate as a CCP, is permitted by the appropriate regulator / overseer to operate as such with respect to the products offered, and satisfies certain other qualifying conditions (see the definition of QCCP set out in §226V(1) of the Rules for more details). H2.18 Where an AI has exposures to a CCP, regardless of whether that CCP is classified as a QCCP, the AI should ensure that it maintains adequate capital for such exposures. In conducting its internal capital assessment, the AI should consider whether additional capital (i.e. in excess of minimum regulatory capital calculated under Pillar 1) needs to be held if, for example, (i) its dealings with the CCP give rise to more risky exposures; or (ii) where, in the context of its dealings with the CCP, it is unclear that the CCP meets the definition of a QCCP. H2.19 Where an AI is acting as a clearing member 51, the AI should assess through appropriate scenario analysis and stress-testing whether the level of capital held against exposures to a CCP adequately addresses the inherent risks of those transactions. This assessment will include potential future or contingent exposures resulting from future drawings on default fund commitments, and/or from secondary commitments to take over or replace offsetting transactions from clients of another clearing

50 These regulations should be consistent with the CPSS-IOSCO Principles for Financial Market Infrastructures. 51 As defined in §2(1) of the Banking (Capital) Rules, “clearing member”, in relation to a CCP, means (i) a member of, or a direct participant in, the CCP that is entitled to enter into a transaction with the CCP; or (ii) another CCP to which the CCP has a link.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 member in the case of this clearing member defaulting or becoming insolvent. H2.20 An AI should monitor and report to the Board (or a designated committee) and senior management on a regular basis all of its exposures to CCPs, including exposures arising from trading through a CCP and exposures arising from CCP membership obligations such as default fund contributions 52 . H2.21 Under the SRP, the MA may require AIs to hold additional capital against their exposures to a QCCP, for example, where an external assessment 53 has found material shortcomings in the CCP or the regulation of CCPs in the jurisdiction concerned, and the CCP and/or the CCP regulator have not since publicly addressed the issues identified. H2.22 Under the Banking (Capital) Rules, AIs must allocate a riskweight of 1,250% to the default fund contributions to a nonqualifying CCP, and for that purpose, an AI’s default fund contributions must include the funded and unfunded contributions that the AI is liable to pay if the non-qualifying CCP requires the AI to do so. If the default fund contributions of an AI to a non-qualifying CCP consist of a binding commitment in respect of an unfunded default fund contribution to the CCP and the amount of the commitment is unlimited, the AI should (i) inform the MA of this situation; and (ii) determine the amount of commitment to which a 1,250% risk-weight is to apply based on its own estimation unless the MA, by notice in writing given to the AI, requires the AI to take the action specified in subsection H2.23. H.2.23 Under the SRP, the MA will review the basis and methodology adopted by the AI to determine the amount of unfunded commitments to which a 1,250% risk-weight should apply under Pillar 1. If the MA considers that the amount used by the AI

52As defined in §2(1) of the Banking (Capital) Rules, “default fund contribution”, in relation to a clearing member of a CCP, means (i) the funded or unfunded contribution made by the clearing member to the CCP’s mutualised loss-sharing arrangements; or (ii) the clearing member’s underwriting of the CCP’s mutualised loss-sharing arrangements. 53 An example of external assessment is an assessment conducted by the International Monetary Fund under its Financial Sector Assessment Programme (i.e. FSAP).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.3 – 28.12.12 cannot fairly reflect the risk exposure of the AI’s commitment, the MA may, by notice in writing, require the AI to use another amount or to use the method specified by the MA to estimate the amount of the commitment to which a 1,250% risk-weight should apply.

Lineage: No known changes

Similar documents from other regulators