Supervisory Review Process

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 1 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To (i) set out the MA’s 1 approach to conducting the SRP under Pillar 2, including the criteria and standards used for evaluating an AI’s capital adequacy and, where applicable, the effectiveness of the AI’s CAAP, for the purposes of determining its Pillar 2 capital requirement; and (ii) describe how the Pillar 2 framework will operate under the capital adequacy framework Classification A statutory guideline issued by the MA under §7(3) of the Banking Ordinance Previous guidelines superseded CA-G-5 “Supervisory Review Process” (V.1) dated 10.11.06, (V.2) dated 04.06.10, (V.3) dated 28.12.12, (V.4) dated 08.04.2016, (V.5) dated 24.01.2020 and (V.6) dated 24.01.2025 Application To all locally incorporated AIs Structure

1. Introduction 1.1 Terminology 1.2 Background and scope 1 In this module, the term “MA” refers to the “Monetary Authority” or the “Hong Kong Monetary Authority”, as the context so requires.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 2 1.3 Main objectives and principles 1.4 Implementation 2. The MA’s approach to supervisory review 2.1 General 2.2 Legal framework 2.3 Operation of Pillar 2 under capital adequacy framework 2.4 Key components of SRP 2.5 Supervisory arrangements 2.6 Application to local banking groups 2.7 Application to foreign bank subsidiaries 2.8 Review and notification of SRP results 3. Supervisory review of capital adequacy 3.1 General 3.2 Key factors for assessing capital adequacy 3.3 Setting of Pillar 2 capital requirement 3.4 The P2A and the P2B components of the Pillar 2 capital requirement 3.5 Determination of §97F minimum CAR 3.6 Integration with risk-based supervisory process 3.7 Use of stress tests 3.8 Supervisory guidance on risk management practices 3.9 Ongoing monitoring of capital adequacy 4. Supervisory standards on CAAP 4.1 General 4.2 Internal control and governance 4.3 Key elements of CAAP 4.4 Additional criteria for use of risk-modelling techniques 4.5 Requirements for consolidated capital 4.6 Application to subsidiary AIs 4.7 Review by the MA

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 3 Annex A List of major supervisory guidelines applicable to assessment of capital adequacy Annex B Factors for assessing capital adequacy under SRP Annex C Scoring worksheets to facilitate assessment under SRP Annex D Supervisory requirements on application of stress tests under CAAP Annex E Assessment of risks arising from securitization activities under CAAP / SRP Annex F Assessment of risk concentrations under CAAP Annex G Assessment of high cost credit protection transactions under SRP Annex H Assessment of counterparty credit risk under CAAP / SRP

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 4

1. Introduction 1.1 Terminology 1.1.1 Abbreviations and other terms used in this module have the following meanings2 : • “Additional Tier 1 capital” means Additional Tier 1 capital as defined in §39 of the BCR; • “BCR” means the Banking (Capital) Rules made by the MA under §97C(1) of the Banking Ordinance for prescribing capital requirements for AIs incorporated in Hong Kong, taking into account the risks associated with the AIs; • “basic approach”, in relation to the calculation of an AI’s credit risk for non-securitization exposures, means the method of calculating that risk as set out in Part 5 of the BCR; • “BCR buffer level” means the buffer level applicable to an AI under §3G of the BCR, and comprises (i) if the AI is a G-SIB or D-SIB, the CB ratio, CCyB ratio and HLA ratio; or (ii) in any other case, the CB ratio and CCyB ratio; • “BCR minimum CAR” means the minimum CET1 capital ratio, Tier 1 capital ratio and Total capital ratio prescribed in §3B of the BCR; • “CAAP” means the capital adequacy assessment process that an AI uses to identify and measure the risks it faces and to assess how much capital is needed to support those risks; 2 To facilitate understanding by AIs, the meanings set out in this subsection in respect of certain terms defined in the BCR are recast, elaborated or simplified. AIs should refer to the Rules for the legal interpretation, as well as the most up-to-date definitions, of these terms.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 5 • “CAR” means the capital adequacy ratio of an AI as defined in §3 of the BCR, which comprises three risk￾based capital ratios, viz. CET1 capital ratio, Tier 1 capital ratio and Total capital ratio. Unless otherwise specified, any reference to CAR in this module should be read as a reference to the three ratios, both individually and collectively; • “capital add-on”, in relation to an AI’s §97F minimum CAR, means that portion of the §97F minimum CAR which is in excess of the BCR minimum CAR. For the avoidance of doubt, the capital add-on referred to here is in terms of each of the three risk-weighted capital ratios that comprise the CAR. For example, under §3B of the BCR, the minimum CET1 capital ratio, Tier 1 capital ratio and Total capital ratio for 2015 onwards are set at 4.5%, 6% and 8% respectively. If the MA requires an AI to observe a higher minimum CET1 capital ratio (at 5.1%), Tier 1 capital ratio (at 6.8%) and Total capital ratio (at 9%) under §97F, the capital add-on for the AI in respect of each of the three ratios is respectively 0.6%, 0.8% and 1%. The MA determines the capital add-on of individual AIs as part of the SRP; • “CB ratio” means the capital conservation buffer ratio specified in §3M of the BCR; • “CCyB ratio” means the countercyclical capital buffer ratio calculated under §3O of the BCR; • “CET1 capital” means Common Equity Tier 1 capital as defined in §38 of the BCR; • “CET1 capital ratio” means the Common Equity Tier 1 capital ratio as defined in §2(1) of the BCR. This ratio, expressed as a percentage, is the amount of an AI’s CET1 capital to the sum of the AI’s risk-weighted amount for credit risk, risk-weighted amount for

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 6 market risk, risk-weighted amount for CVA risk, risk￾weighted amount for operational risk and risk￾weighted amount for sovereign concentration risk, as determined in accordance with the BCR; • “counterparty credit risk” (CCR), in relation to a derivative contract or securities financing transaction entered into by an AI with a counterparty, means the risk that the counterparty could default before the final settlement of the cash flows of the contract or transaction, as defined in §2(1) of the BCR; • “CVA risk” means the risk of mark-to-market losses arising from changes in CVA values in response to changes in credit spreads of counterparties and market risk factors that drive the price of OTC derivative transactions and SFTs as defined in §2(1) of the BCR; • “default risk exposure” means an exposure to the CCR of a counterparty in respect of derivative contracts or securities financing transactions entered into with that counterparty the amount of which is calculated by using any one or more of the approaches or methods set out in Division 1A, 2, 2A or 2B of Part 6A of the BCR, as defined in §2(1) of the BCR; • “D-SIB” means a domestic systemically important authorized institution designated by the MA under §3U of the BCR; • “G-SIB” means a global systemically important authorized institution designated by the MA under §3S of the BCR; • “HLA ratio” means the higher loss absorbency ratio determined under §3V of the BCR (for a D-SIB), or determined under §3T of the Rules (for a G-SIB);

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 7 • “IMA” means the method of calculating an AI’s market risk capital charge under the internal models approach as set out in Part 8 of the BCR; • “IMM(CCR) approach” means the internal models (counterparty credit risk) approach set out in Division 2 of Part 6A of the BCR for calculating an AI’s default risk exposure; • “internal capital” means the amount of capital that an AI holds and allocates internally as a result of the AI’s assessment of the risks it faces; • “IRB approach” means the method of calculating an AI’s credit risk under the internal ratings-based approach as set out in Part 6 of the BCR; • “P2A” means the portion of the Pillar 2 capital requirement that reflects risks not captured, or not adequately captured, in Pillar 1; • “P2B” means the portion of the Pillar 2 capital requirement that provides a cushion of capital to bolster resilience in times of stress (and hence should be allowed to be used in such times) without reference to specific risks considered under P2A; • “Pillar 1” means the framework set out in the BCR for calculating the BCR minimum CAR that an AI should maintain in respect of credit, market, CVA, operational and sovereign concentration risks; • “Pillar 2” means the framework set out in this module for determining any additional capital that an AI should hold principally to cover risks not captured, or risks not adequately captured, under Pillar 1. This framework has two key elements: (i) the CAAP conducted by AIs and (ii) the SRP undertaken by the MA;

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 8 • “Pillar 2 capital requirement” means the capital requirement that an AI is required to meet in respect of its Pillar 2 risks, as derived from the SRP. This capital requirement will form the basis for determining an AI’s §97F minimum CAR (i.e. its CET1 capital ratio, Tier 1 capital ratio, and Total capital ratio) and §97F buffer level (if applicable); • “RRAO” means residual risk add-on as defined in §281 of the BCR; • “Review Tribunal” means the Banking Review Tribunal established by §101A of the Banking Ordinance. An AI aggrieved by a decision made by the MA in relation to the AI, to which §101B applies, may apply to the Tribunal under §101B of the Ordinance for a review of the decision. The MA’s decision under §97F of the Ordinance is a decision to which §101B applies; • “§97F buffer level” means the buffer level set by the MA for an individual AI pursuant to §97F of the Banking Ordinance; • “§97F minimum CAR” means the minimum CET1 capital ratio, Tier 1 capital ratio and Total capital ratio set by the MA for an individual AI pursuant to §97F of the Banking Ordinance; • “SRP” means the supervisory review process conducted by the MA for the purposes of evaluating and monitoring the capital adequacy of individual AIs, and of determining their Pillar 2 capital requirement; • “STM approach” means the method of calculating an AI’s market risk capital charge under the standardized (market risk) approach as set out in Part 8 of the BCR;

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 9 • “Tier 1 capital ratio” means the Tier 1 capital ratio defined in §2(1) of the BCR. This ratio, expressed as a percentage, is the amount of an AI’s Tier 1 capital to the sum of the AI’s risk-weighted amount for credit risk, risk-weighted amount for market risk, risk￾weighted amount for CVA risk, risk-weighted amount for operational risk and risk-weighted amount for sovereign concentration risk, as determined in accordance with the BCR; • “Tier 2 capital” means Tier 2 capital as defined in §40 of the BCR; • “Total capital ratio” means the Total capital ratio defined in §2(1) of the BCR. This ratio, expressed as a percentage, is the amount of an AI’s Total capital to the sum of the AI’s risk-weighted amount for credit risk, risk-weighted amount for market risk, risk￾weighted amount for CVA risk, risk-weighted amount for operational risk, and risk-weighted amount for sovereign concentration risk, as determined in accordance with the BCR. 1.2 Background and scope 1.2.1 The MA has conducted the SRP on AIs since 1 January 2007 as part of its risk-based supervisory process. The main purposes of the SRP are to assess AIs’ capital adequacy and determine if they should hold additional capital to cater for risks that are not covered, or not adequately covered, under Pillar 1. The scope and extent of applying the assessment standards and criteria under the SRP are commensurate with the nature, size and complexity of the business operations of individual AIs. 1.2.2 The basic elements of the SRP are embedded in the MA’s supervisory framework. With the power conferred upon

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 10 him under §97F of the Banking Ordinance3 , the MA may require AIs to observe a minimum CAR4 in excess of the BCR minimum CAR, and where necessary also a buffer level higher than the BCR buffer level, depending on the MA’s assessment of the risk profile of individual AIs. This is with the aim of assigning a minimum CAR and a buffer level to each AI that reflects more precisely the range of risks associated with the AI and to which it is potentially exposed. 1.2.3 A major feature of the SRP is the use by the MA of a detailed and rigorous assessment framework for setting the §97F minimum CAR and the §97F buffer level (where applicable) of individual AIs, taking into account their overall risk profile and risk management systems, the extent to which they are associated with, or exposed to, risks that are outside the realm of Pillar 1 and, the effectiveness of their CAAP. 1.2.4 This module sets out the approach that the MA adopts in conducting the SRP, including a description of: • the main principles and objectives underlying the SRP; • the key assessment factors that the MA considers in determining the Pillar 2 capital requirement, and the supervisory arrangements and procedures associated with the assessment; 3 §97F of the Banking Ordinance provides the MA with the power to vary any capital requirement rule (which includes the BCR minimum CAR and the BCR buffer level) applicable to an AI if he is satisfied, on reasonable grounds, that it is prudent to make the variation, taking into account the risks associated with the AI. 4 For the avoidance of doubt, the CAR referred to in this module covers the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio, individually and collectively, unless otherwise specified.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 11 • the supervisory approach to reviewing the CAAP of individual AIs, including the standards and requirements expected of them; and • the process for ongoing monitoring of AIs’ capital adequacy and compliance with the BCR. 1.2.5 This module also illustrates: • the operation of Pillar 2 within the capital adequacy framework (including the positioning of the Pillar 2 capital requirement in the capital hierarchy); • the approach to allocating the Pillar 2 capital requirement amongst the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio; and • the differentiation of P2A and P2B and how the BCR buffer level is taken into account to address any overlap. 1.2.6 This module should be read in conjunction with the BCR and other supervisory guidelines, including the modules of the Supervisory Policy Manual, issued by the MA that are relevant to the assessment of AIs’ capital adequacy (see a list of such guidelines in Annex A). 1.3 Main objectives and principles 1.3.1 The SRP is an important and integral part of the capital adequacy framework. Its main objectives are to: • facilitate supervisory monitoring of the capital adequacy of AIs to support the risks in their business activities; • encourage AIs to enhance their risk management techniques for monitoring and controlling such risks; and

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 12 • provide the impetus for AIs to adopt more active capital planning and management practices. 1.3.2 In conducting the SRP, the MA is guided by the following principles which should help achieve the objectives outlined in para. 1.3.1: • AIs should have an internal process for assessing their overall capital adequacy in relation to their risk profile and a strategy for maintaining the required level of capital (“the first SRP principle”); • the MA has the responsibility of reviewing AIs’ internal capital adequacy assessments and determining whether the resultant capital position is adequate (“the second SRP principle”); • the MA expects AIs to operate above the BCR minimum CAR and has the power to require AIs to do so (“the third SRP principle”); and • the MA seeks to intervene at an early stage to prevent AIs’ capital from falling below prudent levels (“the fourth SRP principle”). 1.3.3 The manner in which the MA applies the four SRP principles through the legal powers conferred upon him under the Banking Ordinance is elaborated in subsection 2.2. 1.4 Implementation 1.4.1 This module will take effect on 1 January 2026. 1.4.2 Following the conduct of an SRP on an AI (normally once a year), the MA will serve one or more notices on the AI under §97F of the Banking Ordinance specifying the minimum CAR (i.e. the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio) and/or the §97F buffer level

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 13 applicable to it. The minimum CET1 capital ratio, Tier 1 capital ratio and Total capital ratio are derived by apportioning the “capital add-on” according to the method set out in subsection 3.5. Subject to any representations that may be made by an AI, the three minimum capital ratios constituting the §97F minimum CAR of the AI and any §97F buffer level will be in force from the date specified in the respective notice until otherwise advised by the MA subsequently. 1.4.3 Under the SRP, AIs (save for those falling within the exceptions in subsection 4.1.3) are expected to conduct their CAAP in line with the standards in section 4. The MA will attach increasing importance to reviewing the adequacy of an AI’s CAAP as part of the SRP taking into account that the CAAP requirement has been in place since 2007 and since that time AIs have had an opportunity to develop, refine and improve their proficiency in conducting internal capital assessment, capital planning and capital allocation. 1.4.4 The MA’s assessment of an AI’s CAAP will feed into the MA’s overall assessment of the AI’s capital adequacy, and may result in a change in the AI’s Pillar 2 capital requirement and, if significant weaknesses are observed in the AI’s CAAP, the institution of appropriate supervisory measures. 2. The MA’s approach to supervisory review 2.1 General 2.1.1 This section provides an overview of the legal backing that the MA derives from the Banking Ordinance for determining the capital requirement of AIs through the SRP under Pillar 2 (see subsection 2.2), elaborates on the operation of Pillar 2 within the capital adequacy framework (see subsection 2.3), and highlights the key components that make up the SRP (see subsection 2.4).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 14 2.1.2 Other supervisory arrangements relevant to the conduct of the SRP, including (i) its application to local banking groups and foreign bank subsidiaries; and (ii) the associated notification, representation and appeal procedures, are set out in subsections 2.6 to 2.8. 2.2 Legal framework 2.2.1 The Banking Ordinance provides the MA with sufficient powers to enforce the four SRP principles set out in subsection 1.3. 2.2.2 Under Paragraph 6 of the Seventh Schedule to the Banking Ordinance, AIs are obliged to satisfy the MA that they maintain, on and after authorization, adequate financial resources (whether actual or contingent) for the nature and scale of their operations. This provides the basis for AIs to conduct internal capital assessments under the CAAP (i.e. the first SRP principle) and the MA to review such assessments (i.e. the second SRP principle) so as to ascertain that AIs have adequate financial resources. 2.2.3 Whilst §3B of the BCR requires AIs to maintain the BCR minimum CAR, and §3G of the BCR specifies the buffer level applicable, §97F of the Banking Ordinance in empowering the MA to vary any capital requirement rule in effect enables the MA to impose a Pillar 2 capital requirement on individual AIs, based on the MA’s assessment of their capital adequacy (i.e. the third SRP principle). 2.2.4 With the implementation of the BCR buffer level starting from 1 January 2016, the MA has discontinued the imposition on AIs of specific non-statutory trigger ratios set by the MA. Nonetheless, consistent with the fourth SRP principle, AIs will be expected to ensure that they have comparable internal targets or monitoring tools so that

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 15 timely discussion with the MA can be undertaken if their capital levels fall close to the buffer zone. 2.2.5 An AI should therefore set an internal capital target for each of the CET1 capital ratio, the Tier 1 capital ratio and the Total capital ratio, taking into account the §97F minimum CAR and the buffer level (BCR buffer level or §97F buffer level) applicable to the AI, and any additional capital needs having regard to its risk profile and specific circumstances (e.g. the result of relevant stress tests). The internal capital targets, including the methodology for setting them, should be agreed with the MA. 2.2.6 The fourth SRP principle is further reinforced by §97D(1) and §97E(2) of the Banking Ordinance which respectively require an AI to (i) notify the MA immediately regarding a matter prescribed in the BCR (which may concern a failure to comply with a minimum capital requirement (and, in this regard, §3D of the BCR requires an AI to notify the MA immediately of any failure to maintain the §97F minimum CAR)); and (ii) take remedial action, as specified by the MA, to comply with the capital requirement concerned. 2.2.7 Failure of an AI to meet the statutory requirements may call into question whether the AI continues to satisfy the authorization criterion stipulated in Paragraph 6 of the Seventh Schedule to the Banking Ordinance. 2.2.8 Under §97D(3) and §97E(4) of the Banking Ordinance, every director, chief executive and manager of an AI has the legal responsibility to ensure that the AI complies with the MA’s requirements under §97D(1) and §97E(2) of the Ordinance. Such persons may commit an offence and be liable to prosecution if the AI fails to comply with the requirements. 2.2.9 Under §3J of the BCR, if an AI intends to make a distribution payment that would result in its net CET1 capital ratio being equal to or falling below its BCR buffer

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 16 level or §97F buffer level (whichever applicable), it must consult the MA and submit a capital plan to manage and improve its capital position for the MA’s approval. Under §3K of the BCR, if an AI’s net CET1 capital ratio is equal to or below its BCR buffer level or §97F buffer level (whichever applicable), it must notify the MA and provide the information specified in that section upon becoming aware of the fact, and it must notify the MA 1 month before making a distribution payment and submit a capital plan to manage and improve its capital position for the MA’s approval. When notified, the MA may request any particulars from the AI. 2.2.10 If an AI is aggrieved by the MA’s decision to vary the AI’s capital requirement under §97F of the Banking Ordinance, the AI may apply to the Review Tribunal for a review of that decision under §101B(1) of the Ordinance. 2.3 Operation of Pillar 2 under capital adequacy framework 2.3.1 From 1 January 2016, the Pillar 2 capital requirement (“P2”) is differentiated into two constituent parts: • P2A which relates to the portion of the Pillar 2 capital requirement that reflects risks not captured, or not adequately captured, in Pillar 1 (the risks involved being similar to the eight inherent risks5 identified by the MA for the purpose of risk-based supervision). This portion of the Pillar 2 capital requirement will be treated in the same way as the capital held against Pillar 1 risks and will be included in, and counted as, a constituent part of the §97F minimum CAR applicable to an AI; and • P2B which relates to the portion of the Pillar 2 capital requirement that provides a cushion of capital to bolster resilience in times of stress (and hence 5 See para. 3.2.3 for more details.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 17 should be allowed to be used in such times) without reference to specific risks considered under P2A. This part of the Pillar 2 capital requirement can therefore be regarded as akin in nature to the capital held to cover the risks sought to be addressed by the BCR buffer level and should, logically therefore (i) be constituted solely by CET1 capital (to ensure loss absorbency on a going concern basis) and (ii) not be double-counted through any overlap with the BCR buffer level. See subsection 3.4 for more details on the assessment factors underlying P2A and P2B, the rationale underlying their capital treatment, and how P2A and P2B operate alongside the BCR buffer level. Key components of capital hierarchy 2.3.2 Table 1 below illustrates the key components of the capital hierarchy (and the positioning of Pillar 2 within that hierarchy).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 18 Table 1–Key Components of Capital Hierarchy Building block Components Explanatory notes §97F minimum CAR • CET1 capital ratio (BCR minimum CAR + apportioned P2A 6 ) • Tier 1 capital ratio (BCR minimum CAR + apportioned P2A) • Total capital ratio (BCR minimum CAR + apportioned P2A) • All three minimum capital ratios (including the respective AI-specific capital add-ons) must be met at all times • P2A determines the capital add-on for the three ratios BCR buffer level or §97F buffer level (whichever applicable) • CB ratio (in CET1 capital) • CCyB ratio (in CET1 capital) • HLA ratio 7 (in CET1 capital) • Additional capital buffer (in CET1 capital) reflecting any amount of P2B in excess of the BCR buffer level • Falling below the buffer level will render AIs subject to restrictions (e.g. reducing distribution of earnings) • P2B determines whether a §97F buffer level needs to be set Order of applying CET1 capital 2.3.3 For the avoidance of doubt, the CET1 capital held by an AI must be applied in the order set out in Table 2 below, i.e. the CET1 capital will first be used to meet the three minimum capital ratios that constitute the §97F minimum CAR before the remainder can contribute to the BCR buffer level or §97F buffer level (whichever applicable). 6 See subsection 3.5 for details on the apportionment of the P2A to the three minimum capital ratios. 7 The HLA ratio is applicable to G-SIBs and D-SIBs.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 19 Table 2 – Order of Application of CET1 Capital Order Capital requirement 1 CET1 capital ratio 2 Tier 1 capital ratio 3 Total capital ratio 4 BCR buffer level or §97F buffer level (whichever applicable) 2.4 Key components of SRP 2.4.1 The SRP conducted on an AI typically consists of the following key components: • Review of the AI’s risk profile – the MA forms a view of the AI’s overall risk profile as part of the MA’s ongoing risk-based supervision, with the purpose of assessing those risk and control factors that may justify the imposition of additional capital requirements on the AI; • Review of the AI’s CAAP – for AIs that are subject to the CAAP standards set out in section 4, the MA assesses their CAAP as part of the SRP. This review includes a consideration of the assumptions, methodology, coverage and outcome of an AI’s CAAP, with a view to ascertaining the adequacy and effectiveness of the AI’s CAAP; • Determination of the AI’s §97F minimum CAR, §97F buffer level and/or other supervisory measures – the MA considers whether the AI’s existing minimum CAR and buffer level remain appropriate or need to be changed by applying the assessment framework set out in section 3 to the results and findings gathered from the above reviews. The MA may also require the AI to take other actions to rectify any

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 20 system or control deficiencies identified during the SRP. The assessment results, including any supervisory measures proposed, are subject to an independent review process described in subsection 2.8; • Communication of SRP results to the AI – after completion of the SRP, the MA discusses with the AI the results of his assessment, including any areas of concern which may lead to an increase in its minimum CAR and/or buffer level (meaning that the MA will have to propose a variation of the BCR minimum CAR8 and/or BCR buffer level of the AI under §97F of the Banking Ordinance). The MA will explain in sufficient detail the factors which have led to his assessment and recommend what actions the AI should take to address the concerns. If the MA is to invoke his §97F power to vary the AI’s BCR minimum CAR and/or BCR buffer level, the AI will be notified of the proposed variation and the grounds for variation (and given the opportunity to make representations to the MA) before a decision is finalised, pursuant to §97F of the Ordinance. A mechanism for the AI to apply to the Review Tribunal for review of the MA’s decision is also available under §101B of the Ordinance; • Ongoing monitoring of the AI’s capital adequacy – this is to monitor that the AI complies with the various regulatory capital standards and requirements applicable to it on a continuing basis. The MA updates the AI’s risk profile regularly, taking into account its progress in addressing any supervisory concerns raised or other events which may 8 For example, if the Total capital ratio of the AI is to be increased from 10% to 11% against the BCR minimum Total capital ratio of 8%, the MA will propose under §97F of the Banking Ordinance to increase the AI’s minimum Total capital ratio by 3% to 11%.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 21 significantly affect the AI’s ability to monitor and ensure compliance with the BCR. 2.4.2 The SRP is designed to generate an active dialogue with the AI concerned regarding the fulfilment of capital adequacy and risk management standards, through which the MA seeks to: • gain deeper insights into the AI’s overall control and risk management framework; • establish a closer understanding of how the AI approaches the risks that are not covered under Pillar 1 and the amount of internal capital allocated to them; • understand the mechanisms the AI has maintained for identifying, measuring, monitoring, controlling, mitigating and reporting its risks; and • assess the extent to which the AI’s CAAP, where applicable, may be relied upon as a factor to be considered in the MA’s evaluation of the AI’s capital adequacy. 2.5 Supervisory arrangements 2.5.1 The MA performs the SRP on each AI regularly (normally once a year) as part of the MA’s ongoing risk-based supervision. The scope of the SRP covers all significant business activities of the AI, whether operating locally or overseas, on a solo and/or consolidated basis. 2.5.2 When carrying out the SRP, the MA adopts a forward￾looking approach to the extent that he will take stock of any significant changes (either arising from institutional or external conditions) to the AI’s overall risk profile in the past year and assess how these changes will affect the AI and its business plans and prospects in the coming year. For this purpose, the MA takes into account the results of

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 22 any offsite reviews and onsite examinations, and makes use of any relevant information obtained from various sources such as prudential interviews, banking returns and routine supervisory contacts. 2.5.3 The MA takes a proportionate approach when applying the SRP to AIs of varying size and complexity. In other words, the frequency, intensity and depth of the SRP will be determined by the potential risk that the AI poses to the supervisory objectives of the MA. For example, the MA may subject large and sophisticated AIs to a somewhat more in-depth and comprehensive SRP than would be applied to AIs with less complex operations. The MA would not expect AIs with less complex operations to have such sophisticated risk management systems and CAAP, and hence the SRP conducted on such AIs is likely to be less intense and frequent. In categorising AIs, the MA takes account of factors such as the AI’s business nature, scale of operations (i.e. size, risk profile and complexity), history of regulatory compliance and role in the financial system or other supervisory objectives. 2.5.4 The SRP does not replicate or supplant the role of the Board and senior management of AIs. The primary responsibility for ensuring that an AI has adequate capital to support its risk profile rests squarely with its Board and senior management. 2.5.5 In evaluating overall capital adequacy, the SRP includes a review of the appropriateness of the capital requirement of an AI. The relevant minimum CAR and buffer level are to be applied on a solo basis to monitor the AI’s capital adequacy on a standalone basis, unless the MA’s prior approval is obtained for allowing the AI to consolidate some of its subsidiaries in the calculation of a solo￾consolidated CAR (i.e. the AI is not required to deduct its investment in those subsidiaries from its solo capital base) subject to the meeting of certain conditions. If the AI has one or more subsidiaries that are to be consolidated for

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 23 capital adequacy purposes under §3C and/or §3I of the BCR, the relevant minimum CAR and buffer level are also to be applied on a consolidated basis. 2.5.6 The MA may involve third parties to assist him in conducting the SRP. Under §59(2) of the Banking Ordinance, the MA has the power to require an AI, after consultation with the AI, to provide an auditors’ report on such matters as he may specify for the performance of his functions under the Ordinance. The MA may exercise this power to commission an auditors’ report when he considers that an independent assessment of the AI’s capital adequacy or risk management processes is warranted. To avoid any potential conflict of interest, the external auditor(s) appointed by the AI for the purpose of preparing this report will be approved by the MA, and the appointed auditor(s) may not necessarily be the AI’s existing auditor(s). 2.6 Application to local banking groups 2.6.1 The MA, as the home supervisor of a local banking group9 , applies the SRP to the group as a whole, and monitors the group’s capital adequacy at the consolidated level. 2.6.2 The SRP assesses all the major risks of the local banking group, whether arising from banking or non-banking activities (such as securities dealing or insurance-related business). Other risks to the group will also be captured, for example, where services such as IT, accounting, or payment and settlement functions are being provided, or control functions are being exercised, from outside the group on an outsourced basis. 9 This refers to a banking group in which the holding company of the group (or group holding company) is a locally incorporated AI.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 24 2.6.3 The MA may allow a local banking group to develop a group CAAP covering the positions of its subsidiary AIs if their capital is centrally managed at the group level. In other words, such subsidiary AIs will not be required to establish their own CAAP on a standalone basis. However, subsidiary AIs that are operating independently will still be required to develop their own CAAP. 2.6.4 The MA determines the solo and (where applicable) consolidated §97F minimum CAR and/or §97F buffer level (if applicable) for each of the locally incorporated AIs within a local banking group based on their respective risk profile. It is however not uncommon for the MA to set the same Pillar 2 capital requirement for a local banking group at both the solo and consolidated levels. This is generally reflective of the fact that the operations of a local banking group are often dominated by the AI that is the group holding company, and the risk profiles of AIs within the group are not materially different. If a local banking group does not have such characteristics, the solo and consolidated minimum CAR and buffer level applicable to AIs within the group will likely be different, depending on the MA’s assessment of their individual risk profiles. 2.6.5 As an illustration, if the group holding company of a local banking group is a retail bank with a fairly diversified risk profile but some of its significant subsidiary AIs are engaged in specialised and high risk business activities (e.g. foreign exchange and derivatives trading) with decentralised risk management systems, there may be a case for setting the solo §97F minimum CAR and §97F buffer level of those subsidiary AIs at a level higher than that for the group holding company. Whether the consolidated §97F minimum CAR and §97F buffer level of the group holding company will also be set at a higher level than its solo §97F minimum CAR and §97F buffer level depends on the impact of the operations of the subsidiary AIs on the group’s consolidated financial position.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 25 2.6.6 Where a local banking group has overseas branches or subsidiaries the activities of which are significant to the group as a whole, the MA may seek the comments of relevant host supervisors on the financial and operating soundness of those branches or subsidiaries in their jurisdictions in the course of conducting the SRP for the consolidated banking group. 2.7 Application to foreign bank subsidiaries 2.7.1 In the case of AIs which are subsidiaries of foreign banks, the MA continues to exercise his legal duty under the Banking Ordinance, through the setting of §97F minimum CAR and §97F buffer level as appropriate, to require such AIs to maintain adequate capital resources in Hong Kong. 2.7.2 The evaluation of the capital adequacy of foreign bank subsidiaries under the SRP however takes into account the strength and availability of parental support as well as other relevant information from the home supervisor of the foreign banking group. This may include, for example, the results of the home supervisor’s consolidated assessment (including an evaluation of the group CAAP or capital allocation systems and the group support of subsidiaries) of the banking systems and processes used at the group level and any developments or supervisory actions that may affect the calculation of regulatory capital requirements for the subsidiaries in Hong Kong. 2.7.3 A foreign bank subsidiary that is subject to the CAAP standards may employ the CAAP methodology of its parent bank, but will need to explain and justify to the MA how the data and methodology have been adjusted to reflect its local business strategy and the risks to which it is exposed in Hong Kong (see subsection 4.6 for more details).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 26 2.8 Review and notification of SRP results 2.8.1 The MA has established an internal mechanism for ensuring the quality, objectivity and consistency of the assessments performed under the SRP in respect of the determination of the Pillar 2 capital requirement of individual AIs and for considering representations from AIs seeking a review of the determination. An outline of the mechanism is shown in Diagram 1 below.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 27 Diagram 1 – Independent Review of SRP Results Proposal to vary AI’s BCR minimum CAR and/or BCR buffer level under §97F of Banking Ordinance after conducting the SRP Review of the proposal by the SRP Approval Committee Draft notice served on AI under §97F(2) with contents required by §97F(3)(if its BCR minimum CAR and/or BCR buffer level are to be varied) Representations from AI? Yes Consideration by the SRP Approval Review Committee No Notice under §97F(1) issued (in substantially the same terms as the draft notice if no representation or with changes to take account of representations made by AI) Yes AI’s BCR minimum CAR and/or BCR buffer level varied under §97F(1)? No Inform AI of the decision made 2.8.2 Pursuant to §97F(1) of the Banking Ordinance, the MA may vary an AI’s BCR minimum CAR and/ or BCR buffer level if he is satisfied, on reasonable grounds, that it is prudent to make the variation, taking into account the risks associated with the AI. The SRP Approval Committee and SRP Approval Review Committee

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 28 mentioned below contribute to ensuring that any variation made by the MA is in accordance with the §97F(1) requirements. 2.8.3 The mandate of the SRP Approval Committee is to review the assessments conducted on individual AIs under the SRP, and to advise the MA on the appropriateness of any proposed variation of the BCR minimum CAR and BCR buffer level as well as any supervisory measures. The Committee is chaired by an Executive Director, and includes at least two senior staff members within the Banking Departments of the HKMA who have not been involved in conducting the SRP in question. 2.8.4 The SRP Approval Committee evaluates all relevant facts and arguments in support of any proposed variation, and analyses and compares the assessment results of different AIs to ensure the consistency and quality of assessments made. Before putting forward any recommendations for the MA’s consideration, the Committee may direct the relevant supervisory team to provide additional information or carry out further work to resolve any queries or concerns raised. 2.8.5 The mandate of the SRP Approval Review Committee is to consider representations from individual AIs in respect of a proposed variation of their BCR minimum CAR and/or BCR buffer level, and to recommend to the MA whether the BCR minimum CAR and/or BCR buffer level should be so varied in the light of those representations and other relevant circumstances of each case. The Committee is chaired by a Deputy Chief Executive, and includes at least four senior staff members within the Banking Departments of the HKMA who have neither been involved in conducting the SRP in question nor in considering the SRP within the SRP Approval Committee. 2.8.6 If the MA proposes to vary the BCR minimum CAR and/or BCR buffer level of an AI, he is required under §97F of

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 29 the Banking Ordinance to serve a draft notice on the AI specifying the proposed variation and the grounds for the proposed variation. The AI will be given 14 days to make written representations following the date of service of the MA’s draft notice. If necessary, the AI may request an extension of the time limit for submitting representations. Any such request should be in writing, provide sufficient justification and be delivered to the MA within the original 14-day period. The MA may allow such extension as he considers appropriate having regard to the circumstances of each case. 2.8.7 To ensure that the Board and senior management of the AI are fully engaged in the process and have fully considered the circumstances appertaining to the AI’s BCR minimum CAR and/or BCR buffer level and the MA’s proposal to vary the same, the representations should be accompanied by a certified copy of the minutes of meeting in which the Board (or a designated committee) approved the submission of the representations. 2.8.8 The AI should set out clearly in its written representations the grounds for seeking a review of the proposed §97F minimum CAR and/or §97F buffer level, and provide all relevant facts and information that the AI wishes the MA to take into account when considering its representations. An AI may be permitted to make oral representations if the MA considers this helpful in elaborating upon the AI’s written representations. 2.8.9 As a general rule, the making of representations should not delay or impede any other supervisory actions already in progress, or affect the MA’s authority to take any other supervisory actions against the AI concerned. Under exceptional circumstances, the MA may decide that the AI should be relieved from complying with certain other supervisory actions whilst the representations are being considered.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 30 2.8.10 If the MA has not received any written representations from the AI within the 14-day period (or an extended period approved by the MA) or if, after having considered the AI’s representations and the SRP Approval Review Committee’s recommendation, the MA supports a variation of the BCR minimum CAR and/or BCR buffer level (no matter whether the variation is as originally proposed or in a revised form), the MA will, by notice in writing served on the AI, vary the AI’s BCR minimum CAR and/or BCR buffer level under §97F of the Banking Ordinance. 2.8.11 If the AI is still aggrieved by the MA’s decision to vary its BCR minimum CAR and/or BCR buffer level, it may apply to the Review Tribunal for a review of that decision under §101B of the Banking Ordinance. However, the making of an application to the Tribunal for a review of a decision does not operate to suspend the decision. 3. Supervisory review of capital adequacy 3.1 General 3.1.1 This section focuses on the major elements of the assessment framework adopted by the MA under the SRP, including (i) the key assessment factors that are considered in evaluating AIs’ capital adequacy (see subsection 3.2); (ii) the setting of AIs’ Pillar 2 capital requirement (see subsection 3.3); (iii) the differentiation between the P2A and P2B constituent parts of that requirement, and how they relate to the determination of §97F minimum CAR and §97F buffer level (see subsection 3.4); and (iv) the approach to determining AIs’ §97F minimum CAR (see subsection 3.5). 3.1.2 Conducted as part of the MA’s ongoing supervision of AIs, the SRP is closely related to the risk-based supervisory framework currently adopted by the MA. Subsection 3.6 describes their relationship and how the assessment

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 31 results under the SRP may be integrated with the risk￾based supervisory process. Also relevant to the SRP are: • the MA’s approach to using stress tests in evaluating an AI’s capital adequacy and its ability to withstand risk; • the emphasis placed by the MA on encouraging AIs to adopt international risk management standards and best practices through the issue of supervisory guidance; and • the process of monitoring AIs’ capital adequacy on a continuing basis. These aspects are respectively explained in subsections 3.7 to 3.9. 3.2 Key factors for assessing capital adequacy 3.2.1 Apart from credit, market, operational, CVA and sovereign concentration risks that are covered under Pillar 1, the SRP takes into consideration other risks faced by AIs and how well those risks are being managed by AIs. Through the SRP, the MA evaluates the extent to which an AI is required to hold more capital to cover those risks (i.e. the Pillar 2 capital requirement). This subsection serves to specify the major risk and control factors that the MA considers under the SRP and the approach to assessing the impact of such factors on an AI’s Pillar 2 capital requirement (and in turn its §97F minimum CAR and/or §97F buffer level). 3.2.2 With the risk-based supervisory approach as its foundation, the SRP has been developed to provide the MA with a comprehensive, systematic and consistent framework for determining the Pillar 2 capital requirement of individual AIs. Diagram 2 below outlines the key elements that constitute the assessment framework.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 32 Diagram 2 – Key Elements of SRP Assessment Framework Risk-based supervision Inherent risk Systems and Capital strength Corporate Risk increasing Risk mitigating controls and CAAP governance factors factors

• Default risk
• Transaction risk Other credit - Risk - Adequacy and - Corporate Examples Examples Credit risk (CRM) concentration management effectiveness governance - Specific issues - IRB / AMA
• Sovereign risk stress-testing (compliance arising from CRM capability for concentration risk capability and quality) / securitisation AIs using less
• Internal control and credit advanced
• CVA risk - Capital quality derivatives approaches system and and strength
• Equity risk environment - Residual - Insurance
• Commodity risk - Capability to modelling risk cover
• FX risk - Infrastructure to withstand risk recognisable meet business (e.g. access to - Outliers in under AMA Operational - Risk of loss - Residual needs capital market, specific risks risk from internal operational strength of - Diversification (including operations and and legal - Other support shareholders / - Other factors benefits legal risk) external events risks systems parental not already or (e.g. MIS and support, and adequately - Other factors
• Interest rate - Interest rate anti-money vulnerability dealt with under providing risk in trading risk in banking laundering to business BCR relief capital book book controls) cycle risk, etc.) minimum CAR and common Liquidity assessment risk factors Strategic risk Reputation risk Banking (Capital) Rules MINIMUM CAR / Buffer level (Note) Interest rate risk Pillar 2 capital requirement
• Liquidity risk
• Strategic risk
• Reputation risk Supervisory Assessment (through scoring system) Consideration under BCR minimum CAR Common assessment factors AI-specific assessment factors Other considerations Market risk Supervisory Assessment (case-by-case basis) Note: Effective from 1 January 2016, the Pillar 2 capital requirement is differentiated into (i) P2A, which is the capital add-on, or the portion of the §97F minimum CAR that is in excess of the BCR minimum CAR; and (ii) P2B, which determines whether the BCR buffer level of the AI needs to be increased under §97F (see subsections 3.4 and 3.5 for details).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 33 3.2.3 Central to the SRP is the MA’s assessment of the level of capital that an AI should set aside for the eight inherent risks identified for the purpose of risk-based supervision, to which all the assessment factors under the SRP can be linked. These inherent risks (see column 1 of Diagram 2), i.e. credit, market, operational (and legal), interest rate, liquidity, strategic and reputation risks, are as defined in SA-1 “Risk-based Supervisory Approach”. 3.2.4 In determining the overall risk profile and Pillar 2 capital requirement of an AI, the MA takes into account two types of assessment factors, i.e. those that are commonly applicable to all AIs (referred to as the “common assessment factors”) and those that are specific to the AI concerned (referred to as the “specific assessment factors”). Common assessment factors include those inherent risks set out in para. 3.2.5 and other assessment factors mentioned in para. 3.2.7. Specific assessment factors are explained in paras. 3.2.14 to 3.2.18 below. See also Annex B for a more detailed description of the assessment factors. Level of inherent risks 3.2.5 Out of the eight inherent risks, there are certain risks, namely, credit risk (including CCR and sovereign concentration risk), market risk, CVA risk and operational (and legal) risk, that are within the scope of Pillar 1 and hence are covered by the BCR minimum CAR (see column 2). The other inherent risks (including residual risks), as listed below, are to be assessed under the SRP (see column 3): • other credit concentration risk (as a major source of residual credit risk); • residual operational (and legal) risk; • interest rate risk in the banking book;

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 34 • liquidity risk; • strategic risk; and • reputation risk. 3.2.6 The MA assesses an AI’s level of inherent risks covered under the SRP, taking into consideration all relevant qualitative and quantitative factors, including their respective significance to the AI’s overall risk profile and the degree of potential loss that may be posed by these risks in relation to the AI’s earnings and capital. The direction of such risks (i.e. “increasing”, “stable” or “decreasing”) 10 , including those arising from new products, services or business activities, in the next 12 months is also considered. The resultant level of inherent risk is categorised as “low”, “moderate” or “high” 11 . Other common assessment factors 3.2.7 In addition to the level of inherent risks, the MA assesses an AI’s performance under the following assessment factors (see columns 4 to 6) with a view to ascertaining the AI’s ability to manage and mitigate the inherent risks: • Systems and control12 – this refers to the assessment of an AI’s overall operating soundness, including the adequacy of: 10 If the level of credit risk is “low” but the direction of this risk is “increasing”, the MA may consider whether there is a sufficient basis for increasing the level of credit risk to “moderate”. 11 By way of example, the credit concentration risk of an international bank with fairly diversified portfolios by counterparty, sector, or geographical location will likely be regarded as “low” whereas that of a domestic bank with a highly concentrated loan portfolio (e.g. with a few large or connected borrowers) will likely be regarded as “high”. 12 In assessing AIs’ systems and controls, the MA will consider whether they have taken into account climate-related risk drivers and hence covering material climate-related financial risks.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 35

• risk management systems (i.e. systems used for identifying, measuring, monitoring, controlling, mitigating and reporting the eight inherent risks);
• internal control systems and environment (including organisation structure, delegation of authority, segregation of duties, control culture, internal audit and compliance functions);
• infrastructure to meet business needs (such as IT capability, staff competence, and outsourcing); and
• other support systems (such as management information systems (“MIS”), accounting systems and anti-money laundering controls); • Capital strength and CAAP – this refers to the assessment of:
• the quality of capital held by an AI and its access to additional capital and capability to withstand economic cycles and other external risk factors (e.g. the impact of mergers/acquisitions, competition or adverse events on the AI’s operations); and
• the quality and effectiveness of an AI’s CAAP (including capital planning and longer-term capital maintenance) for managing the AI’s capital adequacy in relation to its risk profile, the loss absorbency of its capital (e.g. the sufficiency of its CET1 capital) to protect itself from insolvency, the overall environment within which the CAAP operates, as well as its compliance with the CAAP standards (for AIs that are subject to the CAAP standards set out in section 4); and

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 36 • Corporate governance – this refers to the assessment of the adequacy of an AI’s corporate governance arrangements (see also paras. 3.2.8 and 3.2.10). 3.2.8 In assessing the above factors, the MA pays particular attention to the firm-wide risk oversight exercised by the AI’s Board and senior management, including their knowledge and experience in the AI’s major business activities and risk management systems, their participation and involvement in development of the AI’s CAAP and risk management processes, and their responsiveness to risk management and control issues raised by the MA. Their willingness and ability to promote and maintain prudent remuneration policies and practices within the organisation will also be a major factor for consideration. 3.2.9 Given the uncertainties and challenges brought by climate change, it is important for the AI’s Board and senior management to ensure that the AI develops and implements a sound process for understanding and assessing potential impacts of climate-related drivers on its businesses and on the environment in which it operates, and incorporates climate-related financial risks into its overall business strategies, risk management framework and internal control framework. 3.2.10 With respect to new or complex products and activities engaged in by an AI, the MA expects senior management to understand the assumptions regarding business models, valuation and risk management practices underlying those products and activities and to evaluate the potential risk exposure if such assumptions fail. The MA also takes into account senior management’s ability to detect and rectify issues or problems arising from internal operations and to react promptly to changes in the external environment (e.g. due to competition or deterioration in macroeconomic variables) that could adversely affect the AI’s overall condition.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 37 3.2.11 In relation to the assessment of capital strength, an AI’s prospects and ability to obtain additional capital readily and the likelihood of it doing so when under stress, the capital support potentially available from the AI’s shareholders, and the obligations and commitments which the AI may have towards its subsidiaries and affiliates (if any) are relevant factors to be considered. In the case of an AI which is a banking subsidiary or a member of a banking group (local or foreign), the MA will further consider whether the AI has strong parental support and whether the parent bank or holding company has the resources to provide such support when needed. 3.2.12 In addition to an AI’s ability to maintain sufficient capital for all material risks, the MA attaches importance to the AI’s strength in operating effectively throughout a severe and prolonged period of financial market stress or an adverse credit cycle. Particularly, the MA will have regard to whether the AI’s CAAP has, through stress-testing or otherwise, addressed both short-term and long-term capital needs and considered the prudence of building excess capital over benign periods of the credit cycle to enable the AI to withstand a severe and prolonged market downturn. 3.2.13 In evaluating the above factors, the MA takes into account the business nature and scale of operations of AIs, their role in the financial system and their compliance with the supervisory standards and best practices contained in the relevant guidelines set out in Annex A. The resultant level of performance of the above factors is categorised as “strong”, “acceptable” or “weak”. 13 A “strong” 13 For example, the MA may grade an AI’s risk management systems as “strong” if the AI’s past history indicates that its risk management policies, systems and controls address all material risks and are effectively implemented. However, if subsequent supervisory findings have identified significant flaws in the AI’s risk monitoring and reporting procedures to the extent that senior management is not given accurate or adequate information to evaluate the risks faced by the AI, there may be scope for downgrading the AI’s “risk management systems” to “weak”.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 38 performance on the above factors will have a positive impact on the overall risk profile of an AI, and vice versa. Specific assessment factors 3.2.14 There are two types of specific assessment factors, i.e. risk increasing factors (see column 7) and risk mitigating factors (see column 8). They are used to cater for situations or circumstances specific to the AI concerned and which have not been dealt with, or adequately dealt with, under the BCR minimum CAR, the BCR buffer level or common assessment factors. The MA will consider these factors on a case-by-case basis, having regard to their significance to individual AIs. The use of such factors is however exceptional and subject to close scrutiny by the MA. 3.2.15 Risk increasing factors are specific factors that negatively affect the risk profile of an AI and which may hence be indicative of a need for an increase in the AI’s Pillar 2 capital requirement. Examples of such factors include: • significant “outliers” identified in the review of common assessment factors. These may relate to extremely high levels of inherent risk, substantial management or control weaknesses, or significant vulnerability to adverse economic events which warrant a full assessment of the additional capital required to cover the risks involved; • factors specific to the business and operations of individual AIs, such as risk concentrations that may arise within each type of risk or through a combination of exposures across different types of risk, and other material non-banking risks (e.g. rapid expansion in non-banking activities without proper expertise and management systems); and

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 39 • specific issues arising from the application of, or compliance with, minimum standards or requirements stipulated under the capital adequacy framework. These issues may arise from:

• residual credit risk associated with credit risk mitigation techniques, complex credit derivatives or securitization transactions;
• use of internal models under the IRB approach (including the use of its outputs for the purposes of the SEC-IRBA), IMA, IMM(CCR) approach, and value-at-risk model for calculating CCR of securities financing transactions (e.g. capital shortfall identified in stress tests, breach of qualifying criteria or certain modelling deficiencies pending rectification); or
• operational risk capital charge not commensurate with the scale and complexity of an AI’s business operations (e.g. due to forward-looking aspects of the AI’s operating losses or significant decline in earnings)14 . 3.2.16 Risk mitigating factors are specific factors that have a positive impact on an AI’s risk profile and which may hence be taken into account in considering whether there is any case for lowering the AI’s Pillar 2 capital requirement. They are used by the MA as incentives for AIs to improve their risk management so that the level of their inherent risks can be effectively mitigated. As an example, if an AI can demonstrate to the MA’s satisfaction its proficiency in managing credit or market risk by having sophisticated risk management systems comparable to those required for adopting the advanced approaches 14 This issue will be considered in the MA’s assessment of residual operational (and legal) risk under para. 3.2.5. See also subsection B2.2 of Annex B for more details.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 40 promulgated under the Basel Framework15 (even if the systems may not have been used for regulatory capital treatment in Hong Kong), the MA may recognise this as a risk mitigating factor. 3.2.17 In considering an AI’s Pillar 2 capital requirement, the MA will determine, in consultation with the AI concerned, whether there is any risk mitigating factor that can be recognised for capital adequacy purposes (although the hurdle for recognising any such factor will be high). To facilitate his assessment, the MA may require the AI to provide any such information or documentary evidence as is deemed necessary in the circumstances of the case. The MA will assess each case based on its own merits, taking into account the information provided by the AI to justify the risk mitigating effect of the factor under consideration. 3.2.18 The MA will determine the extent to which the Pillar 2 capital requirement of an AI can be increased or reduced due to the specific assessment factors, based on his assessment of the extent to which such factors can increase or mitigate the risks of the AI. Assessment approach 3.2.19 In conducting his assessment under the SRP, the MA uses a combination of techniques and tools, which include: • quantitative and qualitative assessments; • scoring of key risk factors and trends; 15 These approaches refer to the IRB approach for credit risk, the IMM(CCR) approach for CCR, value￾at-risk model for CCR of securities financing transaction, IMA for market risk and SEC-IRBA for securitization exposures.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 41 • statistical and sensitivity analyses; • stress and scenario tests; • benchmarking against industry performance; and • peer group comparisons. In particular, the common assessment factors are evaluated based on a scoring system developed by the MA whereas the specific assessment factors are separately considered by the MA on a case-by-case basis, with the other techniques and tools incorporated where appropriate. Attached at Annex C is a set of scoring worksheets which help describe the manner in which the MA uses various techniques and tools to facilitate his assessment under the SRP. AIs should however note that the scoring worksheets are subject to periodic review by the MA, and are shown here for illustrative purposes only. 3.2.20 Regardless of the approach taken, supervisory judgement is still an important element in the overall assessment. The MA may also seek the views of the external auditors of an AI and, where applicable, its home or host supervisor on particular issues affecting the AI. 3.2.21 On the basis of the assessment results, the MA will decide upon an AI’s overall risk profile (also categorised as “low”, “moderate” or “high”) to facilitate his determination of the AI’s Pillar 2 capital requirement and any other appropriate supervisory response to the AI’s condition (e.g. the scope and frequency of the next SRP or the need for any supervisory action to be taken in view of the weaknesses or deficiencies identified). 3.2.22 Diagram 3 below is an illustration of the risk profile matrix which relates an AI’s overall risk profile to the level of inherent risks of the AI (with focus on those captured

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 42 under the SRP) and its performance in other common assessment factors, i.e. systems and controls, capital strength and capability to withstand risk, CAAP (if applicable), and corporate governance. The effects of any specific assessment factors applicable to the AI will also be taken into account. Diagram 3 – Risk Profile Matrix SYSTEMS AND CONTROLS / CAPITAL STRENGTH / CAAP / CORPORATE GOVERNANCE etc. (aggregate result of assessment) STRONG ACCEPTABLE WEAK INHERENT RISK HIGH Moderate risk profile Moderate / high risk profile High risk profile MODERATE Low / moderate risk profile Moderate risk profile Moderate / high risk profile LOW Low risk profile Low / moderate risk profile Moderate risk profile 3.2.23 In order to ensure the quality and consistency of the assessments made, the MA aggregates the assessment results of individual AIs and compares the results among peer groups. The assessment results and recommendations will also be subject to the independent review procedures set out in subsection 2.8 before they are finalised. 3.2.24 The MA will discuss the assessment results in detail with individual AIs and consult with them, if a variation of their BCR minimum CAR and/or BCR buffer level are proposed, in accordance with §97F of the Banking Ordinance (see Diagram 1 under subsection 2.8).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 43 3.3 Setting of Pillar 2 capital requirement 3.3.1 The Pillar 2 capital requirement, which is generated from the assessment framework under the SRP, will form the basis for determining an AI’s §97F minimum CAR and/or §97F buffer level (see subsections 3.4 and 3.5 for details on how the determination is made). 3.3.2 Although §97F of the Banking Ordinance sets no upper limit for the variation of the capital requirement of individual AIs, the MA will continue to calibrate the Pillar 2 capital requirement under the SRP based on a maximum Pillar 2 capital requirement of 8%, which is considered appropriate in the light of past experience. The MA will, however, review the calibration from time to time to ensure that it remains suitable for the local banking sector. The MA also retains the right to impose a higher Pillar 2 capital requirement on particular AIs if this should be justified by the SRP results16. This will of course be subject to the requirements set out in §97F of the Ordinance. 3.3.3 The Pillar 2 capital requirement of an AI generally reflects the MA’s perception of its overall risk profile, taking into account all relevant assessment factors set out in subsection 3.2. The factors may have different levels of significance to different AIs, depending on their individual circumstances. For example, some AIs may be more affected by external factors whilst for others, management quality or internal controls may be the principal issues. 3.3.4 Broadly speaking, AIs are assigned with a Pillar 2 capital requirement that falls within the following bands, depending on their assessment results under the SRP: 16 For example, an AI may be assessed to be a significant outlier in some risk factors to the extent of affecting the AI’s solvency and the seriousness of the AI’s position cannot be accommodated by a maximum Pillar 2 capital requirement of 8%.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 44 Overall risk profile Pillar 2 capital requirement Low <=1% Moderate >1% - 4% High >4% - 8% However, as discussed in para. 3.3.2, it should be noted that these indicative levels will not operate to constrain the MA from imposing a higher Pillar 2 capital requirement if he is satisfied, on reasonable grounds, that it is prudent to impose such a requirement, taking into account the risks associated with the AI concerned. 3.3.5 The Pillar 2 capital requirement is to cater for the various Pillar 2 risks and uncertainties faced by an AI. In determining whether additional capital is required to cover a particular type of risk, the MA will consider the level of that risk as well as the extent to which such level of risk can be reduced by applying appropriate risk mitigating measures. For example, if an AI’s residual CCR is mainly caused by poor risk management controls, and the AI holds additional collateral from counterparties as a risk mitigating measure in the course of rectifying the CCR management weaknesses identified, the MA will have regard to the effectiveness of the risk mitigating measure (i.e. the extent to which CCR is effectively reduced by the additional collateral held by the AI) when considering whether the AI needs to hold additional capital for its CCR management weaknesses. The MA will also take into account the AI’s progress in strengthening its CCR management framework.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 45 3.4 The P2A and the P2B components of the Pillar 2 capital requirement Relationship with BCR buffer level 3.4.1 There are fundamental differences between the Pillar 2 capital requirement and the constituent elements of the BCR buffer level. 3.4.2 The calculation of capital requirements in respect of credit, market, operational, CVA and sovereign concentration risks (i.e. Pillar 1 risks) under the BCR is complemented by the SRP conducted under Pillar 2 which determines the additional capital that should be maintained by AIs to address risks not covered (e.g. interest rate risk in the banking book), or not adequately covered (e.g. credit concentration risk other than sovereign concentration risk), under Pillar 1. Such Pillar 2 risks may differ among AIs depending on their risk profiles and management systems. The requirement to hold additional capital to cover such risks not only underpins and supports those risks but also provides AIs with an impetus to improve their systems for managing specific risks. 3.4.3 In contrast, the BCR buffer level is designed to ensure that (i) AIs build up capital outside periods of stress which can be drawn down as losses are incurred (in the case of the CB ratio); (ii) the level of AIs’ capital is reinforced during periods of excessive growth or when risks are judged neither subdued nor elevated (in the case of the CCyB ratio); and (iii) negative externalities posed by G￾SIBs and D-SIBs are duly addressed (in the case of the HLA ratio). Hence, instead of addressing AI-specific risks, the BCR buffer level is intended to be a general cushion of capital above the §97F minimum CAR to be available for use during periods of stress.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 46 3.4.4 As a general principle, to the extent that the Pillar 2 capital requirement generated from the SRP reflects AI-specific risks not covered, or not adequately covered, under Pillar 1, it constitutes P2A , and this portion of the Pillar 2 capital requirement is a constituent part of the §97F minimum CAR. 3.4.5 To the extent that the Pillar 2 capital requirement generated from the SRP reflects a cushion of capital to bolster resilience generally without reference to a specific Pillar 2 risk, it constitutes P2B, by reference to which any need for a higher buffer level to be applicable to an AI over and above the BCR buffer level will be determined. Whilst a degree of overlap may exist between P2B and the components of the BCR buffer level, any such overlap will not be “double-counted” because in effect the AI’s BCR buffer level will be set-off against any P2B and only any P2B in excess of the BCR buffer level will result in the BCR buffer level being varied under §97F of the Ordinance. P2B, like the components of the BCR buffer level, should be constituted solely by CET1 capital. 3.4.6 Based on the SRP scorecards, P2B is primarily generated from the following assessment factors: • All factors assessed under “Capital Adequacy Assessment Process” (i.e. SRP scorecard C1). As the determination of the Pillar 2 capital requirement remains very much a supervisor-driven process, the requirement for additional capital in response to assessment of an AI’s CAAP largely represents a cushion to bolster resilience and a means to motivate AIs’ enhancement of their CAAP capability; and • Certain factors assessed under “Capital Strength and Capability to Withstand Risk” (i.e. SRP scorecard C2). These include (i) asset quality (which provides a cushion of capital for credit risk

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 47 covered in Pillar 1); (ii) business expansion (which provides a cushion of capital during business expansion to cater for a downturn); (iii) stress-testing (which assesses an AI’s vulnerability during stressed situations); and (iv) qualitative assessment factors (such as access to additional funding in times of need, the potential impact of redemption of subordinated debt instruments in times of stress, and strength of parental support, etc.). All such factors do not refer to an AI’s specific inherent risks, but indicate the need for some cushion of capital to bolster resilience especially during stressed periods. 3.4.7 All other assessment factors, from which P2A is generated, relate to the inherent risks to which an AI is exposed as well as to its underlying systems and controls and corporate governance arrangements for mitigating such risks, and should not result in additional capital requirements which constitute an overlap with the BCR buffer level applicable to the AI. 3.4.8 The MA does not expect P2B generated from the assessment factors referred to in para. 3.4.6 to constitute a significant portion of AIs’ Pillar 2 capital requirement. Notwithstanding any overlap with the BCR buffer level, these assessment factors will remain within the SRP as they serve to differentiate individual AIs’ performance for the purpose of assessing and monitoring overall capital adequacy, so that supervisory measures can be taken where appropriate. For example, an AI’s CAAP may fall short of the required standards, prompting the MA to require remedial action from the AI. Illustration of methodology 3.4.9 Diagram 4 below illustrates the Pillar 1 / Pillar 2 constituents of the three minimum capital ratios and the buffer level.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 48 Diagram 4 - Constituents of Minimum Capital Ratios and Buffer Level Buffer level Minimum Capital Ratios P2B in excess of the BCR buffer level, if any Components of the BCR buffer level (CB ratio, CCyB ratio and HLA ratio) P2A ( risks not captured or not adequately captured in P1) Pillar 1 (credit, market, operational risks) 3.4.10 The operation of para. 3.4.8 can be further illustrated by a mathematical example. Looking at the minimum Total capital ratio of 8% and, for illustration purposes a BCR buffer level of 2.5%, if the Pillar 2 capital requirement of an AI is 2% (with P2A and P2B being 1.5% and 0.5% respectively), the AI’s minimum Total capital ratio would be 9.5% (i.e. 8% + 1.5%) (but see subsection 3.5 regarding the apportionment of the P2A between the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio) with the P2B of 0.5% being fully “absorbed” by the BCR buffer level. 3.4.11 In most cases, P2B is expected to be less than the BCR buffer level. In exceptional cases where the P2B of an AI exceeds the BCR buffer level, the AI will be required to “top-up” the BCR buffer level to meet the P2B. For example, if the P2B of an AI is 3% and the BCR buffer level is 2.5%, the §97F buffer level of the AI will be increased from 2.5% to 3% (i.e. effectively the size of the P2B) whilst the minimum capital ratios would only include Pillar 1 and the P2A (see Diagram 5 below). The overlapping portion between the BCR buffer level and P2B is not double-counted. In such cases, the MA will have exercised the power under §97F of the Ordinance to vary the capital requirement rule with respect to the BCR buffer level so that the §97F buffer level applicable to the AI will incorporate any additional capital requirement

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 49 derived from the Pillar 2 assessment. As a result any reference to buffer level in the BCR (e.g. in relation to distribution payment requirements) should refer to the §97F buffer level. Diagram 5 - Total Capital Requirement under Different P2B scenarios 3.4.12 In cases where the P2B of an AI is relatively large compared with that of other AIs, this may be due to the AI’s relatively weaker performance under the P2B assessment factors. As a larger P2B offers greater capital relief than a smaller P2B when “absorbed” by the BCR buffer level, this might create an adverse incentive in terms of the P2B assessment factors. To counter this incentive, the MA will in any such case critically review the underlying components of the figures to determine whether and what action the AI concerned should be required to take to improve its performance under the relevant factors. 3.5 Determination of §97F minimum CAR 3.5.1 The Pillar 2 capital requirement of an AI generated from the SRP will be used to derive the capital add-on applicable to the BCR minimum CAR (i.e. the CET1 BCR buffer level P2A P1 P2A P2B P1 P2B Total capital requirement Scenario 1 BCR buffer level > P2B Scenario 2 BCR buffer level < P2B Minimum ratio requirement BCR buffer level P2B in excess of BCR buffer level Total capital requirement

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 50 capital ratio, Tier 1 capital ratio and Total capital ratio) in accordance with the apportionment approach set out below. Apportionment method 3.5.2 Only the P2A component of the Pillar 2 capital requirement will be allocated to the three minimum capital ratios (whilst the P2B component will be used to determine whether the BCR buffer level of the AI needs to be increased). The MA will allocate the P2A component to the three minimum capital ratios (i.e. the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio) on a 4.5 / 6 / 8 split. For example, assume the P2A component and P2B component of an AI are 1.5% and 0.5% respectively, its minimum capital ratios (not including the buffers) are shown below. Minimum Capital Ratios CET1 Tier 1 Total BCR minimum CAR 4.5% 6% 8% Apportioned P2A (according to 4.5 / 6 / 8 split) 0.844% 1.125% 1.500% BCR minimum CAR + Apportioned P2A 5.344% 7.125% 9.500% P2B 0.5% (not included in minimum capital ratios) 3.5.3 The above apportionment approach will necessitate that AIs closely monitor, plan for, and address any potential or resultant changes in the levels of capital required in each of the CET1 capital, Additional Tier 1 capital and Total capital ratios, whenever there is any change in the size of the Pillar 2 capital requirement.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 51 3.6 Integration with risk-based supervisory process 3.6.1 Diagram 6 below illustrates the relationship between the SRP and the risk-based supervisory process. Diagram 6 – Relationship between SRP and Risk-based Supervision Risk-based supervision Supervisory review process To assess AIs’ overall risk profile To determine §97F minimum CAR and §97F buffer level (if applicable) of AIs Board and senior management oversight Board and senior management oversight / corporate governance Risk management systems Risk management systems Comprehensive internal controls Internal control systems and environment Infrastructure to meet business needs Other support systems Inherent risks (see Diagram 2 above) Inherent risks captured by BCR minimum CAR Inherent risks captured by Pillar 2 Direction of risk capital requirement Capital strength and capability to withstand risk (including CAAP where applicable) RISK PROFILE §97F MINIMUM CAR & §97F BUFFER LEVEL (if applicable) 3.6.2 The MA’s assessment of an AI’s capital strength and capability to withstand risk (including a review of the AI’s CAAP where applicable) conducted as part of the SRP, supplements the ongoing risk-based supervisory process

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 52 by providing detailed analyses on the AI’s capital strength and earning capacity. Other considerations 3.6.3 To reduce frequent fluctuations in the regulatory capital requirement of an AI, the MA will consider whether the factors leading to a change in the Pillar 2 capital requirement are temporary in nature or require further observation. For example, if there are reasonable expectations that certain system deficiencies will be quickly rectified by an AI, the MA may consider withholding temporarily the proposed increase in Pillar 2 capital requirement pending a review of the AI’s corrective actions. Conversely, if a reduction in an AI’s Pillar 2 capital requirement is proposed in the light of the AI’s actions taken to address supervisory concerns raised by the MA, the MA may consider withholding temporarily the proposed reduction until a more comprehensive assessment of whether the improvements have been effectively implemented is completed. 3.6.4 Whilst the setting of an appropriate Pillar 2 capital requirement for individual AIs is an important aspect of the SRP, the MA recognises that capital alone is not a substitute for sound risk management and control environments. In fact, certain risks (e.g. reputation or liquidity risk) may not be adequately addressed by holding additional capital alone. A more appropriate response would be to mitigate a risk by way of adequate systems and controls, or by a combination of adequate systems and controls and additional capital and resources (e.g. a larger liquidity buffer in the case of liquidity concerns). 3.6.5 In certain circumstances (e.g. during the period in which system and control weaknesses have been identified but have yet to be fully remedied), the MA may make use of an increase in regulatory capital as a supervisory tool to focus the minds of management of an AI on the need for

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 53 improving risk management and rectifying control deficiencies. Thus, the MA may increase the AI’s Pillar 2 capital requirement temporarily and, where necessary, take other appropriate supervisory actions (e.g. requiring the AI to reduce the risk inherent in its activities, products and systems), pending corrective actions by the AI. 3.6.6 Cryptoasset activities and associated risks are relatively new and evolving. Supervisory actions for dealing with related deficiencies in capital adequacy or risk management may vary according to the circumstances. The HKMA may consider the following types of response: (i) capital add-ons; (ii) requesting provisioning for losses related to cryptoassets where such losses are foreseeable and estimable; (iii) imposing limits to contain the risks not adequately identified or assessed in the AI’s risk management framework; and (iv) other mitigation measures. 3.7 Use of stress tests Role of stress-testing under SRP 3.7.1 An important aspect of the SRP is to assess the potential vulnerability of an AI to adverse events or other external factors affecting the AI (e.g. economic cycle risk) and the need for the AI to hold additional capital for such risk. 3.7.2 In performing this assessment under the SRP, the MA will have regard to the results of stress tests conducted by an AI, which may provide useful information about the effects of “stressed” situations on the AI’s financial condition, particularly the impact on its asset quality, profitability and capital adequacy.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 54 3.7.3 Stress tests include sensitivity tests and scenario analyses. A sensitivity test typically involves shifting the values of individual risk factors (e.g. worsening of credit spreads or adverse changes in interest rates or other macroeconomic variables) and determining the effect of such changes on an AI’s business and financial positions. 3.7.4 A scenario analysis measures the combined effect of adverse movements in a wider range of risk factors affecting an AI’s business operations at the same time (e.g. an economic recession coupled with a tightening of market liquidity and declining asset prices). It involves various processes including scenario development, forecasting or estimation of stress outcomes, capital projections, and impact assessment. Stress scenarios may be derived from stochastic models or historical events, and can be developed with varying degrees of precision, depth and severity. 3.7.5 Stress tests, which supplement other risk management approaches and measures, help improve an AI’s understanding of the vulnerabilities that it faces under exceptional, but plausible, events, and provide the AI with an indication of how much capital might be needed to absorb losses if such events occur. These events can be financial, operational, legal or relate to any other risk that may have an economic impact on the AI concerned. 3.7.6 The results derived from stress tests should be regularly used by AIs in their determination of the appropriate appetite / tolerance for different types of risk, and in estimating the amount of capital that should be set aside to cover them. Stress-testing obligations on AIs 3.7.7 Under the SRP, AIs are expected to carry out regularly rigorous and forward-looking stress tests, that are appropriate to the nature of their business and the major

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 55 sources of risk faced by them, for risk management purposes. The MA assesses the effectiveness of an AI’s stress-testing programme in accordance with the general standards set out in IC-5 “Stress-testing”, and considers whether the use of stress-testing forms an integral part of the AI’s overall governance and risk management culture. The MA may challenge the key assumptions driving the stress-testing results and their continuing relevance in view of existing and potential changing market conditions. This will be done as part of his review of the AI’s risk management systems. 3.7.8 AIs should integrate relevant stress-testing results into their CAAP so as to ensure that there is sufficient capital to withstand the impact of possible adverse events or changes in market conditions on them. In his review of an AI’s CAAP, the MA takes into account the stress￾testing approach adopted by the AI (including the methodologies and assumptions used), examines the AI’s projected capital resources and capital requirements under adverse scenarios, and considers the extent to which the AI has provided for unexpected events in setting its capital level. See Annex D regarding the supervisory requirements on the application of stress tests for the assessment of capital adequacy. 3.7.9 In addition, AIs using the IRB approach to calculate credit risk, the IMA to calculate market risk, the IMM(CCR) approach to calculate CCR or value-at-risk model to calculate CCR of securities financing transactions are required to conduct respectively credit risk, market risk or CCR stress tests in compliance with the relevant minimum requirements in the BCR. The MA reviews the stress-testing results to ascertain whether AIs have sufficient capital to meet the minimum capital requirements in plausible but adverse stressed conditions.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 56 3.7.10 If the MA is not satisfied with an AI’s capital adequacy after taking into account its stress-testing results, the MA may consider increasing the AI’s Pillar 2 capital requirement and/or require the AI to reduce its risks. Where necessary, other appropriate supervisory measures may also be taken. Supervisory stress tests 3.7.11 In reviewing AIs’ capability to withstand risk, the MA conducts sector-wide stress tests regularly to assess and compare individual AIs’ vulnerability to the same set of severe market shocks or crisis situations (e.g. based on hypothetical scenarios that are similar to, or more severe than, those experienced during the 1997/1998 Asian Crisis or the 2007/2008 global financial crisis), making use of the statistical data provided by AIs or results generated from their stress tests. 3.7.12 Other stress tests will also be applied where appropriate. For example, the MA applies liquidity stress tests to retail banks based on the quarterly cash flow data submitted by them to assess their vulnerability to liquidity crises or bank-run situations when determining the level of their liquidity risk. 3.7.13 The MA will consider whether those “outlier” AIs that show significant vulnerability to “stressed” situations compared with their peers warrant a higher Pillar 2 capital requirement and/or a reduction in risk exposures. 3.8 Supervisory guidance on risk management practices 3.8.1 A key feature of the SRP lies in its emphasis on the comprehensive recognition of risk in an AI’s capital planning and management processes. Apart from requiring AIs to maintain adequate capital to support the risks associated with them, the SRP encourages them to develop and use better risk management techniques for

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 57 monitoring and controlling such risks, especially those specific risks not directly or fully addressed under Pillar 1. 3.8.2 The MA will continue to develop or enhance supervisory guidelines on risk management and control standards applicable to the SRP (see Annex A for a list of relevant supervisory guidelines) with a view to: • encouraging AIs to adopt international standards and best practices in managing their risks; • enabling them to be better prepared for meeting the relevant standards under the SRP; and • ensuring a consistent application of the standards. 3.9 Ongoing monitoring of capital adequacy 3.9.1 The MA monitors and evaluates AIs’ capital adequacy on an ongoing basis, including their compliance with the qualifying criteria for the relevant approaches adopted by them under the BCR. For example, these may relate to the use of the IRB approach for calculating credit risk, the IMA for calculating market risk, the IMM(CCR) approach for calculating CCR, the recognition of credit risk mitigation techniques for capital adequacy purposes or the eligibility of underlying exposures of securitization transactions for capital relief. 3.9.2 If an AI is found to have a continuing decline in its capital levels, the MA will require the AI to provide a capital restoration plan and the timetable for achieving the necessary capital restoration. The MA will establish an action plan to monitor the AI closely. If the AI’s capital is not maintained or restored within the specified timeframe, the MA is likely to take other supervisory actions he considers appropriate, such as restricting the AI from business expansion or limiting its business, operations or network, pending restoration of the capital to an adequate position.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 58 3.9.3 If the findings gathered from ongoing offsite reviews or onsite examinations reflect concerns about an AI’s compliance with certain qualifying criteria or conditions under the BCR, the MA may seek further explanations from the AI or conduct a more detailed examination to assess the concerns. If necessary, the MA may commission a special review under §59(2) of the Banking Ordinance. 3.9.4 As AIs have an obligation to manage their capital and ensure that it is sufficient to cover the risks undertaken by them, they are expected to maintain adequate and effective internal monitoring systems (e.g. through internal validations or audits) to ensure that their capital does not fall below prudent levels, and that they continue to meet the minimum standards and eligibility criteria required for the use of particular approaches or methodologies under the BCR. 3.9.5 The MA would expect AIs to advise him of any significant decline in capital levels or non-compliance with the standards or criteria under the BCR referred to in para. 3.9.4 (and the causes of such decline or non-compliance) and the remedial actions to be taken as soon as practicable. In the event that an AI’s capital falls below the internal capital targets agreed with the MA (see para. 2.2.5), the AI should inform the MA and set out a plan for restoring its capital position. Depending upon the circumstances and frequency with which these situations occur, the MA may regard them as indicative of system and control weaknesses. 4. Supervisory standards on CAAP 4.1 General 4.1.1 Under the SRP, AIs are expected to have a CAAP for assessing their overall capital adequacy in relation to their risk profile and a strategy for maintaining their capital

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 59 levels, unless otherwise exempted by the MA (see para. 4.1.3). The CAAP should fit their individual circumstances and needs, having regard to the risk profile and level of sophistication of their operations. The MA has the responsibility of evaluating AIs’ CAAP and their capital adequacy through the SRP, the results of which will be taken into account in determining their Pillar 2 capital requirement and, ultimately, their §97F minimum CAR and §97F buffer level (if applicable). 4.1.2 Generally, an AI’s CAAP is expected to be integrated with its capital planning process. This section sets out the MA’s approach to reviewing AIs’ CAAP, and the supervisory standards expected of the CAAP and the related capital planning process. 4.1.3 The requirements for conducting CAAP are applicable to all AIs except for the following: • AIs that have the MA’s approval for adopting the basic approach for credit risk permanently are not subject to the CAAP standards in the light of their small and simple operations. Nevertheless, they remain responsible for ensuring that there is sufficient capital to meet their business and operational needs; and • AIs that are subsidiaries of a local banking group are not required to establish their own CAAP if their capital is managed on a group basis and incorporated into the group CAAP. 4.1.4 The MA recognises that there is no single correct approach to conducting the CAAP. As such, the focus of the MA is on providing high level guidance rather than prescriptive criteria on CAAP methodologies or techniques that should be employed. This also takes into account the fact that market practices for conducting the CAAP, and the development of relevant methodologies and techniques (e.g. on how non-quantifiable risks such

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 60 as reputation and strategic risks are to be measured), continue to evolve. The onus, therefore, is on AIs to explain and demonstrate how their CAAP meets supervisory standards, and why they consider their capital targets appropriate given the scale and complexity of their business. 4.1.5 The MA assesses the reasonableness of the outcome of an AI’s CAAP in his review. Whilst the MA will not seek to reconcile precisely the §97F minimum CAR set by the MA with the outcome of the AI’s CAAP (which will likely reflect economic capital as opposed to regulatory capital), it is the case that with the greater focus under Basel III on capital of higher loss-absorbing quality (i.e. CET1 capital), the minimum CET1 capital ratio and the minimum Tier 1 capital ratio set by the MA within the §97F minimum CAR will be expected to be more comparable to the outcome of the AI’s CAAP than hitherto.17 4.1.6 AIs may have different capital adequacy goals (e.g. some may target a certain credit rating and some may seek to hold sufficient capital for long-term sustainable growth). At a minimum, the MA would expect an AI to establish a CAAP to assess the capital needed to cover all material risks (including any of those arising from climate changes18), achieve its business plan and enable it to continue to operate its business on a going concern basis (with sufficient Tier 1 capital to protect itself from 17 Generally speaking, economic capital is more concerned with shareholders’ funds than with other sources of subordinated funding (i.e. the amount of losses that can be absorbed before shareholders’ funds are exhausted) and hence is more akin to the nature of Tier 1 capital. Nevertheless, the approach to evaluating economic capital may differ among AIs depending on the capital objective or the desired level of confidence interval set. Regulatory capital goes beyond the amount needed for survival and includes Tier 2 capital (which serves as an additional protective cushion for depositors). 18 AIs should develop processes to evaluate the solvency impact of climate-related financial risks that may materialize within its capital planning horizons. They should include climate-related financial risks assessed as material over relevant time horizons that may negatively affect the AI’s capital position (i.e. through the impact on traditional risk categories) in its CAAP. As appropriate, this should include both physical and transition risks that are relevant to the AI’s business model, exposure profile and business strategy.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 61 insolvency). The CAAP should also enable an AI to measure its risks and allocate capital against such risks more precisely. 4.1.7 As mentioned in para. 1.4.4, the MA’s assessment of an AI’s CAAP will feed into the MA’s overall assessment of the AI’s capital adequacy, including the setting of the AI’s Pillar 2 capital requirement, and may result in the institution of supervisory measures if significant weaknesses are observed in the CAAP. It is therefore in the interest of AIs to enhance their CAAP capabilities on a continuing basis. 4.2 Internal control and governance Responsibilities of the board and senior management 4.2.1 The Board and senior management of an AI have the primary responsibility for ensuring that the AI has adequate capital to support its risks. At a minimum, the capital required should enable the AI to operate as a going concern and be sufficient to provide for business growth. 4.2.2 The Board and senior management should ensure that adequate and effective capital planning and management policies are established (see paras. 4.3.4 to 4.3.6 for more details). The Board and senior management should review these policies, with changes approved by the Board, at least annually or whenever such review is prompted by specific events (e.g. an opportunity for a significant acquisition has emerged), and establish additional policies where necessary, to ensure that all such internal policies are always in compliance with the applicable supervisory and regulatory requirements. 4.2.3 The Board and senior management should ensure that the AI has in place a capital plan which clearly outlines its current and future capital needs, anticipated capital expenditures, desirable capital level, external capital

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 62 sources and any capital action required. This analysis of capital requirements in relation to an AI’s strategic objectives is a vital element of the strategic capital planning process. The capital plan should be reviewed and approved by the Board or a designated committee of the Board at least annually. 4.2.4 In addition to any identified capital action(s) required (and included in the AI’s capital plan as per para. 4.2.3 above), additional potential capital actions (e.g. reducing dividend payment, issuing regulatory capital instruments and/or reducing balance sheet etc) available to preserve capital or cushion against unexpected events should also be considered and included in the AI’s capital planning and management policies and/or capital plan. 4.2.5 The Board and senior management should consider developing some guiding principles for determining the appropriateness and priority of a particular action under different scenarios, taking into account relevant considerations such as economic value added, costs and benefits and market conditions. Capital actions (required or potential) should be set out in quantified terms and any that are impractical to execute should not be included in the AI’s capital planning and management policies and/or capital plan. 4.2.6 The Board and senior management should ensure that the capital planning process is tailored to reflect the desired strategic objectives for the AI, and that all relevant staff are fully aware of the AI’s corporate goals and objectives. The Board or its designated committee should determine the principles underpinning the capital planning process. These principles may include the forward strategy for the AI, an expression of risk appetite and a perspective on striking the right balance between reinvesting capital in the AI’s operations and providing returns to shareholders. A management committee or similar body should work under the auspices of the Board or its designated

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 63 committee to guide and review the capital planning process. 4.2.7 More broadly, a sound firm-wide risk management framework is the foundation for an effective assessment of the adequacy of an AI’s capital position. The Board and senior management should ensure that such a framework is in place, enabling the AI to set its appetite and tolerance for risks, and supporting the ability of the Board and senior management to manage the AI’s risks from an integrated, firm-wide perspective and to identify and react to emerging and growing risks in a timely and effective manner. 4.2.8 To achieve a sound firm-wide risk management framework, the Board and senior management should: • have a thorough understanding of the AI’s risks on a firm-wide basis, especially the risks associated with new or complex products and activities (e.g. the risks arising from the “originate-to-distribute” business model, securitization or cryptoasset activities), and how certain risks interact with other risks19 and relate to adequate capital levels under both normal and stressed conditions; • ensure all material risks are clearly defined and addressed in the AI’s risk appetite framework; • ensure that the AI’s risk management framework includes detailed policies that set specific firm-wide prudential limits on the AI’s activities, which are consistent with its risk-taking appetite and capacity; • ensure that the infrastructure, systems and controls necessary to manage the AI’s risks are in place, and 19 See section 2.9 of the SPM module SA-1 on “Risk-based Supervisory Approach” for illustrations of how climate risk may affect AIs’ exposures to multiple inherent risks.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 64 are effective and commensurate with its overall risk profile; • ensure that accountability and lines of authority are clearly delineated and effectively communicated throughout the organisation; • provide specific guidance for the implementation of the AI’s business strategies, and monitor compliance with internal policies and limits established for managing the various types of risk associated with the AI; • establish adequate operating and control procedures to ensure that the AI is operating in compliance with regulatory capital and disclosure standards and requirements and to monitor the performance of staff in administering and controlling the capital position of the AI; and • remain adequately informed on an ongoing and timely basis about the AI’s risks as financial markets, risk management practices and the AI’s activities evolve. 4.2.9 It is important for the Board and senior management to ensure that the definition of the AI’s capital used in its CAAP is stated clearly and consistently applied, particularly as there are various definitions of capital that may be used within the banking industry. For example, some AIs may for internal purposes choose a narrow definition for capital, such as confining it to ordinary shares, whilst others may define capital more broadly. The Board and senior management should understand such differences and their implications. As the components of capital are of varying quality, have varying characteristics and do not all have the same ability to absorb losses on a going concern basis, the Board and senior management should thoroughly comprehend the relationship between the AI’s capital definition and its

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 65 assessment of capital adequacy. Any changes in the AI’s internal definition of capital and the reason for those changes should be properly documented. 4.2.10 The Board and senior management should also ensure that the AI’s capital policy, CAAP and escalation protocols (see also para. 4.2.16) are working in tandem and consistently with an appropriate risk reporting and stress testing framework. 4.2.11 Failure to adhere to the above requirements may call into question whether the Board and senior management have adequately discharged their responsibility under para. 4.2.1. Internal controls and audits 4.2.12 There should be a process of internal controls, independent reviews and audits to ensure the adequacy, effectiveness and reliability of the CAAP and the overall capital planning process, and to monitor the actual performance against the approved capital goals and targets as well as the conformity with the strategy and objectives stated in the CAAP. The frequency of the independent reviews and audits may vary depending on the size and complexity of individual AIs but should not be less than once every year. 4.2.13 The CAAP and risk management process should be subject to periodic reviews to ensure their integrity, accuracy and reasonableness. Areas that should be reviewed include: • the appropriateness of risk appetite / tolerance levels and capital planning, the effectiveness of the CAAP, and the strength of internal control infrastructure given the nature, scope and complexity of the AI’s business;

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 66 • where applicable, the appropriateness and validity of third-party inputs or other tools used for management information purposes (e.g. credit ratings, risk measures and models); • the identification of large exposures and risk concentrations; • the accuracy and completeness of data input into the AI’s assessment process; • the reasonableness and validity of scenarios used in the assessment process; and • the use of stress-testing, including an analysis of the underlying assumptions and inputs. 4.2.14 All deficiencies and weaknesses identified in the CAAP, as well as any non-compliance with approved internal policies and management guidelines on capital adequacy or the BCR, must be promptly reported to the Board and senior management for early rectification. 4.2.15 Special attention should be paid to reviewing those areas of the CAAP that may be affected by changes in the operational or business environment, such as the introduction of new products and activities. 4.2.16 The AI’s capital planning process and CAAP should produce a consistent and coherent view of its current and future capital needs, after incorporating inputs from relevant units of the AI in respect of the AI’s current strategy, the risks associated with that strategy and an assessment of how those risks contribute to capital needs as measured by internal and regulatory standards. In the case where assumptions are made by different units and they relate to the units’ capital needs which have to be allocated centrally, there should be formal processes in place to escalate competing assumptions made and

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 67 differences in capital allocation across different units of the AI for discussion and approval by senior management. 4.3 Key elements of CAAP General 4.3.1 AIs are expected to develop a CAAP that is: • comprehensive in terms of the identification and measurement of the risks associated with an AI’s business and the assessment of how much capital is needed to support these risks; • risk-based and forward-looking, with emphasis on the importance of capital planning, management and other qualitative aspects of risk management and controls, and takes into account the AI’s strategic plans and how these relate to macroeconomic factors; • integrated into the management process and decision-making culture of the AI. For more sophisticated AIs, the CAAP should be integrated into their day-to-day management process. For example, in addition to allocation of capital to business units, the CAAP would likely play a part in making credit decisions or other general business decisions (e.g. expansion plans and budgets). The results of the CAAP may also feed into the process of determining business strategies and risk appetite / tolerance levels. Although smaller AIs tend to have less sophisticated capital planning and assessment systems, their CAAP should at least produce results that enable the ongoing assessment and management of their risk profile (e.g. the results may influence their lending behaviour or use of risk mitigants) and inform the setting of risk appetite / tolerance; and

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 68 • capable of producing a reasonable outcome on the overall level of capital required and the assessment supporting such outcome. 4.3.2 The CAAP should capture all material risks of an AI, including the eight inherent risks covered under the MA’s risk-based supervisory framework, and the interactions of these risks under both normal and stressed conditions. The overall environment within which the CAAP should operate is also important. AIs should, in particular, be able to identify other external risk factors that may arise from the regulatory, economic or business environment, including any emerging risks like climate-related financial risk. In addition, adequate corporate governance and proper risk management and internal control arrangements constitute the foundation of an effective CAAP. 4.3.3 The basic elements of a sound CAAP should include: • policies and procedures to identify, measure, monitor, control, and report the risks inherent in an AI’s activities; • a process to relate the AI’s internal capital to its risks; • a process to state the AI’s capital adequacy goals in relation to risks, taking into account its strategic focus and business plan; and • a process of internal controls, independent reviews and audits to ensure the integrity of the overall management process. Capital planning and management policies 4.3.4 It is likewise important that internal policies are in place for capital planning and management purposes and meet the

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 69 standards and criteria required in the relevant supervisory guidelines (see Annex A for more details). 4.3.5 An AI should have a capital policy that will allow the AI to maintain ready access to funding, meet its obligations and continue its business during and after a stressful scenario. At a minimum, such a capital policy should include: • the approach for determining the AI’s overall capital adequacy having regard to its risk profile and risk tolerance as approved by the Board and the senior management; • the AI’s short-term and long-term capital adequacy goals in relation to its risk profile, taking into account its strategic focus and business plan; • the approved capital targets that are consistent with the AI’s overall risk profile and financial position; • the monitoring framework and relevant minimum thresholds and triggers (referencing a suite of capital￾and performance-based indicators) for senior management’s attention and action; and • the range of strategies that can be employed to address anticipated and unanticipated capital shortfalls and measures that would be taken in the event capital falls below a targeted level. 4.3.6 Other management policies should be in place to supplement the capital policy in relation to: • firm-wide risk management, which takes into account all material risks (both quantifiable and non-

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 70 quantifiable)20 as well as risks that do not appear to be significant in isolation, but when combined with other risks could lead to material losses or consequences21; • stress-testing, which should adequately address economic cycle risk and any emerging risks like climate-related financial risks for the assessment and planning period, and measure the AI’s ability to withstand adverse conditions (see subsection 3.7 for more details); • valuation practices, which should apply to all positions (including complex, structured products and financial instruments) that are measured at fair value and cover different circumstances, especially during times of stress; • remuneration systems, which should consider risk￾adjusted performance measures and focus on achieving longer-term capital preservation and financial strength rather than focusing on, and thereby potentially encouraging, the generation of short-term accounting profits; • dividend payout, which should neither hinder the AI from capital formation to support business growth nor weaken its capital position or financial soundness; • provisioning levels and provisioning methodology, which should ensure that the level of provisions 20 Apart from the eight inherent risks identified for the purpose of risk-based supervision, the impact of climate on the inherent risks, and other material risks, such as those posed by concentrations, securitization, and off-balance sheet exposures that are relevant to the AI, should also be considered. 21 For example, the direct loss of an AI arising from an operational risk event (e.g. loss of confidential customer data) may be limited in itself. However, if this event affects a large number of customers and attracts substantial adverse market publicity, there may be significant damage to the AI’s reputation, apart from the potential claims for damages filed by the customers and other regulatory consequences for the AI for breaching data privacy rules and client confidentiality obligations.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 71 established and maintained by the AI is adequate to absorb estimated losses inherent in the AI’s asset portfolios, binding commitments and contingent liabilities; and • income recognition and associated methodology, which should, among other things, clearly define under what situations the AI can or cannot recognise income and set out the details of the methodologies adopted. Risk management policies and procedures 4.3.7 The policies and procedures to identify, measure, monitor, control, and report the risks inherent in an AI’s activities should meet the following standards: • risk measurement systems should be sufficiently comprehensive and rigorous to capture the nature and magnitude of the risks faced by the AI, whilst differentiating risk exposures consistently among risk categories and levels of riskiness. Such systems should also be capable of performing risk data aggregation22 across different risk types or business lines; • adequate controls should be in place to ensure the objectivity and consistency of risk identification and measurement and that all material risks (both on- and off-balance sheet) are adequately addressed; 22 Risk data aggregation means defining, gathering and processing risk data according to the AI’s reporting requirements to enable the AI to measure its performance against its risk tolerance/appetite. The relevant guidance on risk data aggregation is set out in section 5.2 of the SPM module IC-1 on “Risk Management Framework”. An effective CAAP should use risk data aggregation techniques to estimate the amount of capital required, regardless of whether or not the AI uses risk-modelling techniques to assess capital adequacy. If an AI uses risk-modelling techniques to assess capital adequacy, the AI should comply with the additional requirements set out in subsection 4.4.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 72 • all material risks, which can include emerging risks like climate-related financial risks, should be considered; • detailed analyses should be conducted to support the accuracy or appropriateness of the risk measurement techniques used; • limitations of risk quantification and measurement methods should be identified and understood through appropriate processes; • inputs used in risk measurement should be of good quality; • those risks that are not easily quantifiable should be evaluated using qualitative assessment and management judgement. Nevertheless, AIs should recognise the biases and assumptions embedded in, and the limitations of, the qualitative approaches used, with a view to ensuring that the potential impact of the relevant risk is not underestimated; • the economic substance of risk exposures, including reputation risk and valuation uncertainty, should be fully recognised and incorporated into the risk management process; • changes in the AI’s risk profile should be promptly incorporated into risk measures, whether the changes are due to new products or new businesses, increased volumes, changes in concentrations, the quality of the portfolio or the overall economic environment; • when measuring risks, comprehensive and rigorous stress tests should be performed to identify possible events or market changes that could have serious adverse effects or significant impact on the AI’s

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 73 capital and operations (see Annex D for more details); • clear links between capital and liquidity monitoring should be established23; and • adequate consideration should be given to contingent exposures arising from loan commitments, securitization and other transactions or activities that may create such exposures (see Annex E for more details). 4.3.8 To facilitate firm-wide risk management and oversight, AIs should have in place appropriate infrastructure and MIS that contain, at a minimum, the following key elements: For aggregation of risks • allow for the aggregation of exposures and risk measures across business lines and platforms (including the banking and trading books) in managing risks and monitoring limits; • support customised identification of concentrations and emerging risks; • support the ability to evaluate the impact of various types of economic and financial shocks that affect the whole organisation; • offer sufficient flexibility to incorporate hedging and other risk mitigating actions to be carried out on a firm-wide basis whilst taking into account the various related basis risks; 23 For instance, the capital position of an AI can have an effect on its ability to obtain liquidity, especially in times of stress. An AI should evaluate its capital adequacy with regard to its liquidity profile and the liquidity of the markets in which it operates, and have a mechanism in place to trigger any necessary action should circumstances warrant.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 74 To enable proactive risk management • should be capable of providing regular, accurate and timely information on the AI’s aggregate risk profile as well as the main assumptions used for risk aggregation; • should be adaptable and responsive to changes in the AI’s underlying risk assumptions; • should incorporate multiple perspectives of risk exposure to account for uncertainties in risk measurement; and • should be sufficiently flexible so that the AI can generate forward-looking firm-wide scenario analyses that capture management’s interpretation of evolving market conditions and stressed conditions. 4.3.9 If AIs use third-party inputs or other tools (e.g. credit ratings, risk measures and models, etc.) to produce risk management information, they should have adequate procedures in place to ensure that such inputs and tools are subject to initial and ongoing validation. 4.3.10 If AIs employ risk mitigating techniques, they should understand the risk to be mitigated and the potential effects of that mitigation (including its enforceability and effectiveness), and have in place appropriate policies and procedures to control risks associated with these techniques (see subsection B6.2 under Annex B for more details). 4.3.11 AIs should understand that it is often difficult to quantify measurement errors that may exist in risk measurement. As a result, the level of capital maintained should cater for an increase in uncertainty related to modelling and business complexity. AIs should suitably account for measurement errors when calculating capital

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 75 requirements, and be able to demonstrate the adequacy of capital to address such errors. 4.3.12 AIs conducting risk aggregation among various risk types or business lines should understand the challenges in such aggregation. They should seek to address any potential concentrations across more than one risk dimension, recognising that losses could arise in several risk dimensions at the same time, stemming from the same event or a common set of factors. For example, a localised natural disaster could generate losses from credit, market and operational risks at the same time. (See Annex F for more details.) Internal capital allocation process 4.3.13 The process of relating an AI’s internal capital to its risks should meet the following requirements: • the amount of capital held should reflect not only the measured amount of risk but also an additional amount to account for potential uncertainties in risk measurement (e.g. measurement error or modelling risk) (see also para. 4.3.11); • the AI’s capital should reflect the perceived level of precision in the risk measures used, the potential volatility of exposures and the relative importance of the activities producing the risk; • capital levels should reflect the fact that historical correlation among exposures can change rapidly; and • the AI should be able to demonstrate that its approach to relating capital to risk is conceptually sound and that outputs and results are reasonable.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 76 Setting of capital adequacy goals 4.3.14 There should be a process to state the AI’s capital adequacy goals in relation to risks, taking into account its strategic focus and business plan: • explicit goals and targets need to be established for evaluating the AI’s capital adequacy with respect to its risks; • the AI should develop an internal strategy for maintaining capital levels which should not only reflect the desired level of risk coverage but also incorporate factors such as loan growth expectations, future sources and uses of funds, and dividend policy. There may be other considerations that the AI considers relevant or important in determining how much capital it should hold (e.g. external rating goals, market image, strategic goals, etc.). If these other considerations are included in the CAAP, the AI will be required to show how the considerations have influenced its decisions concerning the amount of capital to be held; • the AI’s approved capital plan should state its objectives and time horizon for achieving them, and set out in broad terms the capital planning process and the responsibilities for that process. The capital plan should recognise that accommodating additional capital needs requires significant lead time, and take into account the potential difficulties of raising additional capital during downturns or other times of stress. It should also set out how the AI will comply with regulatory capital requirements, any relevant limits related to capital, and a general contingency plan for dealing with divergences and unexpected events (e.g. raising additional capital, restricting business activities or using risk mitigating techniques for risk management purposes, etc.);

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 77 • the AI should obtain a forward-looking view on the AI’s capital adequacy through stress-tests and scenario analyses. The AI should conduct stress tests that take into account the risks of the environment and the prevailing stage of the economic cycle in which it is operating, to assess the impact of possible adverse events or scenarios on its capital. The AI should analyse what impact new legislation or competitors’ actions may have on its performance, in order to ascertain what changes in the environment it could sustain. The requirements and scenarios for stress-testing should be proportionate to the nature, size, risk profile and complexity of the AI’s business activities. Most importantly, the AI should aim at attaining a capital level that can withstand the stressed conditions in all the relevant stress tests (e.g. the supervisor-driven stress tests and other relevant stress tests conducted by the AI, and supervisory top-down solvency stress tests conducted by the MA, as applicable). • the AI should evaluate whether its long-run capital targets might differ from its short-run goals, based on current and planned changes in its risk profile and the lead time for raising new capital; • it is not necessary for the AI to use formal economic capital models for setting capital goals and targets and assessing its capital adequacy, although it is expected that more sophisticated AIs will elect to do so (in which case the additional criteria set out in subsection 4.4 have to be satisfied); • the capital goals and targets should be reviewed and approved by the Board or designated committee of the Board regularly (at least annually) to ensure their appropriateness; and

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 78 • appropriate adjustments to the CAAP should be promptly initiated if changes in the business, strategy or operational environment suggest that the CAAP is no longer adequate. 4.3.15 AIs should recognise that the §97F minimum CAR imposed on an AI represents a regulatory floor requirement below which the AI’s overall capital level must not fall, even if the AI’s management believes that a lower capital level is justified. 4.3.16 AIs should ensure that adequate capital is held against all material risks not just at a point in time, but over time, to account for changes in their strategic direction, evolving economic conditions and volatility in the financial environment. Design of CAAP 4.3.17 AIs may design their CAAP in different ways to cater for their individual needs and circumstances. The following are some options that AIs may have reference to: • using the BCR minimum CAR as a starting point and adding considerations which are not captured, or not adequately captured, by the BCR minimum CAR. For many small and less complex AIs, a relatively simple CAAP is entirely acceptable. One possibility might be to base their CAAP primarily on the methodology set out in the BCR, supplemented as necessary for any other generic factors which have a particular bearing on their risk profile (e.g. in terms of size, sector or products). For example, to obtain a capital goal, an AI may simply take the BCR minimum CAR and adjust it with a self-determined “capital surcharge”24 24 The term “capital surcharge” referred to in para. 4.3.17 covers the situation in which an AI determines the additional capital it should maintain on top of the BCR minimum CAR based on its own internal capital assessment.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 79 which is calibrated from elements outside the consideration of the BCR minimum CAR and from other forward-looking elements (including the effect of stressed conditions). The AI should be able to demonstrate that it has adequately analysed all material risks outside the BCR minimum CAR and found that all such risks were covered by the “capital surcharge”; • using different methodologies for different risk types (including all risks captured by the BCR minimum CAR and the self-determined “capital surcharge”) and then calculating a simple sum of the resulting capital “needs”; • using a more sophisticated and complex system, e.g. “bottom-up” transaction-based approaches with integrated correlations; or • using a combination of the above. 4.3.18 AIs should ensure that decisions regarding the design and operation of the CAAP should not be unduly influenced by competing business objectives. 4.3.19 AIs should enhance and refine their CAAP over time, taking into account changes in their risk profile and activities as well as advances in risk measurement and management practices. Documentation of CAAP 4.3.20 AIs should have complete documentation covering the CAAP. Such documentation should at least include: • a description of the overall process; • all related policies and management guidelines;

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 80 • all committees and individuals involved in the CAAP, including their responsibilities; • the methodologies, assumptions and procedures used in the CAAP, covering all aspects ordinarily expected for the sound use of quantitative methods, including model selection, limitations, data selection and maintenance, controls and validation; • the frequency of CAAP-related reporting; and • the procedures for the periodic evaluation of the appropriateness and adequacy of the CAAP. 4.3.21 The documentation of the CAAP should be subject to periodic review and approval by the Board (at least annually). 4.3.22 The CAAP and related policies, management guidelines and procedures should be communicated and implemented firm-wide and supported by sufficient authority and resources. 4.4 Additional criteria for use of risk-modelling techniques 4.4.1 Larger and more sophisticated AIs may prefer using risk￾modelling techniques (e.g. economic capital or other models) to perform risk aggregation and to assess capital adequacy within a certain degree of confidence. Nevertheless, this approach is not mandatory. 4.4.2 AIs using risk-modelling techniques to assess capital adequacy should ensure that their CAAP is a comprehensive process seeking to identify their capital needs on the basis of both quantifiable and non￾quantifiable risks. AIs should not rely on quantitative methods alone to assess capital adequacy. Non￾quantifiable risks, if material, should also be included using qualitative assessment and management

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 81 judgement. For example, in modelling the potential consequences of individual risks, account needs to be taken not only of the immediate direct profit and loss impact of possible loss events, but also of their potential consequential cost in terms of damage to AIs’ reputation and future earning capacity. 4.4.3 Under no circumstances should the CAAP be a process which focuses only narrowly on the calculation and use of allocated capital or economic value added for individual products or business lines for internal profitability analysis. This approach can be important to an AI in targeting activities for future growth or retrenchment. However, the AI is required to first determine (by whatever methods are deemed most appropriate to the AI’s circumstances) the amount of capital necessary for each activity or business line as a tool for evaluating the overall capital adequacy of the AI. Thus, the process for determining the necessary capital should not be confused with the related management efforts to measure relative returns of the AI or of individual business lines, given an amount of capital already invested or allocated. 4.4.4 AIs must have in place adequate policies, controls and procedures to validate, on a regular basis, the methodology and data and the robustness of the systems and processes involved in modelling the probabilities of occurrence, and the potential consequences of individual risks and their aggregation. Such policies, controls and procedures should be appropriate for their nature of business and level of sophistication, as well as the relative importance of each component of the CAAP. The internal validation process should encompass, but should not be limited to, the collection and review of developmental evidence, process verification, benchmarking, outcomes analysis, and monitoring activities used to confirm that processes are operating as designed. AIs should also be able to demonstrate that their validation process is

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 82 adequate to enable them to assess the performance of the risk-modelling techniques consistently and meaningfully. 4.4.5 The MA will assess whether the overall assessment and validation processes are commensurate with the nature, size and complexity of the AI’s business and whether the outcomes generated from the processes are reasonable. The MA will also assess the extent to which the risk￾modelling techniques, and the risk-adjusted performance measurement they support, are actually employed in managing the AI’s business. Obviously it will be difficult to assign much credibility to a model in respect of which an AI lacks either the confidence, or the perceived need, to use it for the purpose of making its business decisions. 4.5 Requirements for consolidated capital 4.5.1 AIs are required to conduct their CAAP on a consolidated basis if they have any subsidiary that is subject to §3C of the BCR. 4.5.2 AIs conducting their CAAP at the group level should ensure that their consolidated capital is adequate to: • support the volume and risk characteristics of all parent and subsidiary activities; and • provide a sufficient cushion to absorb potential losses arising from such activities. 4.5.3 AIs should also be able to demonstrate to the satisfaction of the MA that: • their CAAP has been conducted on a consolidated basis and the total capital estimated as appropriate for the group has been allocated to each group member, according to their risk profile;

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 83 • all group members, including the AI itself, have fully evaluated the risks they face (including reputation risk arising from the failure of another group member, and the risks they face due to exposure to, or dependence on, other group members); • capital is freely transferable within the group (even in situations where the group is under financial stress, especially in relation to the group’s cross-border operations where jurisdictional issues come into play); and • in case there is capital that is not, or that is unlikely to be, freely transferable between legal entities within the group, the CAAP has been adjusted to exclude such capital from the consolidated capital adequacy assessment. 4.5.4 In assessing the capital adequacy of the consolidated position, the MA will apply the same standards and requirements as he applies for assessing the capital adequacy of an AI on a solo basis. 4.6 Application to subsidiary AIs 4.6.1 Unless otherwise specified in paras. 2.6.325 and 4.6.2, all subsidiary AIs are required to ensure that they are adequately capitalised on a stand-alone basis and have their own CAAP, commensurate with, and proportionate to, the nature, size and complexity of their business in Hong Kong, for supervisory review purposes. The MA will continue to exercise his legal duty under the Banking Ordinance to monitor their capital adequacy and their compliance with the BCR through the SRP. 25 Under para. 2.6.3, a local banking group may develop a group CAAP covering the positions of its subsidiary AIs if their capital is centrally managed at the group level.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 84 4.6.2 Where appropriate, subsidiary AIs of a foreign banking group may adopt the CAAP methodology used by their parent bank at the group level or, if their capital is centrally managed at the group level, rely on the group CAAP for assessing their capital adequacy. This is on the basis that the group CAAP is conducted in accordance with supervisory standards and criteria that are comparable with those required by the MA, and that the CAAP outcome for the subsidiary AIs has taken into account their local business strategies and associated risks. 4.6.3 Any foreign-owned subsidiary AIs that apply the group CAAP for assessing their capital adequacy should be able to explain and demonstrate to the satisfaction of the MA how the capital assessment or allocation is made and how the assessment process meets supervisory standards and criteria comparable to those of the MA. They have the primary responsibility for providing the MA with any information, documentation and evidence that he may require for conducting the SRP. For example, the MA may require a subsidiary AI to provide an independent review or audit report in relation to the adequacy and integrity of the overall assessment process and/or the validity of the models used for the assessment. 4.6.4 If a foreign-owned subsidiary AI is unable to satisfy the above-mentioned criteria, the AI will be required to establish and maintain its own CAAP in Hong Kong to meet the MA’s supervisory standards. 4.6.5 In reviewing the capital adequacy of foreign-owned subsidiary AIs, the MA will also take into account the strength and availability of parental support and other relevant input from the home supervisor. For example, the MA may request the home supervisor to provide information and comments in respect of the capital adequacy of the parent bank or the results of its evaluation of the group CAAP systems.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 85 4.6.6 The Board and senior management of subsidiary AIs should note that their responsibility as mentioned in para. 4.2.1 remains unchanged irrespective of whether a group CAAP methodology is adopted by a subsidiary AI. 4.7 Review by the MA 4.7.1 In reviewing and evaluating an AI’s CAAP, the MA will have regard to the supervisory standards set out in this section. Key factors to be considered include: • the soundness of the overall CAAP given the nature and scale of the AI’s business activities; • the degree of management involvement in the process, for example, whether the target and actual capital levels are properly monitored and reviewed by the Board (or a designated committee) and senior management; • the extent to which the internal capital assessment is used routinely within the AI for decision-making purposes; • the extent to which the AI has provided for unexpected events in setting capital levels; and • the reasonableness of the outcome of the CAAP in terms of whether: − the amount of capital required as demonstrated by the CAAP is sufficient to support the risks faced by the AI; − whether the levels and composition of capital chosen by the AI are comprehensive, relevant to the current operating environment, appropriate for the nature and scale of the AI’s business activities and can withstand stressed scenarios in all the relevant stress tests (e.g. the

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 86 supervisor-driven stress tests and other relevant stress tests conducted by the AI, and supervisory top-down solvency stress tests conducted by the MA, as applicable); and • the appropriateness and comprehensiveness of the potential capital actions identified in the CAAP to address any capital shortfall. 4.7.2 AIs should be able to explain and demonstrate to the satisfaction of the MA: • how their CAAP meets supervisory requirements; • how their material risks are defined, categorised and measured (if their own terminology is adopted), and how their approach relates to their obligations under the BCR; and • how the internal capital targets are determined and how these targets are consistent with their overall risk profile and the current operating environment as well as current and planned business needs. AIs are also expected to explain the similarities and differences between the level of capital calculated under their CAAP and their regulatory capital requirements. 4.7.3 The MA expects that AIs with complex operations should have a more structured and well-defined risk management framework to monitor the effectiveness of internal control processes and risk exposures in comparison to AIs with simple organisational structures and less complex operations and activities, for which a less sophisticated firm-wide risk management framework may be more appropriate. 4.7.4 In assessing whether AIs have sufficient capital to enable them to continue to operate their business on a going

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 87 concern basis, the MA will place particular importance on, among other things, the capacity of an AI’s capital structure to absorb losses and how this structure could be adversely affected by changes in performance26. The MA recognises that Tier 1 capital is an important component of an AI’s capital structure because it allows AIs to absorb losses on an ongoing basis and is permanently available for this purpose. It also allows AIs to conserve resources when they are under stress as AIs have discretion as to the amount and timing of dividends and other distributions 27 . Therefore, AIs should determine the optimal level of Tier 1 (in particular CET1 capital) and Tier 2 capital to be maintained to meet their capital goals. AIs should also note that the capital structure implied by the BCR minimum CAR is only a minimum standard. AIs should attach more weight to CET1 and Tier 1 capital components in their capital structure if it is prudent to do so. 4.7.5 If an AI’s CAAP does not meaningfully link the identification, evaluation and monitoring of the risks that arise from the AI’s business activities to the determination of its capital needs, the MA will require the AI to improve the CAAP for better integration with internal risk measurement and analysis. The MA will monitor the progress made by the AI in implementing the corrective actions. 4.7.6 Where the amount of capital which the MA considers that the AI should hold is not the same as that generated from 26 For example, an AI experiencing a net operating loss (perhaps due to realisation of unexpected losses) will not only face a reduction in its retained earnings but also possible constraints on its access to capital markets. These constraints could be exacerbated if detrimental conversion options are exercised. These adverse effects could be further accentuated if adverse events take place at critical junctures for raising or maintaining capital (e.g. as term capital instruments are approaching maturity or new capital instruments are being issued). 27 In fact, the Basel III capital framework has leveraged on this characteristic and imposed earnings conservation requirements for banks to observe when their capital level falls within the capital buffer range. This is reflected in the Part 1B Division 2 of the BCR.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 88 the AI’s CAAP (particularly where the amount of capital generated is lower than that expected by the MA), the MA will discuss the difference with the AI. The MA will take into consideration the results of the CAAP and any explanations from the AI in relation to the outcome and appropriateness of the CAAP when determining the Pillar 2 capital requirement. 4.7.7 To facilitate his review, the MA will ask for information such as the results of an AI’s CAAP, together with an explanation of the process used. The MA will require the AI to provide information not only on the amount of capital it considers appropriate, but also on the composition of that capital. In the case of a group CAAP, there should be a breakdown of group capital so as to facilitate evaluation of the extent to which diversification benefits have been incorporated into the underlying assumptions. 4.7.8 The MA may seek other additional information from the AI where necessary. ————————— Contents Glossary Home Introduction

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 89 Annex A: List of major supervisory guidelines applicable to assessment of capital adequacy A1 Introduction A1.1 This annex sets out the major supervisory guidelines applicable to the assessment of AIs’ capital adequacy under the SRP. The MA will have regard to AIs’ compliance with the relevant supervisory standards and best practices contained in these guidelines (particularly in relation to systems and controls and corporate governance) when considering the impact of various assessment factors on an AI’s capital adequacy. A1.2 This list is provided for AIs’ reference only, and should not be regarded as a complete and exhaustive list. With a view to promoting the adoption of international standards and best practices within the banking sector, the MA will continue to issue new, and update existing, supervisory guidelines to provide guidance to AIs on various risk and control factors covered under the SRP. A1.3 AIs should refer to the Supervisory Policy Manual and other guidelines and circulars issued by the MA for a complete set of supervisory guidelines issued to the banking industry. A2 Guidelines under Supervisory Policy Manual by subject Supervisory approach SA-1 Risk-based supervisory approach SA-2 Outsourcing Corporate governance CG-1 Corporate governance of locally incorporated authorized institutions CG-2 Systems of control for the appointment of managers CG-3 Code of conduct CG-5 Guideline on a sound remuneration system

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 90 CG-6 Competence and ethical behaviour Internal controls IC-1 Risk management framework IC-2 Internal audit function IC-4 Complaints handling and redress IC-5 Stress-testing IC-6 The sharing and use of consumer credit data through credit reference agencies IC-7 The sharing and use of commercial credit data through a commercial credit reference agency Capital adequacy CA-G-1 Overview of capital adequacy regime for locally incorporated authorized institutions CA-G-4 Validating risk rating systems under the IRB approach CA-S-4 Capital adequacy requirements for investment guarantees under mandatory provident fund schemes CA-S-5 Use of internal models to measure market risks for investment guarantees under MPF schemes CA-S-10 Fair value practices CA-B-1 Countercyclical Capital Buffer (CCyB) – Approach to its implementation CA-B-2 Systemically important banks CA-B-3 Countercyclical Capital Buffer (CCyB) – Geographic allocation of private sector credit exposures Consolidated supervision CS-1 Group-wide approach to supervision of locally incorporated authorized institutions

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 91 Credit risk management Risk management CR-G-1 General principles of credit risk management CR-G-2 Credit approval, review and records CR-G-3 Credit administration, measurement and monitoring CR-G-5 Country risk management CR-G-6 Interest recognition CR-G-7 Collateral and guarantees CR-G-8 Large exposures and risk concentrations CR-G-9 Exposures to connected parties CR-G-10 Problem credit management CR-G-12 Credit risk transfer activities CR-G-13 Counterparty credit risk management Specific lending activities CR-S-2 Syndicated lending CR-S-4 New share subscription and share margin financing CR-S-5 Credit card business Cryptoassets CRP-1 Classification of cryptoassets Interest rate risk management IR-1 Interest rate risk in the banking book Liquidity risk management LM-1 Regulatory framework for supervision of liquidity risk LM-2 Sound systems and controls for liquidity risk management Market risk management MR-1 Market risk capital charge MR-2 CVA risk capital charge

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 92 Operational risk management OR-1 Operational risk management OR-2 Operational resilience Reputation risk management RR-1 Reputation risk management Strategic risk management SR-1 Strategic risk management Green and sustainable banking GS-1 Climate risk management Trading activities TA-2 Foreign exchange risk management Technology risk management General technology risk management TM-G-1 General principles for technology risk management TM-G-2 Business continuity planning Electronic banking TM-E-1 Risk management of e-banking TM-E-2 Regulation of advertising material for deposits issued over the internet Securities and leveraged foreign exchange business SB-1 Supervision of regulated activities of SFC-registered authorized institutions SB-2 Leveraged foreign exchange trading

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 93 Mandatory Provident Fund MP-2 Provisioning requirements for investment guarantees under Mandatory Provident Fund Schemes Anti-money laundering AML-1 Supervisory approach on anti-Money laundering and counter-financing of terrorism AML-2 Guideline on anti-money laundering and counter-financing of terrorism (For Authorized Institutions) Disclosure CA-D-1 Guideline on the application of the Banking (Disclosure) Rules Recovery planning RE-1 Recovery planning A3 Other Guidelines and Circulars A3.1 Other relevant guidelines and circulars are available for AIs’ access on the HKMA Banking Regulatory Document Repository28 . The major subjects covered by guidelines and circulars not included in section A2 above are highlighted for reference: ⚫ Consumer protection; ⚫ Specific lending activities, e.g. property lending, etc; ⚫ Debt collection; ⚫ Liquidity risk management in relation to RTGS; ⚫ Market risk management; ⚫ RMB business and associated risk management; 28 https://brdr.hkma.gov.hk/eng/main

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 94 ⚫ Risk management of securities, insurance and MPF activities; and ⚫ Resolution planning. A3.2 AIs should also make reference to the Q&As on the application of the BCR 29 and the following codes of practice issued under section 97M of the Banking Ordinance for providing guidance on rules made under the Ordinance30: ⚫ Banking (Securitization) Code; ⚫ Banking (Exposure Limits) Code; ⚫ Banking (Capital) (Operational Risk) Code; and ⚫ Banking (Liquidity Coverage Ratio - Calculation of Total Net Cash Outflows) Code. 29 See https://www.hkma.gov.hk/eng/key-functions/banking/banking-legislation-policies-and￾standards-implementation/capital/credit-risk-management/ 30 See https://brdr.hkma.gov.hk/eng/main

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 95 Annex B: Factors for assessing capital adequacy under SRP B1 Introduction B1.1 The purpose of this annex is to illustrate the MA’s approach to assessing the capital adequacy of AIs by setting out the key assessment factors used by the MA under the SRP. This list of factors is compiled for AIs’ reference, and should not be regarded as a complete and exhaustive list. B1.2 Broadly speaking, the MA’s assessment under the SRP focuses on the following aspects: • the level of inherent risks faced by an AI (in particular those risks that are not captured, or not adequately captured, under Pillar 1); • the adequacy of the AI’s systems and controls relating to each type of inherent risk; • the AI’s capital strength and capability to withstand risk (including, where applicable, the effectiveness of its CAAP); • the adequacy of the AI’s corporate governance arrangements; and • any other factors (risk increasing or risk mitigating) that are specific to the AI concerned. Given their common applicability to AIs, the first four items listed above are referred to as “common assessment factors”. The last item is referred to as “specific assessment factors”, which will be considered by the MA on a case-by-case basis. B1.3 In reviewing the common assessment factors (particularly in respect of systems and controls and CAAP), the MA places special emphasis on an AI’s ongoing compliance with the BCR, including those qualifying criteria and minimum requirements to which the AI is subject (e.g. relating to the adoption of the IRB

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 96 approach, IMA or IMM(CCR) approach), and the extent to which the supervisory standards and best practices contained in the relevant guidelines issued by the MA (see Annex A) have been complied with. The MA also considers the quality of the AI’s systems and controls (including the level of firm-wide oversight exercised by the Board and senior management), the manner in which business risks and activities are aggregated (and any resultant risk concentrations are identified and controlled), and senior management’s track record in responding to emerging or changing risks. B1.4 The MA takes into account the business nature and the scale of operations (i.e. size, risk profile and complexity) of individual AIs and their significance to financial stability or other supervisory objectives in determining whether a factor is applicable or material to the assessment. B1.5 The MA employs a variety of methodologies and techniques to assess the effects of these factors, including the adoption of a scoring system for the common assessment factors, which, where appropriate, incorporates the use of stress-testing, peer group comparisons, benchmarking against industry performance and other relevant qualitative and quantitative analyses. The specific assessment factors are separately considered by the MA on a case-by-case basis, using similar methodologies and techniques. B2 Inherent risks not captured or not adequately captured under Pillar 1 B2.1 Credit concentration risk • Generally, a risk concentration is any single exposure or group of similar exposures to the same borrower or counterparty (who may be a protection provider), geographical area, industry, economic sector or other risk factors with the potential of producing losses large enough (relative to an AI’s capital, earnings, total assets, or total risk exposures) to threaten the AI’s financial position or ability to

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 97 maintain its core operations, or of producing a material change in the AI’s risk profile. • Because lending is the primary activity of most AIs, credit concentration risk is often the major source of risk concentration for an AI. As such, credit concentration risk is separately assessed under the common assessment factors. Other sources of risk concentration (e.g. those arising from funding sources or through a combination of exposures across different risk factors), if material, are assessed under specific assessment factors (see subsection B6.1 and Annex F for more details). • Credit concentration risk is normally driven by some common or correlated risk factors (e.g. changes in economic or market conditions affecting specific industries or sectors), which, in times of stress, will increase the likelihood of default of, or credit deterioration in, individual counterparties or groups of related counterparties making up the concentration. Such concentration risk arises from direct exposures to counterparties and may also occur through exposures to the same credit protection provider or in relation to the obtaining of the same type of credit protection (e.g. the collateral obtained for share margin financing may be concentrated on a few listed stocks). • In assessing the level of credit concentration risk, the MA pays particular attention to the sources of risk concentration arising from:

• large exposures to single counterparties or groups of linked counterparties (including credit protection providers);
• “clustered” loan portfolios (i.e. portfolios with a large number of sizable single exposures);
• business activities (including lending, trading and investment);

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 98

• exposures to particular economic sectors or geographical locations;
• concentration of exposures by product, service, market or collateral; and
• other concentrations, such as those arising from concentration on a particular type of off-balance sheet exposure (e.g. credit derivatives or other complex financial instruments). B2.2 Residual operational (and legal) risk • Level of income/expenses/interest earning assets and historical operational losses used in the standardized approach for the calculation of operational risk capital charge under the BCR, is only a proxy for the scale of operational risk exposures of an AI and can, in some cases (e.g. for AIs with low income/expenses/interest earning assets or historical operational losses), underestimate the capital which should be held against operational risk. • There is thus a need to determine any residual risk of operational loss resulting from an AI’s internal processes, staff and systems, or from external events (including lawsuits). • In conducting the SRP, the MA considers whether the level of operational risk capital imposed on individual AIs under the BCR can adequately reflect their operational risk exposures, for example, in comparison with other AIs of similar size and with similar operations. The MA pays particular attention to risk factors that may not be fully accounted for in the estimation of such capital. These include incomplete identification of risks, the adoption of higher risk business models and the existence of significant contingent liabilities. • The MA also reviews the nature, frequency, and materiality of operational loss events incurred by AIs, and has regard to any

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 99 of their business activities, functions or operational processes that may pose a higher level of operational risk (e.g. undue reliance on outsourced activities or significant operations in politically unstable areas). B2.3 Interest rate risk in the banking book • This is the risk to an AI’s financial condition resulting from adverse movements in interest rates. The MA assesses the level of interest rate risk in the banking book associated with an AI’s business activities from two separate but complementary perspectives, i.e. earnings and economic value. The assessment will be proportionate to the nature, size, complexity as well as the structure, economic significance and relevant risk profile of the AI. • In assessing the level of an AI’s interest rate risk in the banking book, the MA will place significant emphasis on the stressed impact of six interest rate shock scenarios suggested by the BCBS (i.e. parallel up, parallel down, steepener, flattener, short rate up, and short rate down) on the economic value of equity (“EVE”) of an AI. The MA is particularly attentive to those AIs where the impact of the shocks on their EVE is more than 15% of their Tier 1 capital. Where appropriate, the MA will apply stress-testing techniques, especially in assessing an AI’s basis and options risks. In addition, the MA will also take into account the adequacy and effectiveness of AIs’ relevant systems of control to manage its interest rate risk in the banking book. • The assessment includes the effectiveness of an AI’s hedging strategies. In this connection, the MA will have regard to the accounting standards HKFRS 9 and HKAS 39, in particular whether there are internal processes to (i) ensure that an economic relationship exists between the hedged item and the hedging instrument and, in relation to a simple hedge, all the critical terms (e.g. amount, interest rate, interest settlement dates, currency, and maturity date) are substantially matched; (ii) monitor the implication of changes

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 100 in credit risk of either the hedged item or hedging instrument on the economic relationship between them; and (iii) ensure the hedge ratio remains appropriate and consistent with the one used for risk management purposes on an ongoing basis. For example, when an AI’s interest rate risk position can only be hedged with either 3 (under hedged) or 4 (over hedged) futures contracts due to limitation on future contract size, there is a process to determine the optimal hedging option and review it on an ongoing basis. • The MA will determine whether AIs whose interest rate exposures may lead to a significant decline in their earnings or economic value are exposed to a higher level of interest rate risk. • Detailed guidance on the MA’s supervisory and risk assessment approaches on this risk is set out in section 4 of the SPM module IR-1 on “Interest Rate Risk in the Banking Book”. B2.4 Liquidity risk • Liquidity is crucial to the ongoing viability of an AI. An AI having a relatively weak liquidity position or less effective liquidity risk management systems may tend to be more vulnerable to financial stress, and hence would need to be safeguarded by a stronger capital position. The capital position of an AI can have an effect on its ability to obtain liquidity, especially during a period of stress. • When evaluating an AI’s capital adequacy, the MA takes into account its liquidity risk profile and the liquidity of the markets in which it operates under both normal and stressed conditions. • Factors to be considered include the level, trend and volatility of the AI’s liquidity ratios (that is, (i) the Liquidity Coverage Ratio (LCR) and the Net Stable Funding Ratio (NSFR) in the case of a category 1 institution, or (ii) the Liquidity

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 101 Maintenance Ratio (LMR) in the case of a category 2 institution and the Core Funding Ratio (CFR) in case of a category 2A institution) 31 , its loan-to-deposit ratio and maturity profile, liquidity metrics32 , the stability and concentration of its funding sources, intraday liquidity management33 and other relevant factors such as its borrowing capability and access to money markets (particularly during emergency or crisis situations), its potential exposure to contingent liquidity obligations, and the availability of liquidity support from its major shareholders in case of need. • In addition, the MA assesses the adequacy and quality of an AI's stock of liquid assets that can be used by the AI to weather severe stress events (including prolonged market stresses), having regard to the results of liquidity stress tests conducted by the AI. In the case of retail banks, their ability to withstand bank-run scenarios will be further considered, based on the results of applying liquidity stress tests to the half-yearly cash flow data submitted by these banks34 . B2.5 Strategic risk • This is the risk of current or prospective impact on an AI's earnings, capital, reputation or standing arising from changes in the environment in which the AI operates and from adverse strategic decisions, improper implementation of decisions, or lack of responsiveness to industry, economic or technological changes. 31 See the Banking (Liquidity) Rules for definitions applicable to the LCR, LMR, NSFR, CFR, category 1 institution, category 2 institution and category 2A institution. 32 Please refer to section 3 of the SPM module LM-2 on “Sound Systems and Controls for Liquidity Risk Management” for liquidity metrics used for the measurement and analysis of liquidity risk. 33 Please refer to section 10 of the SPM module LM-2 on “Sound Systems and Controls for Liquidity Risk Management” for details on intraday liquidity risk management. 34 Please refer to section 5 of the SPM module LM-2 on “Sound Systems and Controls for Liquidity Risk Management” for the details of stress-testing and scenario analysis.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 102 • Strategic risk is a function of the compatibility of an AI’s strategic goals, the strategies developed to achieve these goals, the resources deployed to meet these goals, and the quality of implementation. The resources needed to implement an AI's strategies are both tangible and intangible. They include capital and funding, communication channels, staffing and operating systems, delivery networks, and managerial resources and capabilities. • In assessing an AI’s level of strategic risk, the MA considers a number of factors, including: – the compatibility or suitability of the AI’s strategic goals and objectives (e.g. relative to its size and complexity); – the AI’s responsiveness to changes in the environment (including those developments resulting in economic, technological, competitive or regulatory changes), and the sustainability of its business models in view of these changes; – the adequacy of resources (both tangible and intangible) provided by the AI to carry out strategic decisions; – the AI’s track record in implementing strategic decisions (such as past performance of overseas operations and joint ventures and in offering new products and services); – any adverse impact on the AI (e.g. reputation or financial position) arising from its strategic decisions; and – any other warning signals of high potential strategic risk.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 103 B2.6 Reputation risk • This is the risk that an AI's reputation is damaged by one or more than one reputation event35, as reflected from negative publicity regarding the AI’s business practices, conduct or financial condition. Such negative publicity, whether true or not, may impair public confidence in the AI, result in costly litigation, or lead to a decline in its customer base, business or revenue. • The major factors that the MA takes into account in assessing an AI’s level of reputation risk are listed below. These are not necessarily all-inclusive, but will serve as a guide for assessment purposes: − the market or public perception of the financial strength of the AI’s major shareholders, its management and financial stability, and the prudence of its business practices; − management’s willingness and ability to adjust, where necessary, the AI’s strategies to enhance its reputation and standing (e.g. in response to changes in market perception, rules and regulations, or legal barriers) ; − the AI’s history of formulating business strategies and making commercial decisions that affect its financial position, business conduct and reputation, including those that reflect on the fairness and integrity of its business dealings (e.g. in relation to the provision of banking services, charging of fees, etc.); 35 A reputation event includes any action, incident or circumstance in relation to an AI which induces, or is likely to induce, reputation risk for the AI. For example, such an event may arise from market rumours, severe regulatory sanctions, or heavy financial losses. Some of these events, if not acted upon swiftly and effectively, may turn into a full-blown crisis (such as a bank run).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 104 − the AI’s history of, and plans for, analysing risk in new products and services, developing relevant policies and conducting due diligence; − the nature and volume of customer complaints and management’s willingness and ability to respond to those complaints; − management’s ability to handle any scandal or negative publicity to minimise damage to the AI’s reputation; − the existence of highly visible or conspicuous litigation (and historical losses arising from such litigation); − the level of the AI’s exposures associated with off-balance sheet vehicles (e.g. exposures to sponsored securitization structures), and its history of, or potential for, providing implicit support to such vehicles in times of stress due to reputation considerations (see Annex E for more details); − the existence of appropriate fiduciary or other liability insurance to mitigate potential losses arising from litigation or claims; and − the AI’s history with respect to conduct of business practices and compliance with laws and regulations, and management’s willingness and ability to address concerns uncovered in internal or regulatory reviews. • The MA will pay particular attention to whether an AI’s risk management processes have covered activities known to be a source of reputational risk with high potential for financial losses, for example: − an AI’s involvement in asset or fund management, particularly when financial instruments are issued by entities owned or sponsored by the AI, and are distributed to the customers of the AI. In the event that the

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 105 instruments are not correctly priced or the main risks underlying the instruments are not clearly or adequately disclosed, the AI may face legal action from its customers or other pressure to cover losses suffered by them; and − an AI’s sponsorship of money market mutual funds, in￾house hedge funds and real estate investment trusts. In these cases, the AI may decide to support the value of shares or units held by investors on reputation grounds even though it is not contractually required to provide the support. • For AIs that are subsidiaries of a banking group (local or foreign) or are branches of foreign-owned banks, the MA will additionally consider whether the financial position, reputation or conduct of the parent bank or head office, or any other member of the group could undermine confidence in the AI through “contagion”. The risk of contagion is not confined to financial weaknesses. Adverse publicity about illegal or unethical conduct by these entities may also damage the AI’s reputation. B3 Systems and controls relating to each type of inherent risk B3.1 Under the SRP, the MA evaluates the adequacy and effectiveness of systems and controls for managing the eight types of inherent risk (i.e. credit, market, interest rate, liquidity, operational, legal, reputation and strategic) identified for the purposes of risk-based supervision. B3.2 The MA’s assessment of an AI’s systems and controls for managing the inherent risks generally includes the following factors: • Risk management systems – the MA reviews the adequacy of the AI’s risk management policies, procedures and limits as well as the effectiveness of its risk identification, measurement, monitoring and reporting processes to ensure compliance with the established policies, procedures and

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 106 limits. The AI’s level of compliance with risk management standards set out in the MA’s supervisory guidelines in respect of different types of risk will also be a basis for assessment; • Internal control systems and environment – the MA assesses the appropriateness of the AI’s organisation structure, the adequacy of its internal control systems (e.g. segregation of duties and responsibilities, risk and quality control and fraud detection) and the effectiveness of its audit and compliance functions; • Infrastructure to meet business needs - the MA reviews the capability and reliability of the AI’s IT systems, the adequacy, competence and stability of management and staff resources, the appropriateness and adequacy of outsourcing arrangements as well as management oversight and controls over back-office or supporting functions located outside Hong Kong (if any); and • Other supporting systems - these normally include accounting and management information systems, compilation of prudential returns and information, and systems and controls for prevention of money laundering and terrorist financing activities. The MA assesses the adequacy of these supporting systems. B3.3 The MA reviews an AI’s systems and controls based on the findings and results gathered from his offsite reviews or onsite examinations, and makes use of any information obtained from various sources such as banking returns, prudential interviews, tripartite meetings and routine supervisory contacts. The MA will also pay attention to the timeliness and effectiveness of corrective actions taken by the AI to address deficiencies identified, whether by supervisors or other independent reviewers (e.g. internal and external auditors). B3.4 The MA will have regard to the size, complexity and geographical diversity of an AI’s business operations in determining whether the

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 107 systems and controls in place are adequate and commensurate with such operations. B4 Capital strength and capability to withstand risk (including CAAP) B4.1 Review of CAAP • The MA assesses the CAAP of AIs that are subject to the CAAP standards set out by him against those standards. Among other things, the MA will:

• assess the degree to which the AI’s CAAP and internal capital targets have incorporated the full range of material risks faced by it;
• review the adequacy of risk measures used in assessing internal capital adequacy and the extent to which these risk measures are used operationally in setting limits, evaluating business line performance, and evaluating and controlling risks more generally;
• consider, in particular, whether the AI’s remuneration and valuation practices have any adverse effects on its capital adequacy36;
• determine whether capital targets are comprehensive and relevant to the current operating environment, and are properly monitored and reviewed by senior management;
• determine whether the composition of capital is appropriate for the nature and scale of the AI’s business; and 36 For example, remuneration policies that encourage excessive short-term profit-taking may pose longer￾term risks to the AI, whilst the lack of robust valuation methodologies and procedures may understate the potential risks arising from illiquid positions.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 108

• consider the extent to which the AI has provided for unexpected events in setting its capital levels, whether the analysis covers a wide range of external factors, conditions and scenarios, and whether the stress-testing techniques and scenarios used are commensurate with the AI’s activities. • For AIs that are not subject to the CAAP standards, the MA assesses their capital planning and management processes, taking into account their business size and complexity. B4.2 Review of capital strength and capability to withstand risk • An overall assessment of capital adequacy should take into account all factors that affect an AI’s financial condition. Therefore, apart from those mentioned in subsection B4.1 above, the MA will consider the following factors: Capital structure, level and trends
• The MA compares the level and trend of an AI’s actual CAR with the §97F minimum CAR assigned to the AI (also taking into account the AI’s BCR buffer level or §97F buffer level, whichever applicable) and with the average levels of CAR maintained by its peers to determine if its CAR has been kept at prudent levels. In addition, the projected asset growth and earnings performance should reasonably support an AI’s ability to maintain its capital levels without undue reliance on capital injections. For a newly authorized AI, the level of its CAR should be reasonable in relation to its business plans and competitive environment.
• The MA also reviews the quality of an AI’s capital by analysing the composition of its capital base (e.g. the level of CET1 / Tier 1 capital in relation to total capital base).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 109 Strategic planning − The MA assesses whether an AI’s capital planning is supported by an effective strategic plan which should clearly outline the AI’s capital needs, anticipated capital expenditures, desirable capital level, and external capital sources. The Board and senior management should regard capital planning as a crucial element for achieving the desired strategic objectives, and should effectively communicate the AI’s corporate goals and objectives throughout the organisation. Business expansion − The MA assesses whether an AI has adequate capital resources to support its business growth. The MA will pay particular attention to situations where rapid lending growth may become a cause for concern if this is achieved by reducing the AI’s underwriting standards and increasing its risk profile. Dividends − Excessive cash dividend payments may weaken an AI’s capital adequacy. The MA reviews an AI’s dividend policy as well as its historical and planned cash dividend payout ratios to determine whether dividend payments are impairing capital adequacy. Access to additional capital − AIs that do not generate sufficient capital internally may require external sources of capital. Large, independent AIs may solicit additional funding from the capital markets to support their business growth or acquisition plans. Smaller AIs may rely solely on their parent banks or major shareholders to provide additional funds, or on the issue of new capital instruments to existing or new investors.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 110 − The MA assesses an AI’s ability to obtain additional funding from the capital markets in times of need, taking into account the potential difficulties in raising additional capital during downturns or other times of stress, and the strength and availability of its parental support in the provision of new capital. If the AI has subsidiaries and affiliates, the MA will review its commitment and responsibility to provide capital to these subsidiaries and affiliates. − The MA also expects an AI to have a plan that enables it to operate effectively throughout a severe and prolonged period of financial market stress or an adverse credit cycle, as well as contingency plans that address unexpected capital or liquidity needs during crisis situations. Asset quality and provisions − The MA takes into account the potential impact of an AI’s asset quality, particularly the severity of its problem and classified assets and the adequacy of its bad debt provisions, on its capital adequacy. Earnings − The MA assesses an AI’s earning ability to ascertain the stability of its capital. Poor earnings or losses can adversely affect an AI’s capital adequacy by preventing the AI from replenishing its capital internally in the case of poor earnings or by depleting its CET1 capital in the case of losses. Off-balance sheet items − Once funded, off-balance sheet items become subject to the same capital requirements as on-balance sheet items. The MA reviews an AI’s off-balance sheet activities (including securitization transactions) to assess whether

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 111 its capital levels are sufficient to support the on-balance sheet assets that would result from a significant portion of the off-balance sheet items being funded within a short time, and to evaluate the possibility of the AI having to bring a portion of securitized assets (e.g. in respect of the AI’s sponsored securitization structures) onto its balance sheet and the likely impact of this on its capital and financial positions (see Annex E for more details). Market value of an AI’s stock − For a listed AI, its stock price is reflective of investors’ confidence in, and support for, the AI, the lack of which could impair the AI’s ability to raise additional capital. If an AI’s stock is trading at low prices, it may indicate investors’ lack of confidence in the AI, or that there are other problems besetting the AI. The MA reviews whether the stock of the AI or, where applicable, its listed parent bank or holding company has been trading at reasonable prices (e.g. in terms of a reasonable multiple of its earnings or a reasonable percentage (or multiple) of its book value) in order to identify whether there are any concerns that warrant his attention. Capital instruments with redemption features

• The MA assesses the potential performance of an AI’s capital instruments during times of stress and the ability of the instruments to absorb the AI’s losses and support its ongoing business operations.
• The MA will pay particular attention to the impact of redemption (including early redemption) of capital instruments with redemption features on an AI’s overall capital structure. The AI should thoroughly assess such impact if the redemption could have a material effect on the level or composition of its capital base. If an AI plans to redeem a capital instrument with the proceeds of, or replace it by, a like amount of a similar capital instrument,

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 112 the AI should consider the likelihood that it will actually be able to do so within the time planned.

• In reviewing an AI’s funding and financial condition, the MA also takes into account the potential impact of redemption of capital instruments that are not eligible for inclusion in the calculation of the AI’s §97F minimum CAR. Unrealised asset values
• AIs may have assets on their books that are carried at significant discounts below current market values. The excess of the market value over the book value (historical or acquisition cost) of assets such as investment securities or bank premises may represent capital to the AI.
• The BCR allow certain amounts of unrealized gains on asset values to be included in the calculation of the regulatory capital base. In some cases, such as for example unrealized gains on real property revaluation, the amount which can be included is subject to restriction, which effectively results in a certain amount of unrealized gain being “disallowed” from inclusion. In the SRP review of an AI’s overall capital adequacy, the MA however takes these asset values into account, considering in particular the nature of the assets, the reasonableness of their valuation, their marketability, and the likelihood of their sale. Whilst adopting this broader view, the MA is nevertheless concerned about cases where there appears to be undue reliance on unrealised gains to satisfy actual and projected capital requirements. Even though Basel III allows unrealised gains on securities to be recognized in the regulatory capital base, the MA will expect AIs not to place undue reliance on unrealised gains in constituting their CET1 capital.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 113 • In assessing an AI’s capability to withstand risk, the MA conducts sector-wide stress tests to assess individual AIs’ vulnerability to severe market shocks or crisis situations (e.g. based on hypothetical scenarios that are similar to, or more severe than, those experienced during the 1997/1998 Asian Crisis or the 2007/2008 Global Financial Crisis). The MA also considers whether “outlier” AIs that show significant vulnerability to “stressed” situations, compared with their peers, warrant a higher §97F minimum CAR, §97F buffer level and/or a reduction in risk exposures. B5 Corporate governance B5.1 A sound risk management process, strong internal controls and well documented policies and procedures are the foundation for ensuring the safety and soundness of an AI. As such, the Board and senior management of an AI are expected to have a reasonable understanding of the nature and level of risks being taken by the AI and how such risks relate to adequate capital levels. They should also be responsible for ensuring that the formality and sophistication of the firm-wide risk management and control processes are appropriate in the light of the AI’s risk profile and business plans. B5.2 The Board and senior management of an AI should promote continuous and robust dialogue and information sharing among members of senior management and across business lines and risk management and control functions so that sources of significant risk to the AI as a whole can be promptly identified, analysed and mitigated. B5.3 When assessing the quality of an AI’s corporate governance, the MA reviews the above aspects in addition to other relevant requirements detailed in various guidelines issued by the MA. In particular, the Board and senior management will be evaluated in terms of: • their risk management knowledge and experience;

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 114 • their participation and involvement in development of the AI’s risk management processes; • their awareness of, and responsiveness to, risk management and control issues raised by the MA; and • their willingness and ability to promote and maintain prudent remuneration policies and practices within the organisation. B6 Risk increasing factors B6.1 General • Risk increasing factors are specific factors that negatively affect the risk profile of an AI and which may hence be indicative of a need for an increase in the AI’s Pillar 2 capital requirement. Such factors may relate to:

• Material risks specific to the AI’s business and operations or material risk concentrations identified within the AI’s business activities. For example, an AI may be exposed to business concentration risk by relying heavily on a particular business activity, or the risk posed by its non￾banking activities (such as securities dealing or insurance￾related activities) is becoming increasingly high, as a result of rapid expansion in the absence of adequate expertise and management systems;
• Significant “outliers” identified in the review of common assessment factors. These may relate to extremely high levels of inherent risk, substantial management problems or control weaknesses, or significant vulnerability to adverse economic events which warrant a full assessment of the additional capital required to cover the risks involved; and
• Specific issues arising from the application of the capital adequacy framework. In particular, these issues relate to an AI’s ongoing compliance with various minimum

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 115 standards and requirements applicable to it for the purpose of calculating regulatory capital for credit, market or operational risk. The MA will consider such issues under the SRP if they are not adequately catered for under Pillar 1. Such issues may result in an AI being required to rectify deficiencies by improving its systems and controls or reducing its risk exposures, or to hold additional capital pending rectification of the deficiencies. See subsections B6.2 and B6.3 for a consideration of such issues in relation to credit risk (including CCR) and market risk. Those relating to operational risk are mentioned under subsection B2.2. • The MA should determine the extent to which the Pillar 2 capital requirement of an AI should be increased due to a risk increasing factor based on his assessment of the extent to which such a factor has the potential to increase the risk of the AI. B6.2 Specific issues in relation to credit risk Credit assessment • AIs’ credit risk management policies and procedures should enable them to assess the credit risk involved in exposures to individual borrowers or counterparties as well as at the portfolio level. These policies and procedures should serve the purposes of not only credit approval and risk management, but also capital adequacy assessment. • For more sophisticated AIs, the MA expects the credit risk assessment of capital adequacy conducted as part of their CAAP, at a minimum, to cover four areas: risk rating systems, portfolio analysis / aggregation, securitization / complex credit derivatives, and large exposures and risk concentrations.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 116 Credit risk mitigation • An AI may be exposed to residual credit risk associated with credit risk mitigation if the techniques used give rise to risks that could render the overall risk reduction less effective. Examples of these risks include:

• inability to seize, or realise in a timely manner, collateral pledged (on default of the obligor);
• refusal or delay by a guarantor to pay;
• ineffectiveness of untested documentation; and
• high cost credit protection transactions where there is an immediate regulatory capital benefit but a delayed recognition of losses or costs of protection in earnings by an AI. The relevant supervisory requirements and guidance relating to high cost credit protection transactions are set out in Annex G. There may also be specific wrong-way risk if there is a high correlation in the credit quality of a credit protection provider/collateral and the obligor due to their performance being dependent on common economic factors. • The MA will determine if there are instances suggesting the lack of appropriate policies and procedures on the part of the AI to control these residual risks, and assess the need for taking appropriate action (e.g. increasing the AI’s Pillar 2 capital requirement). IRB approach • An AI’s adoption of the IRB approach may give rise to some issues which will be subject to the MA’s review in determining the appropriate supervisory actions to be taken (including whether the AI’s regulatory capital requirement should be

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 117 increased pending rectification of deficiencies). Examples include:

• deficiencies or flaws identified in the risk quantification or back-testing methodologies or other processes associated with the institution’s rating systems;
• deviations from the reference definition of default used for risk estimation (e.g. use of external data or historical internal data not fully consistent with the prescribed default criteria under the BCR);
• weaknesses arising from the application of credit risk stress tests under the IRB approach. For example, the stress-testing processes or methodologies employed may not be appropriate to an AI’s circumstances or a capital shortfall (i.e. the stress-testing results suggest that an institution will not be able to operate above the regulatory capital requirements under Pillar 1) is identified but not adequately addressed; and
• inadequate systems and controls in monitoring the deterioration in the credit quality of protection providers and in assessing the impact of protection providers falling outside the eligibility criteria (due to rating changes) on their capital requirements at the time of default. Basic approach • AIs using the basic approach are not subject to a higher capital charge for their exposures that are past due or defaulted. If such exposures have reached a significant level compared with an AI’s peers, the MA may consider whether a capital adjustment under the SRP is necessary to reflect the higher risk associated with the problem exposures.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 118 Standardized (credit risk) approach • AIs should have effective internal policies, processes, systems and controls to ensure compliance with the requirements set out in §54C (due diligence requirements) of the BCR and to meet the MA’s supervisory expectations set out in any guidance on the due diligence requirements. In those instances where an AI determines that the inherent risk of an exposure (whether subject to §54C(2) of the BCR or not), is significantly higher than that implied by the risk weight assigned to the exposure under the Standardized (Credit Risk) Approach, the AI should consider the higher degree of credit risk in the evaluation of its overall capital adequacy as required under its CAAP. • AIs must be able to demonstrate to the MA that their due diligence analyses are appropriate. As part of its supervisory review, the MA will ensure that AIs have appropriately performed their due diligence analyses, and will take supervisory measures where these have not been done. Securitization • The MA will be alert for any indication that may call into question an AI’s compliance with the relevant requirements on the recognition of risk transference for its securitization transactions. If the MA determines that the level of risk transfer for a particular securitization transaction has been overstated and does not justify the capital relief obtained, it may lead to an increase in capital requirements for the transaction or, where necessary, an increase in the overall level of capital the AI is required to hold. • Similarly, if there is indication that an AI has provided implicit support to securitization transactions, the MA will consider the appropriateness of taking one or more supervisory actions (including an increase in the AI’s §97F minimum CAR) as specified in Part 7 of the BCR.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 119 • In the event that an AI is engaged in complex securitization transactions the risks of which are not adequately accounted for under Pillar 1 (e.g. as a result of market innovations introducing new features to a securitization), the MA may consider imposing a specific capital treatment for such transactions or adjust the AI’s §97F minimum CAR to account for the additional risk incurred. • The MA will also review any other issues arising from an AI’s compliance with the securitization requirements set out in the BCR (e.g. in relation to call options and early amortization provisions) to determine the need for a capital adjustment or other supervisory actions. • Annex E provides further discussion on the various risks associated with securitization and the MA’s expectations of how such risks should be addressed by AIs in their CAAP and managed, as well as the MA’s approach to assessing such risks under the SRP. The MA will consider the need for additional capital or supervisory measures if there are major concerns in the way an AI addresses these risks. Counterparty credit risk • The MA will focus substantially on an AI’s systems of control to manage the AI’s CCR in assessing its capital adequacy in relation to such risk under the SRP. • For an AI that uses the IMM(CCR) approach to calculate CCR, where it is apparent to the MA that the estimates from the calculation do not adequately reflect the AI’s exposure to CCR, the MA will determine the appropriate action to be taken, which might include directing the AI to (i) revise its estimates; (ii) apply higher estimates of default risk exposures or a higher alpha factor under the IMM(CCR) approach; or (iii) not recognise internal estimates of default risk exposures for regulatory capital purposes.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 120 • For an AI that uses the standardised (counterparty credit risk) approach (SA-CCR approach) to calculate CCR, the MA will review the AI’s evaluation of the risks contained in the contracts or transactions that give rise to CCR and the AI’s assessment of whether the SA-CCR approach captures those risks appropriately and satisfactorily (which is conducted as part of the AI’s CAAP). If the SA-CCR approach does not capture the risks inherent in the AI’s relevant contracts or transactions (as could be the case with structured, more complex OTC derivatives), the MA may require the AI to apply the SA-CCR approach on a transaction-by-transaction basis (i.e. no netting will be recognised). • The MA will also assess AIs’ exposures to central counterparties under the SRP. In particular, an AI should review, and the MA will assess, whether there is a need for the AI to hold additional capital against such exposures, including any unlimited funding commitments arising from an AI’s default fund contributions (which are not entirely prefunded) to a central counterparty. • Detailed supervisory requirements and guidance in relation to CCR are set out in Annex H. B6.3 Specific issues in relation to market risk IMA • A variety of issues may arise from an AI’s adoption of the IMA for the calculation of market risk. These include:

• deficiencies or flaws identified in the risk quantification or back-testing methodologies or processes associated with market risk internal models;
• deficiencies arising from valuation issues, such as inappropriate valuation adjustments to less well diversified

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 121 portfolios or portfolios consisting of less liquid cash instruments;

• weaknesses arising from the application of market risk stress tests under the IMA, such stress-testing being a requirement for using this approach. For example, the stress-testing assumptions or methodologies may not be appropriate or commensurate with an AI’s trading activities or a capital shortfall (i.e. capital insufficient to cover the minimum capital requirements under the IMA according to the market risk stress tests performed) is identified but not adequately addressed; and
• weaknesses arising from capitalising non-modellable risk factors or default risk under the IMA. For example, model effectiveness is undermined by positions with limited price transparency or by illiquid positions, or the approach to capturing default risk is inadequate, or there is a minor imperfection in the internal models due to an assumption or approximation underlying the models. • Moreover, an AI that uses IMA is required to conduct profit and loss attribution test as referred to in new §322G of the BCR effective from 1 January 2025. During the transitional period which lasts until the first anniversary of the commencement of the test (i.e. from 1 January 2025 to 31 December 2025), the outcomes of the test will not affect capital charge calculation but will be considered by the HKMA during its supervisory review process. During this period, the HKMA will pay particular attention to the AIs having significant number of trading desks in the yellow and red zones as a result of structural issues in their internal models. • The MA will determine the appropriate supervisory actions to be taken in respect of these issues (including whether the AI’s §97F minimum CAR should be increased pending rectification of weaknesses).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 122 STM approach • An AI has to calculate a RRAO for all instruments (i) with an exotic underlying and (ii) bearing other residual risks in accordance with §281R of the BCR. If the MA considers the normal capital charge for the RRAO is not sufficiently prudent with respect to the risks of the underlying instrument of an AI, he may impose a conservative additional capital charge on the AI. B7 Risk mitigating factors B7.1 Risk mitigating factors are specific factors that will have a positive impact on the risk profile of an AI and hence may reduce the need for, or amount of, any Pillar 2 capital requirement. They are used by the MA as incentives for AIs to improve their risk management so that the level of their inherent risks can be effectively mitigated. Risk mitigating factors may include AIs using less advanced approaches for calculating regulatory credit risk capital requirements, but possessing IRB capabilities for risk management purposes. B7.2 The MA will conduct a stringent review to determine whether an AI has any risk mitigating factors that can be recognised for capital adequacy purposes, in consultation with the AI concerned. Each case will be considered based on its own merits. To facilitate his assessment, the MA may require the AI to submit any such information or documentary evidence as is deemed necessary to justify the risk mitigating effect of any particular factor under consideration. B7.3 The MA will determine the extent to which the Pillar 2 capital requirement of an AI can be reduced due to a recognised risk mitigating factor based on his assessment of the extent to which such factor can generally mitigate the risk of the AI in all circumstances.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 123 Annex C: Scoring worksheets to facilitate assessment under SRP

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 124 CREDIT CONCENTRATION RISK (A1) Position as at HK$m % of Score Maximum Exposures / claims considered concentrated Benchmarks (% of) DD/MM/YYYY C.B. obtained score / large if any of the benchmarks is exceeded T.L. T.A. C.B.

1. Concentration in lending activities 1a. Credit concentration in industry / economic sectors Return item O/S Balance As % of Benchmark Risk- RW Exposure Aggregate of Concentration criteria for 1a: HK$m T.L. T.A. C.B. exceeded? weight HK$m RW exposure (a) Residential mortgages H5(a) & H5(b) from 1a Residential mortgages (b) Credit card advances H5(c) Credit card advances (c) Other loans to professional H5(d) & H5(e) PLUS Loans to professional & private individuals and private individuals Property development and investment (d) Property dev. and inv. B1(e) & B2(e) Aggregate of Taxi and PLB loans (e) Taxi and PLB loans G3 & G4 additional Share financing (f) Share financing H3(c) & H4(c) RW exposure Trade financing (g) Trade financing J from 1b Other economic sectors (individual) (h) Others (if concentrated) : - Return items : A1(c), 2, 3, 4, 5(c), 6, 7, 8, 9; B3; C; D; E3; F; G1, 2, 5; H1, 2(e), 6; and K 1b. Business concentration arising from lending activities T.L. as % of total assets RW Additional Concentration criteria for 1b with reference to: Return item Exposure As % Multiplier RW Exposure HK$m of T.L. HK$m (a) Total loans (T.L.) as percentage of total (a) Residential mortgages H5(a) & H5(b) assets; (b) Credit card advances H5(c) (b) Exposures in each sector as percentage (c) Other loans to professional H5(d) & H5(e) of T.L.; and and private individuals (c) Sum of exposures in two or more sectors (d) Property dev. and inv. B1(e) & B2(e) exceeding certain percentage of T.L. (e) Taxi and PLB loans G3 & G4 (f) Share financing H3(c) & H4(c) (g) Trade financing J (h) Others (if concentrated) : HK$m Criteria met? P.1 of 2 Sectoral exposures O/S Balance

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 125

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 126

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 127

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 128

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 129

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 130

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 131

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 132

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 133 REPUTATION RISK (A5) P.1 of 2 Rating Low (L) Moderate (M) High (H) Comments Annex

1. Market / public perception Strong Acceptable Weak (a) (b) (c) (d)
2. New business development Strong Acceptable Weak (a) (b) (c) (d) (e)
3. Nature and volume of customer complaints Insignificant Moderate Serious (a) (b) (c) (d)
4. Litigation Insignificant Moderate Serious (a) (b) Are there any customer complaints that are indicative of serious supervisory concern? Are there any customer complaints that have resulted (or likely to result) in substantial compensation or an adverse impact on the AI's reputation? Is the AI's management willing and able to respond to customer complaints? Factors for assessment Is the AI's management willing and able to adjust business strategies based on market perception? Does the AI have a well developed plan for introducing or Is there a general perception that the financial position of the AI's major shareholders is adequate or strong? Is there a general perception that the management and financial position of the AI is adequate or strong? Is there a general perception that acquiring new business activities? the complexity and riskiness of the AI's business activities are commensurate with its size and operations and risk management capacity? Does the AI have a successful track record in:

• launching new business lines, products or services; or Is there any highly visible or conspicuous litigation?
• acquiring new subsidiaries / businesses (e.g. a mortgage or credit card portfolio)? Is the AI's management willing and able to adjust business strategies based on regulatory changes or legal barriers? Does the AI have a successful track record in formulating business strategies and making commercial decisions that bolster its financial position, business conduct and reputation (including the fairness and integrity of its business dealings)? Is the AI's management willing and able to analyse risk in new products and services, develop relevant policies and conduct due diligence? Is the volume of customer complaints acceptable based on the AI's size and complexity of business? Are there any litigation cases that have resulted (or are likely to result) in substantial financial losses or an adverse impact on the AI's reputation? The factors listed below should be used when assessing the overall level of reputation risk. The suggested questions are not necessarily all-inclusive, but should serve as a guide to be used in determining the risk rating for each factor.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 134 REPUTATION RISK (A5) P. 2 of 2 Rating Low (L) Moderate (M) High (H) Comments Annex 5. Negative publicity No Insignificant Serious (a) (b) 6. Compliance with laws and regulations Strong Acceptable Weak (a) (b) (c) (d) 7. Fiduciary or other liability insurance Highly adequate Adequate Inadequate 8. None or not Moderate Serious Please itemise the signals below : identified significance significance Overall rating Maximum score Maximum score Maximum score Score obtained Overall comment on reputation risk : Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Other warning signals of high potential reputation risk (e.g. does the AI have a high level of exposures to off-balance sheet vehicles (SIVs/conduits etc.) that may put pressure on it to provide implicit support in times of stress for reputation considerations?) Are there any cases of non-compliance that are indicative of serious supervisory concern? Have significant findings about the AI's regulatory compliance, conduct and business practices been uncovered in internal and regulatory reviews? Is the AI's management willing and able to respond to these findings? Factors for assessment Is there appropriate fiduciary or other liability insurance to cover the AI's potential exposure? Are there frequent cases of non-compliance with laws and Has the AI experienced any scandal or negative publicity that has resulted in substantial financial losses or an adverse impact on its reputation? Has the AI's management properly handled such events and taken adequate remedial actions to minimise the damage to reputation caused? regulations (particularly in the conduct of asset management, investment advisory and securities dealing activities as well as the compliance with regulatory requirements to combat money laundering and terrorist financing)?

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 135 STRATEGIC RISK (A6) Rating Low (L) Moderate (M) High (H) Comments Annex

1. Compatibility / suitability of strategic goals & objectives Strong Acceptable Weak (a) (b) (c)
2. Responsiveness to changes in business environment High Medium Low
3. Adequacy of resources to carry out business strategies Highly adequate Adequate Inadequate (a) (b)
4. Implementation of business strategies Strong Acceptable Weak (a) (b)
5. Impact of strategic decisions Low Moderate High (a) (b) (c)
6. Other warning signals of high potential strategic risk None or not Moderate Serious Please itemise the signals below : identified significance significance Overall rating Maximum score Maximum score Maximum score Score obtained Overall comment on strategic risk : Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Does the AI have adequate resources to carry out business strategies in terms of such factors as management resources and capabilities, capital and funding, staffing and operating systems, communication channels and delivery networks? Have there been any strategic decisions, or external pressures arising from such strategic decisions, that resulted in a significant adverse impact on the AI's financial position? Have there been any strategic decisions that could not be reversed without significant cost or difficulty? Is the AI's business fairly diversified (e.g. by product, geography or customer demographics) that will help reduce the overall impact of adverse market conditions? Are the AI's business strategies and decisions indicative of its responsiveness to changes in the external environment (such as industry, economic, technological, competitive, regulatory, and other environmental changes)? Are the AI's strategic goals and decisions compatible with its corporate mission, goals, culture, values, business direction and risk tolerance? Are the AI's financial objectives consistent and commensurate with its short and long term goals? Are the AI's strategic decisions generally prudent or overly aggressive relative to its size and complexity? The factors listed below should be used when assessing the overall level of strategic risk. The suggested questions are not necessarily all-inclusive, but should serve as a guide to be used in determining the risk rating for each factor. Have the AI's major business units and operations, including

• offering new products and services;
• shifting of business focuses (including re-focuses);
• conducting strategic investments / forming joint ventures; and overseas branches, banking subsidiaries and associates, achieved satisfactory performance in line with their business targets? Factors for assessment Does the AI have the potential or capability to enter to new markets, businesses or products? Does the AI have a successful track record in :
• implementing merger and acquisition plans?

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 136

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 137 INTERNAL CONTROL SYSTEM AND ENVIRONMENT (B2) Total Firm-wide rating rating* Credit Market Interest rate Liquidity Operational Legal Reputation Strategic 1. 2. 3. (a) (b) (c) (d) (e) 4. S : Strong A : Acceptable W : Weak

• A firm-wide rating reflects an AI's ability to integrate and manage all material risks from a firm-wide perspective. Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Individual rating Annex Rating Fraud detection Result / progress of implementation of the recommendations from regulators, internal and external auditors on internal controls Overall rating Score obtained Quality and effectiveness of the Board and senior management oversight Maximum score Appropriateness of organisation structure and adequacy of control environment Factors for assessment External audit Internal audit Centralised compliance Centralised risk & quality control Adequacy and effectiveness of individual components within the internal control system Comments

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 138 INFRASTRUCTURE TO MEET BUSINESS NEEDS (B3) Total Firm-wide rating rating* Credit Market Interest rate Liquidity Operational Legal Reputation Strategic 1. 2. 3. 4. 5. 6. S : Strong A : Acceptable W : Weak

• A firm-wide rating reflects an AI's ability to integrate and manage all material risks from a firm-wide perspective. Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Annex Rating Result / progress of implementation of the recommendations from regulators, internal and external auditors on infrastructure Overall rating IT capability, reliability and stability Comments Individual rating Score obtained Appropriateness and adequacy of outsourcing arrangements Maximum score Factors for assessment Staff competence, sufficiency and stability Maintenance of sufficient office space to ensure adequacy of internal controls and efficient operations Adequacy and effectiveness of management oversight and controls over "back office operations / support functions" outside Hong Kong

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 139

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 140 CAPITAL ADEQUACY ASSESSMENT PROCESS ("CAAP") (C1) Part I - Applicable to AIs which are required to comply with the CAAP standards Rating Strong (S) Acceptable (A) Weak (W) Comments Annex 1. (a) Highly competent Acceptable to competent Marginally acceptable or weak (b) Proportional Marginally proportional Not in proportion (less than required) (c) Satisfactory Acceptable Less than satisfactory (d) Adequate Acceptable Inadequate (e) High Moderate Low 2. (a) Satisfactory Acceptable Less than satisfactory (b) Capable Marginally capable Incapable (c) Clear and reasonable Acceptable Unclear or with doubt (d) All the time Most of the time Sometimes 3. (a) Not necessary Minor with minimal concerns Significant with serious concerns (b) Not applicable Satisfactory Less than satisfactory Overall rating Maximum score Maximum score Maximum score Score obtained Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Identifying and measuring all material risks Adequacy and effectiveness of the overall CAAP Competence of the board and senior management in discharging their responsibilities in CAAP Proportionality of the CAAP to the risk profile and level of sophistication of the AI's operations Usefulness and effectiveness of the CAAP in the AI's risk management and decision-making processes New supervisory actions required Results of rectification of previous supervisory actions Factors for assessment Capability of relating capital to the level of risk Stating explicit capital adequacy goals / targets with respect to risk Conformity to the AI's stated capital adequacy goals / targets / objectives Supervisory actions required / taken Adequacy of controls over the integrity and functionality of the CAAP Ability of the CAAP to ensure the AI's compliance with the regulatory capital requirements Adequacy and effectiveness of individual elements in the CAAP (including stress-testing on capital adequacy) P.1 of 2

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 141 CAPITAL ADEQUACY ASSESSMENT PROCESS ("CAAP") (C1) Part II - Applicable to AIs which are not required to comply with the CAAP standards (assessment based on individual AIs' business size and complexity) Rating Strong (S) Acceptable (A) Weak (W) Comments Annex 1. (a) Accurate and complete No significant weaknesses Unsatisfactory (b) Accurate and complete No significant weaknesses Unsatisfactory (c) Very good Generally satisfactory Poor (d) Adequate and effective No significant weaknesses Unsatisfactory 2. (a) Formal and with adequate policy and procedures Informal although generally satisfactory Unsatisfactory / not commensurate with AI's operations (b) Adequate consideration Acceptable Inadequate / no consideration (c) Clear, appropriate and well documented Informally defined although acceptable Unclear (d) Adequate and well documented Informal although acceptable Insufficient / no consideration 3. (a) Not necessary Minor with minimal concerns Significant with serious concerns (b) Not applicable Satisfactory Less than satisfactory Overall rating Maximum score Maximum score Maximum score Score obtained Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Factors for assessment Adequacy and effectiveness of controls over compliance with capital requirements Accuracy and completeness in categorising and reporting all components of capital base Accuracy and completeness in risk-weighting and reporting all on- and off-balance sheet items Documentation of categorisation and reporting procedures for regulatory capital measurement purposes Adequacy and effectiveness of internal monitoring systems in ensuring that actual CAR does not fall below regulatory minimum and trigger ratio Capital planning and management processes Consideration of all material risks and capital needs in capital planning and management Responsibilities in capital planning and management Contingent capital planning P.2 of 2 Supervisory actions required / taken New supervisory actions required Results of rectification of previous supervisory actions Adequacy and effectiveness of capital planning and management

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 142

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 143

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 144

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 145

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 146

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 147 Annex D: Supervisory requirements on application of stress tests under CAAP D1 General requirements D1.1 AIs should conduct rigorous, forward-looking stress tests that can alert them to adverse unexpected outcomes related to a broad variety of risks and provide them with an indication of how much capital might be needed to absorb losses should severe stress events occur. D1.2 AIs should regularly conduct stress tests (especially firm-wide stress tests) that are appropriate for their size, complexity and nature of operations to assess their vulnerabilities to possible adverse events or changes in market conditions and the need for them to hold additional capital should such events or changes occur. Recognising that market conditions can change rapidly, AIs are normally expected to conduct stress tests on a quarterly basis. Depending on the nature of the major sources of risk identified and their possible impact on AIs’ financial conditions, some stress tests (e.g. those relating to trading activities) may need to be carried out more frequently (say, daily or weekly). D1.3 Stress-testing should form an integral part of an AI’s overall governance and risk management culture. The Board and senior management should have active involvement in setting stress-testing objectives, defining scenarios, discussing the results of stress tests, assessing potential actions and making decisions in response to concerns identified. Senior management should take an active interest in the development and operation of stress-testing. The Board and senior management should also be informed of, and should fully understand, the limitations of an AI’s stress tests. Any stress￾testing results should be reported to the Board and senior management in a timely and appropriate manner (so as to facilitate comprehension and understanding) and communicated within an AI appropriately so that the results can contribute to strategic decision-making, foster internal debate regarding

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 148 assumptions (such as the cost, risk and speed with which new capital could be raised or positions could be hedged or sold), and facilitate the development of risk mitigation or contingency plans across a range of stressed conditions. D1.4 Stress tests should be used to identify existing, or potential, firm￾wide risk concentrations. They should also be used to provide an independent risk perspective and complement other risk management tools, such as those that are based on complex, quantitative models using historical data and estimated statistical relationships. In particular, stress-testing outcomes for a particular portfolio should provide insights about the validity of statistical models (e.g. VaR models) at high confidence intervals. D1.5 AIs should feed the results of relevant stress tests (e.g. the supervisor-driven stress tests and other relevant stress tests conducted by the AI, and supervisory top-down solvency stress tests conducted by the MA, as applicable) into their capital and liquidity planning processes, and take these results into account when evaluating the adequacy of their capital and funding sources and examining future capital resources and liquidity requirements under adverse scenarios in order to ensure that they have the ability to raise funds at reasonable cost, when necessary. D1.6 AIs’ regulatory capital requirements may vary as economic conditions fluctuate over time. Such requirements will also depend on where in the economic cycle AIs find themselves at any given time. Deterioration in business or economic conditions, in particular, may result in the need for an AI to raise capital or, alternatively, to contract its business activities, at a time when market conditions are most unfavourable to raising capital. To reduce the impact of cyclical effects, an AI should aim at maintaining an adequate capital buffer during the upturn in an economic cycle such that it has sufficient capital available to protect itself from a severe market downturn. D1.7 To assess their expected capital requirements over an economic cycle, AIs may wish to project their financial position, taking

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 149 account of their business strategy and expected growth, according to a range of assumptions as to the state of the economic or business environment which they may face. For example, the CAAP of an AI may include an analysis of the impact that the actions of the AI’s competitors could have on its performance, in order to see what changes in its environment the AI could sustain. Projections over a one to three year period would likely be appropriate in most circumstances. The AI may then calculate its projected capital requirements and assess whether they could be met from expected financial resources. D1.8 AIs should have regard to the general standards set out in IC-5 “Stress-testing” and the Stress Testing Principles issued by the Basel Committee in October 201837 for more guidance on the use of stress-testing techniques. D2 Specific requirements D2.1 The purpose of stress tests is to identify potential risks under stressed conditions and analyse the adequacy of an AI’s capital in response to such conditions. The nature, depth and detail of the analysis will depend, in part, upon the AI’s risk profile and its vulnerabilities to adverse changes in the external environment as well as the robustness of its risk prevention, detection and mitigating measures. D2.2 In carrying out stress tests, AIs should take reasonable steps to identify an appropriate range of risks and the circumstances and events in which those risks would crystallise. Such circumstances and events should reflect severe, but plausible, scenarios. Possible correlations among risk types should be identified together with the interaction between different risk factors and the potential feedback effects. 37 https://www.bis.org/bcbs/publ/d450.pdf

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 150 D2.3 Particular attention should be paid to developing stress scenarios to address, where applicable, the following types of risk: • an AI which is engaged in originating securitization transactions should manage warehouse and pipeline risk by including exposures held for prospective securitization purposes in its regular stress tests, regardless of the probability of such exposures being securitized. This is because many of the risks associated with these exposures are likely to emerge when the AI is unable to access the securitization market due to either AI-specific or more general market stress; • an AI should carefully assess the risks with respect to commitments to off-balance sheet vehicles and third-party institutions related to structured credit securities and the possibility that assets will need to be taken onto the balance sheet for reputation reasons. Therefore, in its stress-testing programme, the AI should include scenarios assessing the size and soundness of such vehicles and institutions relative to its own financial, liquidity and regulatory capital positions. This analysis should cater for structural, solvency, liquidity and other risk issues, including the effects of covenants and triggers; and • an AI should also assess the effect of reputation risk in terms of other risk types, namely credit, liquidity, market and other risks, to which the AI may be exposed. This could be done by including reputation risk scenarios in regular stress tests. For example, the provision of non-contractual support (capital and/or liquidity) by an AI to the off-balance sheet vehicles sponsored by the AI due to reputation concerns may be included in the stress tests to determine the impact of such support on its credit, market and liquidity risk profile. D2.4 In applying stress tests, AIs are expected to determine an appropriate time horizon to be covered by the tests. This will depend upon:

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 151 • how quickly an AI would be able to identify events or changes in circumstances that might lead to a risk crystallising resulting in a loss; and • after the AI has identified such event or circumstance, how quickly and effectively it could act to prevent or mitigate any loss resulting from the risk crystallising and to reduce exposure to any further adverse event or change in circumstances. D2.5 The time horizon over which stress tests would need to be carried out for market risk arising from the holding of investments, for example, would depend upon: • the extent to which there is a regular, open and transparent market for those assets, which would allow fluctuations in the value of the investment to be more readily and quickly identified; and • the extent to which the market for those assets is liquid (and would remain liquid in the changed circumstances contemplated in the stress tests), which would allow AIs, if needed, to sell their holdings so as to prevent or reduce the exposure to future price fluctuations. D2.6 In identifying stress scenarios, and assessing their impact, AIs should take into account, where material, how changes in circumstances might impact upon: • the nature, scale and mix of their future activities; and • the behaviour of counterparties, and of the AIs themselves, including the exercise of choices (e.g. options embedded in financial instruments or contracts of insurance). D2.7 In determining whether there would be adequate capital in the event of each identified stress scenario, AIs should:

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 152 • only include capital that could reasonably be relied upon as being available in the circumstances of the identified scenario; and • take account of any legal or other restriction on the use of capital. D2.8 AIs should conduct stress tests which enable them to assess their exposures not only in their current position in the economic cycle, but also with respect to possible changes in the cycle which might be expected over the next few years. D2.9 AIs may consider scenarios in which expected future profits will provide capital reserves against future risks. However, it would be appropriate to take into account only those profits that can be foreseen with a reasonable degree of certainty as arising before the risk against which they are being held could possibly arise. In estimating future reserves, AIs should deduct future dividend payment estimates from projections of future profits. D2.10 AIs may substitute more sophisticated modelling techniques for traditional stress tests. This approach is acceptable providing that major risks are identified and the modelling is capable of estimating the impact on their financial position where the risks crystallise, or are assumed to crystallise, with a particular probability.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 153 Annex E: Assessment of risks arising from securitization activities under CAAP / SRP E1 Introduction E1.1 Securitization has increasingly been used by banks as an alternative source of funding and as a mechanism to transfer risk to investors. Whilst the risks associated with securitization are not new to banks, the 2007/2008 Global Financial Crisis highlighted some aspects of credit risk, concentration risk, market risk, liquidity risk, legal risk and reputation risk, which certain banks had previously failed to adequately address. For instance, a number of banks that were not contractually obligated to support sponsored securitization structures were unwilling to allow these structures to fail due to concerns about reputation risk and future access to capital markets. Their support of these structures exposed the banks to additional and unexpected credit, market and liquidity risks as they brought assets onto their balance sheets, imposing significant pressure on their financial position and capital ratios. E1.2 In the light of the wide range of risks arising from securitization activities, which can be compounded by rapid innovation in securitization techniques and instruments, the regulatory capital requirements under Pillar 1 may not be sufficient to cover all risks arising from such activities. These risks usually include: • credit, market, liquidity and reputation risks in respect of each securitization exposure; • potential delinquencies and losses associated with the underlying exposures of securitization transactions; • exposures from credit enhancement or liquidity facilities provided to special purpose entities; and • exposures from guarantees provided by monoline insurers and other third parties.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 154 E1.3 This annex sets out the MA’s expectation on how AIs should manage specific risks arising from securitization activities and how such risks should be assessed in their CAAP. The MA’s approach to reviewing AIs’ securitization exposures and addressing issues associated with such exposures under the SRP are also explained. E2 Supervisory requirements General E2.1 To help ensure that the Board and senior management understand the implications of securitization exposures for liquidity, earnings, risk concentration and capital, AIs should cover all relevant exposures and potential exposures (both contractual and non-contractual) in their risk management processes and MIS and address such exposures in their CAAP. E2.2 AIs adopting an “originate-to-distribute” business model, or using securitization to enhance credit intermediation and profitability, are expected to have risk management processes that meet the supervisory requirements under this section. Other AIs are also expected to meet the supervisory requirements, where applicable. E2.3 The MA will take into account the compliance of an AI with the relevant supervisory requirements set out in this annex and SPM module CR-G-12 on “Credit Risk Transfer Activities” when assessing the AI’s risk management processes and CAAP under the SRP. Approach to supervisory review E2.4 The MA will monitor, as appropriate, whether AIs have taken adequate account of the economic substance of securitization transactions in their determination of capital adequacy under the CAAP. In cases where the regulatory capital requirements under Pillar 1 would not sufficiently reflect the risks to which an AI is exposed in respect of its securitization exposures, the MA

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 155 may consider the need to increase the AI’s capital requirements under the SRP. E2.5 Among other things, the MA may review where relevant: ⚫ an AI’s own assessment of its capital needs and how that has been reflected in the capital calculation as well as the documentation of securitization transactions. This facilitates the MA to determine whether the capital requirements accord with the AI’s risk profile (e.g. substitution clauses); ⚫ the manner in which an AI has addressed the issue of maturity mismatch in relation to retained securitization positions in its economic capital calculations as well as any structuring of maturity mismatches in transactions to artificially reduce capital requirements; and ⚫ an AI’s economic capital assessment of actual correlation between underlying exposures in the pool and how that has been reflected in the capital calculation. Where the MA considers that an AI’s approach is not adequate, he will determine what appropriate action should be taken, which may include denying capital relief in the case of originated assets or increasing the AI’s capital requirements against securitization exposures acquired by the AI. Risk evaluation and management E2.6 During the 2007/2008 Global Financial Crisis, weaknesses in certain banks’ risk management of securitization activities resulted in large unexpected losses. To help mitigate these risks, an AI’s on- and off-balance sheet securitization activities should be included in its risk management disciplines, such as product approval, risk concentration limits, and assessments of risks associated with such activities, including credit, market, operational, reputation and liquidity risks.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 156 E2.7 AIs should conduct their own analyses of the underlying risks when investing in securitization products and should not solely rely on the external credit ratings assigned to such products by the credit rating agencies. AIs should be mindful that, whilst external ratings are a useful starting point for credit analysis, they are no substitute for a full and proper understanding of the underlying risks, especially where the ratings for certain asset classes have a short history or have been shown to be volatile. AIs should also be alert to, and cautious of, situations where deterioration in the quality of a securitization product may not be promptly and properly reflected in the rating. As such, AIs should conduct credit analysis of a securitization exposure at the time of acquisition and on an ongoing basis, and have in place the necessary quantitative tools, valuation models and stress tests of sufficient sophistication to reliably assess all relevant risks. E2.8 To facilitate their assessment of securitization transactions, AIs should have the necessary procedures in place to capture in a timely manner updated information on such transactions, including market data, if available, and updated performance data from the securitization trustee or servicer. In addition, AIs should ensure that they fully understand the credit quality and risk characteristics of the underlying exposures in securitization transactions generally, including any risk concentrations. They should also review the maturity of the exposures underlying securitization transactions relative to the issued liabilities in order to assess potential maturity mismatches. E2.9 AIs should track credit risk in securitization exposures at the transaction level, within each business line and across business lines, and produce reliable measures of aggregate risk. They should also track all meaningful concentrations in securitization exposures, such as name, product or sector concentrations, and feed this information into firm-wide risk aggregation systems that track, for example, credit exposure to a particular obligor. E2.10 AIs’ own risk assessments need to be based on a comprehensive understanding of the structure of securitization transactions. In performing such assessments, AIs should

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 157 identify the various types of triggers, credit events and other legal provisions that may affect the performance of their on- and off￾balance sheet exposures and integrate these triggers, credit events and provisions into their credit, liquidity and balance sheet management. The impact of the events or triggers on their liquidity and capital positions should also be considered. E2.11 As market-wide disruptions may pose difficulty to the securitization of warehoused or pipeline exposures, AIs should, as part of their risk management processes, consider and, where appropriate, mark-to-market warehoused positions as well as those in the pipeline. They should also consider scenarios which may prevent them from securitizing their assets as part of their stress-testing, and identify the potential effect of such exposures on their liquidity position, earnings and capital adequacy. E2.12 AIs should develop prudent contingency plans specifying how they would respond to funding, capital and other pressures that may arise when access to securitization markets is reduced. Contingency plans should also address how AIs would address valuation challenges for potentially illiquid positions held for sale or for trading purposes. The risk measures, stress-testing results and contingency plans should be incorporated into AIs’ risk management processes and CAAP, and should result in an appropriate level of capital in excess of the minimum capital requirements under Pillar 1. E2.13 AIs that employ risk mitigating techniques to reduce their risks arising from securitization activities should fully understand the risks to be mitigated, the potential effects of risk mitigation, whether the mitigation is fully effective and the risks which may arise from the risk mitigation itself. This is to help ensure that they do not understate the true level of risk in their capital assessment (see Annex G for guidance on high cost credit protection transactions which may be relevant to securitization exposures). In particular, AIs should consider whether they would realistically be compelled to provide support to the securitization structures in stressed scenarios due to their

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 158 reliance on securitization as a funding tool or for other reputational or strategic reasons. Reputational risk and implicit support38 arising from securitizations39 E2.14 Prior to the 2007/2008 Global Financial Crisis, many banks failed to recognise the reputation risk associated with their off-balance sheet vehicles. In order to preserve their reputation, some of them felt compelled to provide liquidity support, going beyond their contractual obligations, to their structured investment vehicles (“SIVs”) or to purchase asset-backed commercial paper (“ABCP”) issued by their sponsored vehicles. By providing this implicit support, these banks signalled to the market that the risks inherent in the assets held by off-balance sheet vehicles were essentially still held by the banks and, in effect, had not been transferred. As a result of the provision of the support, the banks not only assumed additional credit, market and liquidity risks, but also put pressure on their capital ratios. E2.15 Consequently AIs should incorporate exposures that could give rise to reputation risk into their assessments of whether the requirements for recognition of risk transference under the securitization framework within Pillar 1 have been met and the potential adverse impact of providing implicit support. AIs’ processes for approving new products and strategic initiatives should also consider the potential provision of implicit support. Further, they should incorporate the risks arising from such exposures into their risk management processes and appropriately address them in their CAAP and liquidity contingency plans. 38 Implicit support arises when an AI provides any direct or indirect support to investors in a transaction in excess of its predetermined contractual obligations. Such non-contractual support exposes the AI to the risk of loss, such as loss arising from deterioration in the credit quality of the transaction’s underlying exposures. 39 See HKMA’s Q&As on securitization for more detailed guidance on implicit support and recognition of significant credit risk transfer (https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20180326-4- EN/20180326-4-EN.pdf).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 159 E2.16 To support the process described in subsection E2.15, AIs should have effective policies and procedures in place to identify potential sources of reputation risk in respect of any of their securitization activities. In identifying such potential sources, AIs should pay particular attention to their sponsorship of securitization structures such as ABCP conduits and SIVs, as well as the sale by the AI of credit exposures to securitization trusts. Reputation risk may arise as described in subsection E2.14. E2.17 AIs should take account of the sources of reputation risk mentioned above in conducting their stress tests in order to enable the Board and senior management to have a firm understanding of the consequences and second-round effects of reputation risk arising from securitization activities (see Annex D for details). E2.18 AIs should also remain mindful of the potential regulatory consequences of providing implicit support to investors in securitization transactions that they have originated. Under §234 of the BCR, if an AI provides implicit support to a securitization transaction, it must calculate its CAR as if the underlying exposures of the transaction were not securitized. If the AI provides or has provided implicit support to more than one securitization transaction, the MA may require the AI to treat all or some of those other securitization transactions in a manner as if they failed to satisfy the requirements for recognition of credit risk transfer set out in Schedules 9 and 10 to the BCR or may exercise his power under §97F of the Banking Ordinance to vary any capital requirement rule applicable to the AI, including by increasing all or any of the AI’s minimum CAR. Significance of risk transfer40 E2.19 If an AI wants to obtain the capital relief provided under §230 of the BCR in respect of a securitization transaction that the AI has originated, the requirements set out in Schedule 9 or 10 to the 40 See footnote 39.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 160 Rules, as the case requires, must be met. In particular, the transfer of credit risk associated with the underlying exposures in the transaction from the AI to third parties must be significant. If the MA considers that the risk transfer under a securitization transaction is not significant, the MA may consider the need for increasing the AI’s capital requirements to cover any additional risk not already accounted for in the capital requirements calculated under Pillar 1. E2.20 An originating AI that has obtained capital relief for a securitization transaction under §230 of the BCR may be required by the MA, for SRP purposes, to demonstrate that significant credit risk associated with the underlying exposures in the transaction has been transferred to third parties. The MA is likely to have concerns in any cases where it appears that a significant amount of risk is retained or repurchased by the originating AI (after taking into consideration any retained amount or repurchase commitment that is necessary for complying with the regulatory retention requirements applicable to the transaction), especially if this relates to unrated exposures41. The MA will expect a significant portion of credit risk to be transferred to at least one independent third party, both at the inception of the transaction and on an ongoing basis. The MA will, for this purpose, have regard to all relevant factors, including whether a significant portion of the nominal value of the pool of underlying exposures has been transferred in the process. Where AIs repurchase risk for market-making purposes, the repurchase should be confined to part of a transaction and should not, for example, extend to the repurchase of a whole tranche. Moreover, positions repurchased for market-making purposes should be resold within an appropriate period. 41 In this situation, it is likely that both the poorer quality unrated assets (usually the originator retains the first loss) and most of the credit risk embedded in the underlying exposures will remain with the originating AI.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 161 Market innovations E2.21 As the Pillar 1 requirements for securitization exposures (re Part 7 of the BCR) may not be adequate to address all potential issues associated with such exposures, the MA will consider new features of securitization transactions as they arise, and determine as part of the SRP whether additional capital needs to be maintained by AIs for such transactions. The MA’s assessment will include any potential impact that the new features of securitization transactions may have on credit risk transfer. Call provisions E2.22 The MA expects an AI not to make use of clauses that entitle the AI to call a securitization transaction, or allow a credit protection to lapse, prematurely if this would increase the AI’s exposure to losses or deterioration in the credit quality of the underlying exposures. E2.23 In addition, the MA expects AIs to only execute clean-up calls42 for economic business purposes, such as when the cost of servicing the underlying exposures exceeds the benefit of servicing the exposures. E2.24 AIs should also be aware that certain clean-up calls may constitute implicit support, and hence be subject to the measures set out in §234 of the BCR. According to paragraph (b) of the definition of “implicit support” in §227(1) of the BCR, implicit support includes any clean-up call the exercise of which by the originating AI is found to provide credit enhancement to the transaction. 42 As defined in §227(1) of the BCR.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 162 Early amortization43 E2.25 The MA will assess how AIs internally measure, monitor, and manage risks associated with securitizations of revolving credit facilities. In particular, the MA will place significant emphasis on internal management and controls, as well as risk monitoring activities, with respect to securitization transactions with early amortization features, including how an AI assesses the risk and likelihood of early amortization of such transactions. E2.26 The MA expects the sophistication of an AI’s system for monitoring the likelihood and risks of an early amortization event to be commensurate with the size and complexity of the AI’s securitization activities that involve early amortization provisions. E2.27 At a minimum, AIs are expected to (i) implement reasonable methods for allocating economic capital against the economic substance of the credit risk arising from revolving securitizations; and (ii) have adequate capital and liquidity contingency plans that evaluate the probability of an early amortization occurring and address the implications of both scheduled and early amortization. E2.28 Because most early amortization triggers are tied to excess spread44 levels, the factors affecting these levels should be well understood, monitored, and managed, to the extent possible, by originating AIs in securitization transactions with early 43 As defined in §227(1) of the BCR, "early amortization provision", in relation to a securitization transaction in which the underlying exposures are revolving in nature, means a mechanism which, once triggered, allows investors in the securitization issues to be paid out prior to the originally stated maturity of the securitization issues held by the investors. 44 Excess spread refers to interest and other income derived by the special purpose entity in a securitization transaction from the underlying exposures in the transaction in excess of the transaction costs (e.g. servicing fees) and any interest payments and charge-offs incurred or made by the entity, as specified in the documentation for the transaction, expressed as a percentage of the underlying exposures.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 163 amortization features. For example, the following factors affecting excess spread should generally be considered: • interest payments made by obligors of the underlying exposures; • other fees and charges to be paid by obligors of the underlying exposures (e.g. late payment fees, cash advance fees and over-limit fees); • gross charge-offs; • principal payments; • recoveries on charged-off loans; • interchange income; • interest paid on investors’ certificates; and • macroeconomic factors such as bankruptcy rates, interest rate movements, unemployment rates, etc. E2.29 AIs should consider the effects that changes in portfolio management or business strategies may have on the levels of excess spread and on the likelihood of an early amortization event. For example, marketing strategies or underwriting changes that result in lower finance charges or higher charge￾offs, might also lower excess spread levels and increase the likelihood of an early amortization event. E2.30 AIs should use techniques such as static pool cash collections analyses and stress tests to better understand pool performance. These techniques can highlight adverse trends or potential adverse impacts. AIs should have policies in place to respond promptly to adverse or unanticipated changes. The MA will take appropriate action where he does not consider these policies adequate, such as directing an AI to obtain a dedicated liquidity line or increasing the AI’s capital requirements.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 164 Annex F: Assessment of risk concentrations under CAAP F1 Introduction F1.1 Risk concentrations can arise in an AI’s assets, liabilities or off￾balance sheet items, through the execution or processing of transactions (either product or service), or through a combination of exposures across these broad categories. Unmanaged risk concentrations are an important cause of major banking problems. AIs should have comprehensive policies and procedures in place to identify and assess risk concentrations, and incorporate an appropriate level of capital for risk concentrations in their CAAP. F1.2 An AI’s assessment of risk concentrations under its CAAP should not be a mechanical process. The AI should determine how to conduct this assessment, having regard to its business model and its own specific vulnerabilities. F1.3 AIs are expected to comply with the supervisory requirements set out in section F2 when assessing and managing their risk concentrations. As part of the SRP, the MA reviews AIs’ compliance with the supervisory requirements and evaluates the appropriateness of the level of capital they have set aside for risk concentrations. F2 Supervisory requirements F2.1 AIs should consider not only the obvious “traditional concentrations”, but also concentrations based on common or correlated risk factors that reflect more subtle or more situation￾specific factors than traditional concentrations, such as correlations between credit, market and liquidity risks. The typical situations in which risk concentrations can arise include: • exposures to a single counterparty, borrower or group of connected counterparties or borrowers;

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 165 • exposures to industry or economic sectors, including exposures to both regulated and non-regulated financial institutions such as hedge funds and private equity firms; • exposures to geographical regions; • exposures arising from credit risk mitigation techniques, including exposure to similar collateral types or to credit protection providers whose creditworthiness is closely related to the performance of assets or exposures for which credit protection is purchased due to “wrong-way risk”; • trading or market risk exposures; • exposures to counterparties (e.g. hedge funds and hedge counterparties) through the execution or processing of transactions (either product or service); • undue reliance on particular funding sources; • holding of assets in the banking book or trading book, such as loans, derivatives and structured products; and • off-balance sheet exposures, including guarantees, liquidity facilities and other commitments. F2.2 AIs should have effective internal polices, systems and controls in place to identify, measure, monitor, control and mitigate their risk concentrations in a timely manner. In identifying and assessing risk concentrations, not only should normal market conditions be considered, but also the potential build-up of concentrations under stressed market conditions, economic downturns and periods of general market illiquidity. Where applicable, AIs should assess scenarios that consider possible concentrations arising from contractual and non-contractual contingent claims. AIs with significant involvement in originating exposures for securitization or other structured credit product related purposes should assess scenarios that combine the

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 166 potential build-up of pipeline exposures together with the loss of market liquidity and a significant decline in asset values. F2.3 AIs should be able to identify and aggregate similar risk exposures across the organisation, including across business lines 45 , asset types (e.g. loans, derivatives and structured products), risk areas (e.g. the trading book) and geographical regions through their risk management processes and MIS. The Board and senior management of AIs should analyse and understand the firm-wide risk concentrations identified. In the case of a local banking group which adopts a CAAP covering the positions of their subsidiary AIs, risk concentrations should be analysed on both solo and consolidated bases, as an unmanaged concentration at a subsidiary AI may appear immaterial at the consolidated level, but could threaten the viability of the subsidiary operation. F2.4 Whilst risk concentrations often arise due to direct exposures to borrowers and obligors, an AI may also incur a concentration on a particular asset type indirectly through investments backed by such assets (e.g. collateralised debt obligations) as well as exposure to protection providers which guarantee the performance of the specific asset type (e.g. monoline insurers). AIs should have adequate, systematic procedures in place for identifying high correlations between the creditworthiness of a protection provider and the obligors of the underlying exposures due to their performance being dependent on common factors beyond general systemic risk (i.e. “wrong-way risk”). F2.5 AIs should employ a number of techniques, as appropriate, to measure risk concentrations. These techniques include sensitivity analysis by applying shocks to various risk factors, use of business level and firm-wide scenarios, and use of integrated stress-testing and economic capital models. Identified concentrations should be measured in a number of 45 An example from the 2007/2008 Global Financial Crisis would be subprime exposure in lending portfolios, counterparty exposures, conduit exposures and structured investment vehicles, contractual and non-contractual exposures, trading activities, and underwriting pipelines.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 167 ways, including for example consideration of gross versus net exposures, use of notional amounts, and analysis of exposures with and without counterparty hedges. F2.6 When conducting regular stress tests, AIs should incorporate all major risk concentrations and identify and respond to potential changes in market conditions that could adversely impact their performance and capital adequacy. F2.7 AIs should establish internal position limits for concentrations to which they may be exposed. Similar exposures should be aggregated across business platforms (including the banking and trading books) to determine whether there is a concentration or a breach of an internal position limit. Procedures should also be in place to identify any limit breaches and promptly report such breaches to senior management, as well as to ensure that appropriate follow-up actions are taken. F2.8 AIs should have credit risk mitigation strategies in place that have senior management approval. This may include altering business strategies, reducing limits or increasing capital buffers in line with the desired risk profile. Whilst implementing risk mitigation strategies, AIs should be aware of possible concentrations that might arise as a result of employing risk mitigation techniques. F2.9 AIs should have an appropriate infrastructure and MIS that allow for the aggregation of exposures and risk measures across business lines and support customised identification of concentrations and emerging risks. Procedures should also be in place to communicate risk concentrations to the Board and senior management in a manner that clearly indicates where in the organisation each segment of a risk concentration resides.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 168 Annex G : Assessment of high cost credit protection transactions under SRP G1 Introduction G1.1 Credit risk mitigation techniques are recognised in the calculation of credit risk under the capital adequacy framework. However, potential for regulatory capital arbitrage has been identified through the use of high cost credit protection transactions. This annex: • highlights the issues associated with such transactions; • sets out the factors that AIs should take into account in analysing any such transactions that they may use for the purpose of credit risk mitigation or transfer of credit risk; and • describes the MA’s approach to scrutiny of any such transactions entered into by an AI in his assessment of the AI’s capital adequacy under the SRP. G2 High cost credit protection transactions G.2.1 High cost credit protection transactions typically involve (i) a delay in recognising losses and the costs of protection in earnings by an AI which has purchased the credit protection; and (ii) an immediate regulatory capital benefit being received by that AI in the form of a lower risk weight on an exposure on which it is nominally transferring risk. G2.2 In some of these transactions, the premiums or fees and other direct or indirect costs paid for credit protection, combined with other terms and conditions, call into question the degree of credit risk mitigation or credit risk transfer of the transaction. Rather than contributing to a prudent risk management strategy, the primary effect of such transactions may be to embed a high percentage of expected losses into the premiums and fees paid, under the premise that the transaction would receive favourable risk-based capital treatment in the short term and defer

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 169 recognition of losses over an extended period, without meaningful risk mitigation or transfer of risk. G2.3 As an example, assume that an AI purchases credit protection on a first loss retained securitization position where the cost of protection is equal to the recorded value of the securitization tranche on which protection is being purchased or where the terms and conditions of the contract ensure that the premiums paid throughout the life of the contract will equal the amount of the realised losses. Regulatory capital arbitrage may exist where the immediate capital relief recognised for the purchased credit protection ultimately will be offset by the premiums paid and recognised in earnings over the life of the contract. G2.4 Whilst the above example focuses on the use of credit risk mitigation in a securitization transaction, arbitrage opportunities exist more generally under the credit risk mitigation framework. However, arbitrage opportunities are more likely to occur when credit risk mitigation techniques are used for securitization transactions where the difference in the risk weight before and after purchasing protection can be significant. G3 Supervisory requirements General G3.1 AIs should consider the relevant costs of any credit protection they purchase, whether in the context of the securitization framework or within the credit risk mitigation framework, when assessing their capital adequacy. G3.2 In the case of credit protection transactions that have unusually high cost or innovative features, AIs should further analyse and document the economic substance of such transactions to assess the degree of risk transference and the associated impact on their overall capital adequacy. The analysis should also specify how such transactions align with their overall risk management strategy.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 170 G3.3 AIs should bring to the attention of the MA any high cost or innovative transactions that fall within subsection G2.2 to ensure they are subject to appropriate prudential treatment. Specific factors to be considered G3.4 In evaluating the degree of credit risk mitigation or credit risk transfer of a transaction, an AI should consider, among other things: • a comparison of the present value of premiums and other costs not yet recognised in capital relative to the expected losses in respect of the protected exposures over a variety of stress scenarios; • the pricing of the transaction relative to market prices, including appropriate consideration of non-cash premium payments; • the timing of payments under the transaction by the protection buyer, including potential timing differences between the AI’s provisioning for, or write-downs of, the protected exposures and payments by the protection seller; • a review of applicable call dates to assess the likely duration of the credit protection relative to the potential timing of future credit losses; • an analysis of whether certain circumstances could lead to the AI’s increased reliance on the counterparty at the same time that the counterparty’s ability to meet its obligations is weakened; and • an analysis of whether the AI can prudently afford the premiums given its earnings, capital, and overall financial condition.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 171 Supervisory assessment G3.5 An AI’s analysis of its credit protection transactions will be assessed by the MA under the SRP. In particular, the MA may review any internal memos or records outlining the rationale for a credit protection transaction and the AI’s analysis of the anticipated costs and benefits of the transaction. G3.6 The MA will pay particular attention to credit protection transactions that exhibit the characteristics stated below. • Protection premiums are high relative to the amount of the exposures being protected – for example, when the cost of protection over the life of the protection contract equals, or exceeds, the amount of the exposures for which protection is being purchased. Rebate mechanisms (i.e. where the protection seller agrees to refund parts of the premium to the protection buyer according to the performance / deterioration of the protected exposure) will, prima facie, be regarded as an indication of excessive premium and, consequently, regulatory arbitrage. • Transactions where the exposure being protected has not been fair valued and losses on the exposure have not been recognised in earnings – this situation can increase the potential for a transaction to involve regulatory capital arbitrage in the form of deferral of loss recognition. • Transactions where the potential for reduction in risk weight or regulatory capital as a result of the transaction is greatest – this is most likely in transactions where the exposures for which protection is purchased would otherwise be assigned a high risk weight, for example, exceeding 150%. Nevertheless, the potential for arbitrage still exists for relatively lower risk-weighted reference exposures, and the MA will also focus on individual transactions that raise concerns due to unique deal features.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 172 • Protection premiums are not proportional to the exposures being protected – this can occur, for example, when (i) premiums are guaranteed over time without respect to write￾downs or default of the reference exposure (i.e. the premium payments are not a proportion of the amount of positions of the protected portfolio that are still performing); or (ii) upfront premiums or premiums payable at termination have not been recognised in retained earnings. • Structural features of the transaction that can increase the total cost of credit risk mitigation – these features can include (i) high transaction costs for the protection buyer; (ii) obligations of the protection buyer to the counterparty to post additional collateral; (iii) additional payments at maturity required of the protection buyer; and (iv) early termination of the transaction at the option of the protection buyer. Other features that should lead to increased scrutiny include pre-agreed mechanisms, for example “at-market unwinds”, where the protection seller and protection buyer agree that the transaction can be terminated in the future at an agreed upon “market” value where calculation of the “market” value is pre-specified. G3.7 The MA will also review the appropriateness of an AI’s approach to the recognition of credit protection for first loss credit enhancements in respect of securitization transactions (see the example in subsection G2.3). In such cases it is likely that expected loss on the first loss positions will still be retained by the AI even if it has bought credit protection given that the pricing for such protection will reflect the higher risk involved. Therefore, the MA will expect an AI’s policies to take account of this in determining its economic capital.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 173 Annex H : Assessment of counterparty credit risk under CAAP / SRP H1 Introduction H1.1 Whilst CCR is a type of credit risk, it differs from traditional credit risk in that an economic loss would only occur to an AI if a transaction, or a portfolio of transactions, with a counterparty has a positive economic value to the AI at the time of default of that counterparty. Hence, unlike an AI’s exposure to credit risk through a loan, where the exposure to credit risk is unilateral and only the lending AI faces the risk of loss, CCR creates a bilateral risk of loss, i.e. the market value of the transaction can be positive or negative to either counterparty to the transaction. The market value is uncertain and can vary over time with the movement of underlying market factors. H1.2 Under the BCR, AIs are required to maintain regulatory capital for its CCR. Subject to the MA’s approval, AIs may adopt a modelling approach (i.e. the IMM(CCR) approach) to the calculation of CCR or a VaR model for the calculation of CCR arising from securities financing transactions (SFTs). H1.3 In assessing an AI’s CCR under the SRP, the MA will focus substantially on the adequacy and effectiveness of the AI’s CCR management systems, especially in respect of the key elements mentioned in subsections H2.1 to H2.9 of this annex. The MA’s approach to assessing AIs’ use of the IMM(CCR) approach, and dealing with any issues identified, is also highlighted in this annex. Regarding the VaR model for SFTs, the factors that would be considered by the MA for SRP purposes would essentially be similar to those for the IMA. H1.4 Another area of assessment under the SRP relates to an AI’s exposure to central counterparties, which may be a potential source of CCR for the AI’s centrally cleared trade exposures. This annex provides guidance on AIs’ assessment of such

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 174 exposures under their CAAP, as well as the MA’s approach towards such exposures under the SRP. H2 Supervisory requirements CCR systems and controls H2.1 An AI should have CCR management policies, processes and systems that are conceptually sound and implemented with integrity and that are proportionate to the sophistication and complexity of the AI’s holdings of exposures that give rise to CCR. A sound CCR management framework should include the identification, measurement, management, approval and internal reporting of CCR, with designated units for independent risk control and collateral management. See CR-G-13 “Counterparty Credit Risk Management” for more details. H2.2 An AI’s risk management policies should take account of the market, liquidity, legal, operational and other risks that can be associated with CCR and, to the extent practicable, inter￾relationships among those risks. The AI should not undertake business with a counterparty without assessing its creditworthiness and should take due account of both settlement and pre-settlement credit risk. These risks should be managed as comprehensively as practicable at the counterparty level (aggregating counterparty exposures with other credit exposures) and at the firm-wide level. H2.3 The Board and senior management of an AI should be actively involved in the CCR control process and should regard this as an essential aspect of the business to which significant resources need to be devoted. H2.4 An AI should prepare daily reports on its exposures to CCR, which should be reviewed by a level of management with sufficient seniority and authority to enforce both reduction of

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 175 positions taken by individual credit managers or traders and reduction in the AI’s overall CCR exposure. H2.5 An AI’s CCR management system should be used in conjunction with the AI’s internal credit and trading limits which should be related to its risk measurement model in a manner that is consistent over time and that is well understood by credit managers, traders and senior management. H2.6 The measurement of CCR should include monitoring daily and intraday usage of credit lines. An AI should measure current exposure (gross and net of collateral held) where such measures are appropriate and meaningful (e.g. for OTC derivatives, margin lending, etc.). The AI should take account of large or concentrated positions, including concentrations by groups of related counterparties, by industry, by market, customer investment strategies, etc. H2.7 An AI should have a routine and rigorous programme of stress￾testing in place as a supplement to the CCR analysis based on the day-to-day output of its risk measurement model. The results of stress-testing should be reviewed periodically by the Board and senior management and be reflected in the CCR policies and limits set by senior management and the Board. Where stress tests reveal particular vulnerability to a given set of circumstances, management should explicitly consider appropriate risk management strategies (e.g. by hedging against that outcome, or reducing the size of the AI’s exposures). H2.8 An AI’s internal policies, controls and procedures concerning the operation of the CCR management system should be well documented, for example, through a risk management manual that describes the basic principles of the risk management system and that provides an explanation of the empirical techniques used to measure CCR. These policies and

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 176 procedures should be subject to periodical review to ensure they remain adequate and appropriate. H2.9 An AI should conduct an independent review of the CCR management system (including any internal models used for CCR management and/or capital calculation purposes) regularly through its internal auditing process (ideally not less than once a year). This review should include both the activities of the credit and trading units and of the independent CCR control unit 46 , and should specifically address, at a minimum, the following aspects: • the adequacy of the documentation of the CCR management system and process; • the organisation and effectiveness of the independent CCR control unit and collateral management unit47 mentioned in subsection H2.1; • the integration of CCR measures into daily risk management; • the approval process for risk pricing models and valuation systems used by front and back-office personnel; • the validation of any significant change in the CCR measurement process; • the scope of CCR captured by the risk measurement model; • the integrity of the MIS produced for risk monitoring and reporting purposes; 46 The maintenance of this control function for CCR management purposes is generally required under CR￾G-13 “Counterparty Credit Risk Management” (see section 9.4 of the module for a detailed description of this function and its responsibilities). 47 This unit performs the function of collateral management and margining related operations.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 177 • the accuracy and completeness of CCR data; • the accurate reflection of legal terms in collateral and netting agreements into exposure measurements; • the verification of the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources; • the accuracy and appropriateness of volatility and correlation assumptions; • the accuracy of valuation and risk transformation calculations; and • the verification of the model’s accuracy through frequent back-testing. In the case of AIs which adopt the IMM(CCR) approach, the review should also cover relevant requirements set out in Schedule 2A of the BCR. Use of IMM(CCR) approach H2.10 An AI that uses the IMM(CCR) approach to calculate its default risk exposures should monitor the appropriate risks and have processes to adjust its estimation of effective expected positive exposure (“effective EPE”) 48 , when those risks become significant. This includes the following: • the AI should identify and manage its exposures to specific wrong-way risk; • for exposures with a rising risk profile after one year, the AI should compare on a regular basis the estimate of effective 48 Effective EPE, in relation to a netting set, refers to the amount calculated in accordance with §226F of the BCR.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 178 EPE over one year with the effective EPE over the life of the exposure; and • for exposures with a short-term maturity (below one year), the AI should compare on a regular basis the replacement cost (current exposure) and the realised exposure profile, and/or store data that allow such comparisons. H2.11 Senior management of an AI should be aware of the limitations and assumptions of the internal model used for CCR and the impact these can have on the reliability of the model output. They should also consider the uncertainties of the market environment (e.g. the timing of realisation of collateral) and operational issues (e.g. pricing feed irregularities) and how these are reflected in the model. H2.12 In assessing an internal model used to estimate effective EPE, the MA will review the characteristics of the AI’s portfolio of exposures that give rise to CCR, in particular: • the diversification of the portfolio (number of risk factors to which the portfolio is exposed); • the correlation of default across counterparties; and • the number and granularity of counterparty exposures. H2.13 The MA expects an AI to have a robust limit monitoring system that includes the measurement and monitoring of peak exposure or potential future exposure at a confidence level chosen by the AI at both the portfolio and counterparty levels. H2.14 The MA will assess whether an AI using the IMM(CCR) approach continues to comply with Schedule 2A to the BCR, which specifies the minimum requirements to be satisfied for

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 179 approval under §10B(2)(a) of the Rules to use the IMM(CCR) approach (see also subsection B1.3 of Annex B). H2.15 The MA will determine the appropriate action to be taken where an AI’s estimates of default risk exposures under the IMM(CCR) approach do not adequately reflect the AI’s exposure to CCR. Such action might include directing the AI to revise its estimates, directing it to apply a higher estimate of default risk exposures or a higher alpha factor under the IMM(CCR) approach, or disallowing it from recognising internal estimates of default risk exposures for regulatory capital purposes. Exposures to central counterparties H2.16 A central counterparty (“CCP”) is a clearing house that interposes itself between counterparties to contracts traded in one or more financial markets, becoming the buyer to every seller and the seller to every buyer and thereby ensuring the future performance of open contracts. H2.17 Given the significance of CCPs to financial markets, it is important for individual CCPs to have robust risk management systems and be subject to adequate regulations49 in jurisdictions in which they are based and prudentially supervised. Under the BCR, the capital treatment for an AI’s exposures to a CCP differs depending on whether that CCP is a qualifying CCP (“QCCP”). Generally, a QCCP is an entity that is licensed to operate as a CCP, is permitted by the appropriate regulator / overseer to operate as such with respect to the products offered, and satisfies certain other qualifying conditions (see the definition of QCCP set out in §226V(1) of the Rules for more details). H2.18 Where an AI has exposures to a CCP, regardless of whether that CCP is classified as a QCCP, the AI should ensure that it maintains adequate capital for such exposures. In conducting its internal capital assessment, the AI should consider whether 49 These regulations should be consistent with the CPSS-IOSCO Principles for Financial Market Infrastructures.

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 180 additional capital (i.e. in excess of minimum regulatory capital calculated under Pillar 1) needs to be held if, for example, (i) its dealings with the CCP give rise to more risky exposures; or (ii) where, in the context of its dealings with the CCP, it is unclear that the CCP meets the definition of a QCCP. H2.19 Where an AI is acting as a clearing member50, the AI should assess through appropriate scenario analysis and stress-testing whether the level of capital held against exposures to a CCP adequately addresses the inherent risks of those transactions. This assessment will include potential future or contingent exposures resulting from future drawings on default fund commitments, and/or from secondary commitments to take over or replace offsetting transactions from clients of another clearing member in the case of this clearing member defaulting or becoming insolvent. H2.20 An AI should monitor and report to the Board (or a designated committee) and senior management on a regular basis all of its exposures to CCPs, including exposures arising from trading through a CCP and exposures arising from CCP membership obligations such as default fund contributions51 . H2.21 Under the SRP, the MA may require AIs to hold additional capital against their exposures to a QCCP, for example, where an external assessment52 has found material shortcomings in the CCP or the regulation of CCPs in the jurisdiction concerned, and 50 As defined in §2(1) of the BCR, “clearing member”, in relation to a CCP, means (i) a member of, or a direct participant in, the CCP that is entitled to enter into a transaction with the CCP; or (ii) another CCP to which the CCP has a link (where a member of, or a direct participant in, that another CCP that is entitled to enter into a transaction with that another CCP is able to clear transactions through the CCP via the link). 51 As defined in §2(1) of the BCR, “default fund contribution”, in relation to a clearing member of a CCP, means (i) the funded or unfunded contribution made by the clearing member to the CCP’s mutualised loss-sharing arrangements; or (ii) the clearing member’s underwriting of the CCP’s mutualised loss￾sharing arrangements. 52 An example of external assessment is an assessment conducted by the International Monetary Fund under its Financial Sector Assessment Programme (i.e. FSAP).

Supervisory Policy Manual CA-G-5 Supervisory Review Process V.7 – 19.12.2025 181 the CCP and/or the CCP regulator have not since publicly addressed the issues identified. H2.22 Under the BCR, AIs must allocate a risk-weight of 1,250% to the default fund contributions to a non-qualifying CCP, and for that purpose, an AI’s default fund contributions must include the funded and unfunded contributions that the AI is liable to pay if the non-qualifying CCP requires the AI to do so. If the default fund contributions of an AI to a non-qualifying CCP consist of a binding commitment in respect of an unfunded default fund contribution to the CCP and the amount of the commitment is unlimited, the AI should (i) inform the MA of this situation; and (ii) determine the amount of commitment to which a 1,250% risk￾weight is to apply based on its own estimation unless the MA, by notice in writing given to the AI, requires the AI to take the action specified in subsection H2.23. H.2.23 Under the SRP, the MA will review the basis and methodology adopted by the AI to determine the amount of unfunded commitments to which a 1,250% risk-weight should apply under Pillar 1. If the MA considers that the amount used by the AI cannot fairly reflect the risk exposure of the AI’s commitment, the MA may, by notice in writing, require the AI to use another amount or to use the method specified by the MA to estimate the amount of the commitment to which a 1,250% risk-weight should apply.