Supervisory Review Process

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To (i) set out the MA’s1 approach to conducting the SRP under Pillar 2, including the criteria and standards used for evaluating an AI’s capital adequacy and, where applicable, the effectiveness of the AI’s CAAP, for the purposes of determining its Pillar 2 capital requirement; and (ii) describe how the Pillar 2 framework will operate under the capital adequacy framework Classification A statutory guideline issued by the MA under §7(3) of the Banking Ordinance Previous guidelines superseded CA-G-5 “Supervisory Review Process” (V.1) dated 10.11.06, (V.2) dated 04.06.10, and (V.3) dated 28.12.12 Application To all locally incorporated AIs Structure

1. Introduction
   1.1 Terminology
   1.2 Background and scope

1 In this module, the term “MA” refers to the “Monetary Authority” or the “Hong Kong Monetary Authority”, as the context so requires.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
1.3 Main objectives and principles
1.4 Implementation
2. The MA’s approach to supervisory review
2.1 General
2.2 Legal framework
2.3 Operation of Pillar 2 under capital adequacy framework
2.4 Key components of SRP
2.5 Supervisory arrangements
2.6 Application to local banking groups
2.7 Application to foreign bank subsidiaries
2.8 Review and notification of SRP results
3. Supervisory review of capital adequacy
3.1 General
3.2 Key factors for assessing capital adequacy
3.3 Setting of Pillar 2 capital requirement
3.4 The P2A and the P2B components of the Pillar 2 capital
requirement
3.5 Determination of §97F minimum CAR
3.6 Integration with risk-based supervisory process
3.7 Use of stress tests
3.8 Supervisory guidance on risk management practices
3.9 Ongoing monitoring of capital adequacy
4. Supervisory standards on CAAP
4.1 General
4.2 Internal control and governance
4.3 Key elements of CAAP
4.4 Additional criteria for use of risk-modelling techniques
4.5 Requirements for consolidated capital
4.6 Application to subsidiary AIs

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
4.7 Review by the MA
Annex A List of major supervisory guidelines applicable to assessment of
capital adequacy
Annex B Factors for assessing capital adequacy under SRP
Annex C Scoring worksheets to facilitate assessment under SRP
Annex D Supervisory requirements on application of stress tests under
CAAP
Annex E Assessment of securitization risk and off-balance sheet exposures
under CAAP / SRP
Annex F Assessment of risk concentrations under CAAP
Annex G Assessment of high cost credit protection transactions under SRP
Annex H Assessment of counterparty credit risk under CAAP / SRP

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

1. Introduction
   1.1 Terminology
   1.1.1 Abbreviations and other terms used in this module have
   the following meanings2
   :

• “Additional Tier 1 capital” means Additional Tier 1
  capital as defined in §39 of the Banking (Capital) Rules;
• “Banking (Capital) Rules” mean those rules made by
  the MA under §97C(1) of the Banking Ordinance for prescribing capital requirements for AIs incorporated in Hong Kong, taking into account the risks associated with the AIs;
• “basic approach”, in relation to the calculation of an
  AI’s credit risk, means the method of calculating that risk as set out in Part 5 of the Banking (Capital) Rules;
• “BCR buffer level” means the buffer level applicable
  to an AI under §3G of the Banking (Capital) Rules, and comprises (i) if the AI is a G-SIB or D-SIB, the CB ratio, CCyB ratio and HLA ratio; or (ii) in any other case, the CB ratio and CCyB ratio;
• “BCR minimum CAR” means the minimum CET1
  capital ratio, Tier 1 capital ratio and Total capital ratio prescribed in §3B of the Banking (Capital) Rules;
• “CAAP” means the capital adequacy assessment
  process that an AI uses to identify and measure the risks it faces and to assess how much capital is needed to support those risks;

2 To facilitate understanding by AIs, the meanings set out in this subsection in respect of certain terms defined in the Banking (Capital) Rules are recast, elaborated or simplified. AIs should refer to the Rules for the legal interpretation, as well as the most up-to-date definitions, of these terms.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• “CAR” means the capital adequacy ratio of an AI as
  defined in §3 of the Banking (Capital) Rules, which comprises three risk-weighted capital ratios, viz. CET1 capital ratio, Tier 1 capital ratio and Total capital ratio. Unless otherwise specified, any reference to CAR in this module should be read as a reference to the three ratios, both individually and collectively;
• “capital add-on”, in relation to an AI’s §97F minimum
  CAR, means that portion of the §97F minimum CAR which is in excess of the BCR minimum CAR. For the avoidance of doubt, the capital add-on referred to here is in terms of each of the three risk-weighted capital ratios that comprise the CAR. For example, under §3B of the Banking (Capital) Rules, the minimum CET1 capital ratio, Tier 1 capital ratio and Total capital ratio for 2015 onwards are set at 4.5%, 6% and 8% respectively. If the MA requires an AI to observe a higher minimum CET1 capital ratio (at 5.1%), Tier 1 capital ratio (at 6.8%) and Total capital ratio (at 9%) under §97F, the capital add-on for the AI in respect of each of the three ratios is respectively 0.6%, 0.8% and 1%. The MA determines the capital add-on of individual AIs as
  part of the SRP;
• “CB ratio” means the capital conservation buffer
  ratio specified in §3M of the Banking (Capital) Rules;
• “CCyB ratio” means the countercyclical capital
  buffer ratio calculated under §3O of the Banking (Capital) Rules;
• “CET1 capital” means Common Equity Tier 1 capital
  as defined in §38 of the Banking (Capital) Rules;
• “CET1 capital ratio” means the Common Equity Tier
  1 capital ratio defined in §2(1) of the Banking (Capital) Rules. This ratio, expressed as a

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 percentage, is the amount of an AI’s CET1 capital to the sum of the AI’s risk-weighted amount for credit risk, risk-weighted amount for market risk, and risk￾weighted amount for operational risk, as determined in accordance with the Banking (Capital) Rules;

• “counterparty credit risk” means counterparty default
  risk and CVA risk, as defined in §2(1) of the Banking (Capital) Rules;
• “counterparty default risk”, in relation to a derivative
  contract or securities financing transaction entered into by an AI with a counterparty, means the risk that the counterparty could default before the final settlement of the cash flows of the contract or transaction, as the case may be, as defined in §2(1) of the Banking (Capital) Rules;
• “CVA risk” means the risk of mark-to-market losses
  in a transaction with a counterparty arising from a change in the credit valuation adjustment for the counterparty, as defined in §226A of the Banking (Capital) Rules;
• “default risk exposure” means an AI’s exposure to
  the counterparty default risk of a counterparty, as defined in §2(1) of the Banking (Capital) Rules;
• “D-SIB” means a domestic systemically important
  authorized institution designated by the MA under §3U of the Banking (Capital) Rules;
• “G-SIB” means a global systemically important
  authorized institution designated by the MA under §3S of the Banking (Capital) Rules;
• “HLA ratio” means the higher loss absorbency ratio
  determined under §3V of the Banking (Capital) Rules (for a D-SIB), or determined under §3T of the Rules (for a G-SIB);

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• “IMM approach” means the method of calculating an
  AI’s market risk under the internal models approach as set out in Divisions 11 and 12 of Part 8 of the Banking (Capital) Rules;
• “IMM(CCR) approach” means the method of
  calculating an AI’s default risk exposure under the internal models (counterparty credit risk) approach as set out in Division 2 of Part 6A of the Banking (Capital) Rules;
• “internal capital” means the amount of capital that an
  AI holds and allocates internally as a result of the AI’s assessment of the risks it faces;
• “IRB approach” means the method of calculating an
  AI’s credit risk under the internal ratings-based approach as set out in Part 6 of the Banking (Capital) Rules;
• “P2A” means the portion of the Pillar 2 capital
  requirement that reflects risks not captured, or not adequately captured, in Pillar 1;
• “P2B” means the portion of the Pillar 2 capital
  requirement that provides a cushion of capital to bolster resilience in times of stress (and hence should be allowed to be used in such times) without reference to specific risks considered under P2A;
• “Pillar 1” means the framework set out in the Banking
  (Capital) Rules for calculating the BCR minimum CAR that an AI should maintain in respect of credit, market and operational risks;
• “Pillar 2” means the framework set out in this
  module for determining any additional capital that an AI should hold principally to cover risks not captured, or risks not adequately captured, under Pillar 1. This framework has two key elements: (i)

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 the CAAP conducted by AIs and (ii) the SRP undertaken by the MA;

• “Pillar 2 capital requirement” means the capital
  requirement that an AI is required to meet in respect of its Pillar 2 risks, as derived from the SRP. This capital requirement will form the basis for determining an AI’s §97F minimum CAR (i.e. its CET1 capital ratio, Tier 1 capital ratio, and Total capital ratio) and §97F buffer level (if applicable);
• “Review Tribunal” means the Banking Review
  Tribunal established by §101A of the Banking Ordinance. An AI aggrieved by a decision made by the MA in relation to the AI, to which §101B applies, may apply to the Tribunal under §101B of the Ordinance for a review of the decision. The MA’s decision under §97F of the Ordinance is a decision to which §101B applies;
• “§97F buffer level” means the buffer level set by the
  MA for an individual AI pursuant to §97F of the Banking Ordinance;
• “§97F minimum CAR” means the minimum CET1
  capital ratio, Tier 1 capital ratio and Total capital ratio set by the MA for an individual AI pursuant to §97F of the Banking Ordinance;
• “SRP” means the supervisory review process
  conducted by the MA for the purposes of evaluating and monitoring the capital adequacy of individual AIs, and of determining their Pillar 2 capital requirement;
• “STM approach” means the method of calculating an
  AI’s market risk under the standardized (market risk) approach as set out in Part 8 of the Banking (Capital) Rules;
• “Tier 1 capital ratio” means the Tier 1 capital ratio
  defined in §2(1) of the Banking (Capital) Rules. This

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 ratio, expressed as a percentage, is the amount of an AI’s Tier 1 capital to the sum of the AI’s risk￾weighted amount for credit risk, risk-weighted amount for market risk and risk-weighted amount for operational risk, as determined in accordance with the Banking (Capital) Rules;

• “Tier 2 capital” means Tier 2 capital as defined in
  §40 of the Banking (Capital) Rules;
• “Total capital ratio” means the Total capital ratio
  defined in §2(1) of the Banking (Capital) Rules. This ratio, expressed as a percentage, is the amount of an AI’s Total capital to the sum of the AI’s risk￾weighted amount for credit risk, risk-weighted amount for market risk and risk-weighted amount for operational risk, as determined in accordance with the Banking (Capital) Rules.
  1.2 Background and scope
  1.2.1 The MA has conducted the SRP on AIs since 1 January
  2007 as part of its risk-based supervisory process. The main purposes of the SRP are to assess AIs’ capital adequacy and determine if they should hold additional capital to cater for risks that are not covered, or not adequately covered, under Pillar 1. The scope and extent of applying the assessment standards and criteria under the SRP are commensurate with the nature, size and complexity of the business operations of individual AIs.
  1.2.2 The basic elements of the SRP are embedded in the
  MA’s supervisory framework. With the power conferred upon him under §97F of the Banking Ordinance3 , the MA

3 §97F of the Banking Ordinance provides the MA with the power to vary any capital requirement rule (which includes the BCR minimum CAR and the BCR buffer level) applicable to an AI if he is satisfied, on reasonable grounds, that it is prudent to make the variation, taking into account the risks associated with the AI.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 may require AIs to observe a minimum CAR4 in excess of the BCR minimum CAR, and where necessary also a buffer level higher than the BCR buffer level, depending on the MA’s assessment of the risk profile of individual AIs. This is with the aim of assigning a minimum CAR and a buffer level to each AI that reflects more precisely the range of risks associated with the AI and to which it is potentially exposed.
1.2.3 A major feature of the SRP is the use by the MA of a
detailed and rigorous assessment framework for setting the §97F minimum CAR and the §97F buffer level (where applicable) of individual AIs, taking into account their overall risk profile and risk management systems, the extent to which they are associated with, or exposed to, risks that are outside the realm of Pillar 1 and, the effectiveness of their CAAP.
1.2.4 This module sets out the approach that the MA adopts in
conducting the SRP, including a description of:

• the main principles and objectives underlying the
  SRP;
• the key assessment factors that the MA considers in
  determining the Pillar 2 capital requirement, and the supervisory arrangements and procedures associated with the assessment;
• the supervisory approach to reviewing the CAAP of
  individual AIs, including the standards and requirements expected of them; and
• the process for ongoing monitoring of AIs’ capital
  adequacy and compliance with the Banking (Capital) Rules.

4 For the avoidance of doubt, the CAR referred to in this module covers the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio, individually and collectively, unless otherwise specified.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
1.2.5 With the implementation of Basel III (including the
requirements in respect of the BCR buffer level), this module has been updated to illustrate:

• the operation of Pillar 2 within the revised capital
  adequacy framework (including the positioning of the Pillar 2 capital requirement in the capital hierarchy);
• the approach to allocating the Pillar 2 capital
  requirement amongst the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio; and
• the differentiation of P2A and P2B and how the BCR
  buffer level is taken into account to address any overlap.
  1.2.6 This module should be read in conjunction with the
  Banking (Capital) Rules and other supervisory guidelines, including the modules of the Supervisory Policy Manual, issued by the MA that are relevant to the assessment of AIs’ capital adequacy (see a list of such guidelines in Annex A).
  1.3 Main objectives and principles
  1.3.1 The SRP is an important and integral part of the capital
  adequacy framework. Its main objectives are to:
• facilitate supervisory monitoring of the capital
  adequacy of AIs to support the risks in their business activities;
• encourage AIs to enhance their risk management
  techniques for monitoring and controlling such risks; and
• provide the impetus for AIs to adopt more active
  capital planning and management practices.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
1.3.2 In conducting the SRP, the MA is guided by the following
principles which should help achieve the objectives outlined in para. 1.3.1:

• AIs should have an internal process for assessing
  their overall capital adequacy in relation to their risk profile and a strategy for maintaining the required level of capital (“the first SRP principle”);
• the MA has the responsibility of reviewing AIs’
  internal capital adequacy assessments and determining whether the resultant capital position is adequate (“the second SRP principle”);
• the MA expects AIs to operate above the BCR
  minimum CAR and has the power to require AIs to do so (“the third SRP principle”); and
• the MA seeks to intervene at an early stage to
  prevent AIs’ capital from falling below prudent levels (“the fourth SRP principle”).
  1.3.3 The manner in which the MA applies the four SRP
  principles through the legal powers conferred upon him under the Banking Ordinance is elaborated in subsection 2.2.
  1.4 Implementation
  1.4.1 This revised module will take effect from the date of its
  issuance.
  1.4.2 Following the conduct of an SRP on an AI (normally
  once a year), the MA will serve one or more notices on the AI under §97F of the Banking Ordinance specifying the minimum CAR (i.e. the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio) and/or the §97F buffer level applicable to it. The minimum CET1 capital ratio, Tier 1 capital ratio and Total capital ratio are derived by apportioning the “capital add-on” according to the method set out in subsection 3.5. Subject to any representations that may be made by an AI, the three

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 minimum capital ratios constituting the §97F minimum CAR of the AI and any §97F buffer level will be in force from the date specified in the respective notice until otherwise advised by the MA subsequently.
1.4.3 Under the SRP, AIs (save for those falling within the
exceptions in subsection 4.1.3) are expected to conduct their CAAP in line with the standards in section 4. The MA will attach increasing importance to reviewing the adequacy of an AI’s CAAP as part of the SRP taking into account that the CAAP requirement has been in place since 2007 and since that time AIs have had an opportunity to develop, refine and improve their proficiency in conducting internal capital assessment, capital planning and capital allocation.
1.4.4 The MA’s assessment of an AI’s CAAP will feed into the
MA’s overall assessment of the AI’s capital adequacy, and may result in a change in the AI’s Pillar 2 capital requirement and, if significant weaknesses are observed in the AI’s CAAP, the institution of appropriate supervisory measures.
2. The MA’s approach to supervisory review
2.1 General
2.1.1 This section provides an overview of the legal backing
that the MA derives from the Banking Ordinance for determining the capital requirement of AIs through the SRP under Pillar 2 (see subsection 2.2), elaborates on the operation of Pillar 2 within the capital adequacy framework (see subsection 2.3), and highlights the key components that make up the SRP (see subsection 2.4).
2.1.2 Other supervisory arrangements relevant to the conduct
of the SRP, including (i) its application to local banking groups and foreign bank subsidiaries; and (ii) the associated notification, representation and appeal procedures, are set out in subsections 2.6 to 2.8.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
2.2 Legal framework
2.2.1 The Banking Ordinance provides the MA with sufficient
powers to enforce the four SRP principles set out in subsection 1.3.
2.2.2 Under Paragraph 6 of the Seventh Schedule to the
Banking Ordinance, AIs are obliged to satisfy the MA that they maintain, on and after authorization, adequate financial resources (whether actual or contingent) for the nature and scale of their operations. This provides the basis for AIs to conduct internal capital assessments under the CAAP (i.e. the first SRP principle) and the MA to review such assessments (i.e. the second SRP principle) so as to ascertain that AIs have adequate financial resources.
2.2.3 Whilst §3B of the Banking (Capital) Rules requires AIs to
maintain the BCR minimum CAR, and §3G of the Banking (Capital) Rules specifies the buffer level applicable, §97F of the Banking Ordinance in empowering the MA to vary any capital requirement rule in effect enables the MA to impose a Pillar 2 capital requirement on individual AIs, based on the MA’s assessment of their capital adequacy (i.e. the third SRP principle).
2.2.4 With the implementation of the BCR buffer level starting
from 1 January 2016, the HKMA has discontinued the imposition on AIs of specific non-statutory trigger ratios set by the MA. Nonetheless, consistent with the fourth SRP principle, AIs will be expected to ensure that they have comparable internal targets or monitoring tools so that timely discussion with the MA can be undertaken if their capital levels fall close to the buffer zone.
2.2.5 An AI should therefore set an internal capital target for
each of the CET1 capital ratio, Tier 1 capital ratio and the Total capital ratio, taking into account the §97F minimum CAR and the buffer level (BCR buffer level or §97F buffer level) applicable to the AI, and any additional capital needs having regard to its risk profile and specific

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 circumstances (e.g. the result of relevant stress tests). The internal capital targets, including the methodology for setting them, should be agreed with the MA.
2.2.6 The fourth SRP principle is further reinforced by §97D(1)
and §97E(2) of the Banking Ordinance which respectively require an AI to (i) notify the MA immediately regarding a matter prescribed in the Banking (Capital) Rules (which may concern a failure to comply with a minimum capital requirement (and, in this regard, §3D of the Banking (Capital) Rules requires an AI to notify the MA immediately of any failure to maintain the §97F minimum CAR)); and (ii) take remedial action, as specified by the MA, to comply with the capital requirement concerned.
2.2.7 Failure of an AI to meet the statutory requirements may
call into question whether the AI continues to satisfy the authorization criterion stipulated in Paragraph 6 of the Seventh Schedule to the Banking Ordinance.
2.2.8 Under §97D(3) and §97E(4) of the Banking Ordinance,
every director, chief executive and manager of an AI has the legal responsibility to ensure that the AI complies with the MA’s requirements under §97D(1) and §97E(2) of the Ordinance. Such persons may commit an offence and be liable to prosecution if the AI fails to comply with the requirements.
2.2.9 Under §3J of the Banking (Capital) Rules, if an AI intends
to make a distribution payment that would result in its net CET1 capital ratio being equal to or falling below its BCR buffer level or §97F buffer level (whichever applicable), it must consult the MA and submit a capital plan to manage and improve its capital position for the MA’s approval. Under §3K of the Banking (Capital) Rules, if an AI’s net CET1 capital ratio is equal to or below its BCR buffer level or §97F buffer level (whichever applicable), it must notify the MA and provide the information specified in that section upon becoming aware of the fact, and it must notify the MA 1 month before making a distribution payment and submit a capital plan to manage and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 improve its capital position for the MA’s approval. When notified, the MA may request any particulars from the AI.
2.2.10 If an AI is aggrieved by the MA’s decision to vary the AI’s
capital requirement under §97F of the Banking Ordinance, the AI may apply to the Review Tribunal for a review of that decision under §101B(1) of the Ordinance.
2.3 Operation of Pillar 2 under capital adequacy framework
2.3.1 From 1 January 2016, the Pillar 2 capital requirement
(“P2”) is differentiated into two constituent parts:

• P2A which relates to the portion of the Pillar 2
  capital requirement that reflects risks not captured, or not adequately captured, in Pillar 1 (the risks involved being similar to the eight inherent risks 5 identified by the MA for the purpose of risk-based supervision). This portion of the Pillar 2 capital requirement will be treated in the same way as the capital held against Pillar 1 risks and will be included in, and counted as, a constituent part of the §97F minimum CAR applicable to an AI; and
• P2B which relates to the portion of the Pillar 2
  capital requirement that provides a cushion of capital to bolster resilience in times of stress (and hence should be allowed to be used in such times) without reference to specific risks considered under P2A. This part of the Pillar 2 capital requirement can therefore be regarded as akin in nature to the capital held to cover the risks sought to be addressed by the BCR buffer level and should, logically therefore (i) be constituted solely by CET1 capital (to ensure loss absorbency on a going concern basis) and (ii) not be double-counted through any overlap with the BCR buffer level.

5 See para. 3.2.3 for more details.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 See subsection 3.4 for more details on the assessment factors underlying P2A and P2B, the rationale underlying their capital treatment, and how P2A and P2B operate alongside the BCR buffer level. Key components of capital hierarchy
2.3.2 Table 2 below illustrates the key components of the capital
hierarchy (and the positioning of Pillar 2 within that hierarchy).
Table 2–Key Components of Capital Hierarchy
Building block Components Explanatory notes §97F minimum CAR • CET1 capital ratio (BCR minimum CAR + apportioned P2A6 )

• Tier 1 capital ratio
  (BCR minimum CAR + apportioned P2A)
• Total capital ratio
  (BCR minimum CAR + apportioned P2A)
• All three minimum capital
  ratios (including the respective AI-specific capital add-ons) must be met at all times
• P2A determines the capital
  add-on for the three ratios
  BCR buffer level or
  §97F buffer level
  (whichever applicable)
• CB ratio (in CET1
  capital)
• CCyB ratio (in CET1
  capital)
• HLA ratio 7 (in CET1
  capital)
• Additional capital
  buffer (in CET1 capital) reflecting any amount of P2B in excess of the BCR
• Falling below the buffer
  level will render AIs subject to restrictions (e.g. reducing distribution of earnings)
• P2B determines whether a
  §97F buffer level needs to be set

6 See subsection 3.5 for details on the apportionment of the P2A to the three minimum capital ratios. 7 The HLA ratio is applicable to G-SIBs and D-SIBs.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 buffer level Order of applying CET1 capital
2.3.3 For the avoidance of doubt, the CET1 capital held by an AI
must be applied in the order set out in Table 3 below, i.e. the CET1 capital will first be used to meet the three minimum capital ratios that constitute the §97F minimum CAR before the remainder can contribute to the BCR buffer level or §97F buffer level (whichever applicable).
Table 3 – Order of Application of CET1 Capital
Order Capital requirement
1 CET1 capital ratio
2 Tier 1 capital ratio
3 Total capital ratio
4 BCR buffer level or §97F buffer level (whichever applicable)
2.4 Key components of SRP
2.4.1 The SRP conducted on an AI typically consists of the
following key components:

• Review of the AI’s risk profile – the MA forms a view
  of the AI’s overall risk profile as part of the MA’s ongoing risk-based supervision, with the purpose of assessing those risk and control factors that may justify the imposition of additional capital requirements on the AI;
• Review of the AI’s CAAP – for AIs that are subject to
  the CAAP standards set out in section 4, the MA assesses their CAAP as part of the SRP. This review includes a consideration of the assumptions,

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 methodology, coverage and outcome of an AI’s CAAP, with a view to ascertaining the adequacy and effectiveness of the AI’s CAAP;

• Determination of the AI’s §97F minimum CAR, §97F
  buffer level and/or other supervisory measures – the MA considers whether the AI’s existing minimum CAR and buffer level remain appropriate or need to be changed by applying the assessment framework set out in section 3 to the results and findings gathered from the above reviews. The MA may also require the AI to take other actions to rectify any system or control deficiencies identified during the SRP. The assessment results, including any supervisory measures proposed, are subject to an independent review process described in subsection 2.8;
• Communication of SRP results to the AI – after
  completion of the SRP, the MA discusses with the AI the results of his assessment, including any areas of concern which may lead to an increase in its minimum CAR and/or buffer level (meaning that the MA will have to propose a variation of the BCR minimum CAR8 and/or BCR buffer level of the AI under §97F of the Banking Ordinance). The MA will explain in sufficient detail the factors which have led to his assessment and recommend what actions the AI should take to address the concerns. If the MA is to invoke his §97F power to vary the AI’s BCR minimum CAR and/or BCR buffer level, the AI will be notified of the proposed variation and the grounds for variation (and given the opportunity to make representations to the MA) before a decision is finalised, pursuant to §97F of the Ordinance. A mechanism for the AI to apply to the Review

8 For example, if the Total capital ratio of the AI is to be increased from 10% to 11% against the BCR minimum Total capital ratio of 8%, the MA will propose under §97F of the Banking Ordinance to increase the AI’s minimum Total capital ratio by 3% to 11%.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Tribunal for review of the MA’s decision is also available under §101B of the Ordinance;

• Ongoing monitoring of the AI’s capital adequacy –
  this is to monitor that the AI complies with the various regulatory capital standards and requirements applicable to it on a continuing basis. The MA updates the AI’s risk profile regularly, taking into account its progress in addressing any supervisory concerns raised or other events which may significantly affect the AI’s ability to monitor and ensure compliance with the Banking (Capital) Rules.
  2.4.2 The SRP is designed to generate an active dialogue with
  the AI concerned regarding the fulfilment of capital adequacy and risk management standards, through which the MA seeks to:
• gain deeper insights into the AI’s overall control and
  risk management framework;
• establish a closer understanding of how the AI
  approaches the risks that are not covered under Pillar 1 and the amount of internal capital allocated to them;
• understand the mechanisms the AI has maintained
  for identifying, measuring, monitoring, controlling, mitigating and reporting its risks; and
• assess the extent to which the AI’s CAAP, where
  applicable, may be relied upon as a factor to be considered in the MA’s evaluation of the AI’s capital adequacy.
  2.4.3 Diagram 1 below provides a graphical presentation of the
  key components of the SRP described above.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Diagram 1 – Key Components of SRP
2.5 Supervisory arrangements
2.5.1 The MA performs the SRP on each AI regularly
(normally once a year) as part of the MA’s ongoing risk￾based supervision. The scope of the SRP covers all significant business activities of the AI, whether operating locally or overseas, on a solo and/or consolidated basis.
2.5.2 When carrying out the SRP, the MA adopts a forward￾looking approach to the extent that he will take stock of
any significant changes (either arising from institutional or external conditions) to the AI’s overall risk profile in the past year and assess how these changes will affect the AI and its business plans and prospects in the coming AI being assessed SRP conducted by the MA SUPERVISORY ACTION Identify, review and evaluate all risk and control factors of AI via risk-based supervision Review and evaluate AI's CAAP (where applicable) Capital strength and CAAP (with stress-testing applied) Systems and controls Other relevant factors Inherent risks (increase in minimum CAR and / or buffer level and / or other appropriate supervisory measures) INDEPENDENT REVIEW OF SRP RESULTS Supervisory monitoring of ongoing compliance with regulatory capital requirements & standards Review and evaluate compliance with minimum requirements and standards for calculation of CAR SUPERVISORY FINDINGS G o v e r n a n c e C o r p o r a t e APPLICATION OF SRP ASSESSMENT FRAMEWORK DIALOGUE COMMUNICATION OF SRP RESULTS (with consultation on increase in minimum CAR and / or buffer level where applicable)

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 year. For this purpose, the MA takes into account the results of any offsite reviews and onsite examinations, and makes use of any relevant information obtained from various sources such as prudential interviews, banking returns and routine supervisory contacts.
2.5.3 The MA takes a proportionate approach when applying
the SRP to AIs of varying size and complexity. In other words, the frequency, intensity and depth of the SRP will be determined by the potential risk that the AI poses to the supervisory objectives of the MA. For example, the MA may subject large and sophisticated AIs to a somewhat more in-depth and comprehensive SRP than would be applied to AIs with less complex operations. The MA would not expect AIs with less complex operations to have such sophisticated risk management systems and CAAP, and hence the SRP conducted on such AIs is likely to be less intense and frequent. In categorising AIs, the MA takes account of factors such as the AI’s business nature, scale of operations (i.e. size, risk profile and complexity), history of regulatory compliance and role in the financial system or other supervisory objectives.
2.5.4 The SRP does not replicate or supplant the role of the
Board and senior management of AIs. The primary responsibility for ensuring that an AI has adequate capital to support its risk profile rests squarely with its Board and senior management.
2.5.5 In evaluating overall capital adequacy, the SRP includes
a review of the appropriateness of the capital requirement of an AI. The relevant minimum CAR and buffer level are to be applied on a solo basis to monitor the AI’s capital adequacy on a standalone basis, unless the MA’s prior approval is obtained for allowing the AI to consolidate some of its subsidiaries in the calculation of a solo-consolidated CAR (i.e. the AI is not required to deduct its investment in those subsidiaries from its solo capital base) subject to the meeting of certain conditions. If the AI has one or more subsidiaries that are to be

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 consolidated for capital adequacy purposes under §3C and/or §3I of the Banking (Capital) Rules, the relevant minimum CAR and buffer level are also to be applied on a consolidated basis.
2.5.6 The MA may involve third parties to assist him in
conducting the SRP. Under §59(2) of the Banking Ordinance, the MA has the power to require an AI, after consultation with the AI, to provide an auditors’ report on such matters as he may specify for the performance of his functions under the Ordinance. The MA may exercise this power to commission an auditors’ report when he considers that an independent assessment of the AI’s capital adequacy or risk management processes is warranted. To avoid any potential conflict of interest, the external auditor(s) appointed by the AI for the purpose of preparing this report will be approved by the MA, and the appointed auditor(s) may not necessarily be the AI’s existing auditor(s).
2.6 Application to local banking groups
2.6.1 The MA, as the home supervisor of a local banking
group9
, applies the SRP to the group as a whole, and monitors the group’s capital adequacy at the consolidated level.
2.6.2 The SRP assesses all the major risks of the local
banking group, whether arising from banking or non￾banking activities (such as securities dealing or insurance-related business). Other risks to the group will also be captured, for example, where services such as IT, accounting, or payment and settlement functions are being provided, or control functions are being exercised, from outside the group on an outsourced basis.

9 This refers to a banking group in which the holding company of the group (or group holding company) is a locally incorporated AI.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
2.6.3 The MA may allow a local banking group to develop a
group CAAP covering the positions of its subsidiary AIs if their capital is centrally managed at the group level. In other words, such subsidiary AIs will not be required to establish their own CAAP on a standalone basis. However, subsidiary AIs that are operating independently will still be required to develop their own CAAP.
2.6.4 The MA determines the solo and (where applicable)
consolidated §97F minimum CAR and/or §97F buffer level (if applicable) for each of the locally incorporated AIs within a local banking group based on their respective risk profile. It is however not uncommon for the MA to set the same Pillar 2 capital requirement for a local banking group at both the solo and consolidated levels. This is generally reflective of the fact that the operations of a local banking group are often dominated by the AI that is the group holding company, and the risk profiles of AIs within the group are not materially different. If a local banking group does not have such characteristics, the solo and consolidated minimum CAR and buffer level applicable to AIs within the group will likely be different, depending on the MA’s assessment of their individual risk profiles.
2.6.5 As an illustration, if the group holding company of a local
banking group is a retail bank with a fairly diversified risk profile but some of its significant subsidiary AIs are engaged in specialised and high risk business activities (e.g. foreign exchange and derivatives trading) with decentralised risk management systems, there may be a case for setting the solo §97F minimum CAR and §97F buffer level of those subsidiary AIs at a level higher than that for the group holding company. Whether the consolidated §97F minimum CAR and §97F buffer level of the group holding company will also be set at a higher level than its solo §97F minimum CAR and §97F buffer level depends on the impact of the operations of the subsidiary AIs on the group’s consolidated financial position.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
2.6.6 Where a local banking group has overseas branches or
subsidiaries the activities of which are significant to the group as a whole, the MA may seek the comments of relevant host supervisors on the financial and operating soundness of those branches or subsidiaries in their jurisdictions in the course of conducting the SRP for the consolidated banking group.
2.7 Application to foreign bank subsidiaries
2.7.1 In the case of AIs which are subsidiaries of foreign
banks, the MA continues to exercise his legal duty under the Banking Ordinance, through the setting of §97F minimum CAR and §97F buffer level as appropriate, to require such AIs to maintain adequate capital resources in Hong Kong.
2.7.2 The evaluation of the capital adequacy of foreign bank
subsidiaries under the SRP however takes into account the strength and availability of parental support as well as other relevant information from the home supervisor of the foreign banking group. This may include, for example, the results of the home supervisor’s consolidated assessment (including an evaluation of the group CAAP or capital allocation systems and the group support of subsidiaries) of the banking systems and processes used at the group level and any developments or supervisory actions that may affect the calculation of regulatory capital requirements for the subsidiaries in Hong Kong.
2.7.3 A foreign bank subsidiary that is subject to the CAAP
standards may employ the CAAP methodology of its parent bank, but will need to explain and justify to the MA how the data and methodology have been adjusted to reflect its local business strategy and the risks to which it is exposed in Hong Kong (see subsection 4.6 for more details).
2.8 Review and notification of SRP results

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
2.8.1 The MA has established an internal mechanism for
ensuring the quality, objectivity and consistency of the assessments performed under the SRP in respect of the determination of the Pillar 2 capital requirement of individual AIs and for considering representations from AIs seeking a review of the determination. An outline of the mechanism is shown in Diagram 2 below.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Diagram 2 – Independent Review of SRP Results Proposal to vary AI’s BCR minimum CAR and/or BCR buffer level under §97F of Banking Ordinance after conducting the SRP Review of the proposal by the SRP Approval Committee Draft notice served on AI under §97F(2) with contents required by §97F(3)(if its BCR minimum CAR and/or BCR buffer level are to be varied) Representations from AI? Yes Consideration by the SRP Approval Review Committee No Notice under §97F(1) issued (in substantially the same terms as the draft notice if no representation or with changes to take account of representations made by AI) Yes AI’s BCR minimum CAR and/or BCR buffer level varied under §97F(1)? No Inform AI of the decision made
2.8.2 Pursuant to §97F(1) of the Banking Ordinance, the MA
may vary an AI’s BCR minimum CAR and/ or BCR buffer level if he is satisfied, on reasonable grounds, that it is prudent to make the variation, taking into account the risks associated with the AI. The SRP Approval Committee and SRP Approval Review Committee mentioned below contribute to ensuring that any variation made by the MA is in accordance with the §97F(1) requirements.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
2.8.3 The mandate of the SRP Approval Committee is to
review the assessments conducted on individual AIs under the SRP, and to advise the MA on the appropriateness of any proposed variation of the BCR minimum CAR and BCR buffer level as well as any supervisory measures. The Committee is chaired by an Executive Director, and includes at least two senior staff members within the Banking Departments of the HKMA who have not been involved in conducting the SRP in question.
2.8.4 The SRP Approval Committee evaluates all relevant
facts and arguments in support of any proposed variation, and analyses and compares the assessment results of different AIs to ensure the consistency and quality of assessments made. Before putting forward any recommendations for the MA’s consideration, the Committee may direct the relevant supervisory team to provide additional information or carry out further work to resolve any queries or concerns raised.
2.8.5 The mandate of the SRP Approval Review Committee is
to consider representations from individual AIs in respect of a proposed variation of their BCR minimum CAR and/or BCR buffer level, and to recommend to the MA whether the BCR minimum CAR and/or BCR buffer level should be so varied in the light of those representations and other relevant circumstances of each case. The Committee is chaired by a Deputy Chief Executive, and includes at least four senior staff members within the Banking Departments of the HKMA who have neither been involved in conducting the SRP in question nor in considering the SRP within the SRP Approval Committee.
2.8.6 If the MA proposes to vary the BCR minimum CAR
and/or BCR buffer level of an AI, he is required under §97F of the Banking Ordinance to serve a draft notice on the AI specifying the proposed variation and the grounds for the proposed variation. The AI will be given 14 days to make written representations following the date of

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 service of the MA’s draft notice. If necessary, the AI may request an extension of the time limit for submitting representations. Any such request should be in writing, provide sufficient justification and be delivered to the MA within the original 14-day period. The MA may allow such extension as he considers appropriate having regard to the circumstances of each case.
2.8.7 To ensure that the Board and senior management of the
AI are fully engaged in the process and have fully considered the circumstances appertaining to the AI’s BCR minimum CAR and/or BCR buffer level and the MA’s proposal to vary the same, the representations should be accompanied by a certified copy of the minutes of meeting in which the Board (or a designated committee) approved the submission of the representations.
2.8.8 The AI should set out clearly in its written
representations the grounds for seeking a review of the proposed §97F minimum CAR and/or §97F buffer level, and provide all relevant facts and information that the AI wishes the MA to take into account when considering its representations. An AI may be permitted to make oral representations if the MA considers this helpful in elaborating upon the AI’s written representations.
2.8.9 As a general rule, the making of representations should
not delay or impede any other supervisory actions already in progress, or affect the MA’s authority to take any other supervisory actions against the AI concerned. Under exceptional circumstances, the MA may decide that the AI should be relieved from complying with certain other supervisory actions whilst the representations are being considered.
2.8.10 If the MA has not received any written representations
from the AI within the 14-day period (or an extended period approved by the MA) or if, after having considered the AI’s representations and the SRP Approval Review Committee’s recommendation, the MA supports a variation of the BCR minimum CAR and/or

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 BCR buffer level (no matter whether the variation is as originally proposed or in a revised form), the MA will, by notice in writing served on the AI, vary the AI’s BCR minimum CAR and/or BCR buffer level under §97F of the Banking Ordinance.
2.8.11 If the AI is still aggrieved by the MA’s decision to vary its
BCR minimum CAR and/or BCR buffer level, it may apply to the Review Tribunal for a review of that decision under §101B of the Banking Ordinance. However, the making of an application to the Tribunal for a review of a decision does not operate to suspend the decision.
3. Supervisory review of capital adequacy
3.1 General
3.1.1 This section focuses on the major elements of the
assessment framework adopted by the MA under the SRP, including (i) the key assessment factors that are considered in evaluating AIs’ capital adequacy (see subsection 3.2); (ii) the setting of AIs’ Pillar 2 capital requirement (see subsection 3.3); (iii) the differentiation between the P2A and P2B constituent parts of that requirement, and how they relate to the determination of §97F minimum CAR and §97F buffer level (see subsection 3.4); and (iv) the approach to determining AIs’ §97F minimum CAR (see subsection 3.5).
3.1.2 Conducted as part of the MA’s ongoing supervision of
AIs, the SRP is closely related to the risk-based supervisory framework currently adopted by the MA. Subsection 3.6 describes their relationship and how the assessment results under the SRP may be integrated with the risk-based supervisory process. Also relevant to the SRP are:

• the MA’s approach to using stress tests in evaluating
  an AI’s capital adequacy and its ability to withstand risk;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• the emphasis placed by the MA on encouraging AIs
  to adopt international risk management standards and best practices through the issue of supervisory guidance; and
• the process of monitoring AIs’ capital adequacy on a
  continuing basis.
  These aspects are respectively explained in subsections
  3.7 to 3.9.
  3.2 Key factors for assessing capital adequacy
  3.2.1 Apart from credit, market and operational risks that are
  covered under Pillar 1, the SRP takes into consideration other risks faced by AIs and how well those risks are being managed by AIs. Through the SRP, the MA evaluates the extent to which an AI is required to hold more capital to cover those risks (i.e. the Pillar 2 capital requirement). This subsection serves to specify the major risk and control factors that the MA considers under the SRP and the approach to assessing the impact of such factors on an AI’s Pillar 2 capital requirement (and in turn its §97F minimum CAR and/or §97F buffer level).
  3.2.2 With the risk-based supervisory approach as its
  foundation, the SRP has been developed to provide the MA with a comprehensive, systematic and consistent framework for determining the Pillar 2 capital requirement of individual AIs. Diagram 3 below outlines the key elements that constitute the assessment framework.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Diagram 3 – Key Elements of SRP Assessment Framework Risk-based supervision Inherent risk Systems and Capital strength Corporate Risk increasing Risk mitigating controls and CAAP governance factors factors

• Default risk - Credit
  Credit - Transaction risk concentration - Risk - Adequacy and - Corporate Examples Examples risk (CRM) risk management effectiveness governance system of CAAP and (compliance - Specific issues - IRB / AMA stress-testing and quality) arising from CRM capability for
• Equity risk - Internal control capability / securitisation AIs using less
• Commodity risk system and and credit advanced
• FX risk environment derivatives approaches
• Capital quality
  Operational - Risk of loss - Residual and strength risk from internal operational - Infrastructure to - Residual - Insurance (including operations and and legal meet business - Capability to modelling risk cover legal risk) external events risks needs withstand risk recognisable (e.g. access to - Outliers in under AMA
• Interest rate - Interest rate - Other support capital market, specific risks
  risk in trading risk in banking systems strength of - Diversification book book (e.g. MIS and shareholders / - Other factors benefits anti-money parental not already or Liquidity laundering support, and adequately - Other factors risk controls) vulnerability dealt with under providing to business BCR relief capital Strategic cycle risk, etc.) minimum CAR risk and common assessment Reputation factors risk Banking (Capital) Rules Consideration under BCR minimum CAR Common assessment factors AI-specific assessment factors Other considerations Market risk Supervisory Assessment (case-by-case basis) MINIMUM CAR / Buffer level (Note) Interest rate risk Pillar 2 capital requirement
• Liquidity risk
• Strategic risk
• Reputation risk
  Supervisory Assessment
  (through scoring system)
  Note: Effective from 1 January 2016, the Pillar 2 capital requirement is differentiated into (i) P2A, which is the capital add-on, or the portion of the §97F minimum CAR that is in excess of the BCR minimum CAR; and (ii) P2B, which determines whether the BCR buffer level of the AI needs to be increased under §97F (see subsections
  3.4 and 3.5 for details).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
3.2.3 Central to the SRP is the MA’s assessment of the level of
capital that an AI should set aside for the eight inherent risks identified for the purpose of risk-based supervision, to which all the assessment factors under the SRP can be linked. These inherent risks (see column 1 of Diagram 3), i.e. credit, market, operational (and legal), interest rate, liquidity, strategic and reputation risks, are as defined in SA-1 “Risk-based Supervisory Approach”.
3.2.4 In determining the overall risk profile and Pillar 2 capital
requirement of an AI, the MA takes into account two types of assessment factors, i.e. those that are commonly applicable to all AIs (referred to as the “common assessment factors”) and those that are specific to the AI concerned (referred to as the “specific assessment factors”). Common assessment factors include those inherent risks set out in para. 3.2.5 and other assessment factors mentioned in para. 3.2.7. Specific assessment factors are explained in paras.
3.2.13 to 3.2.17 below. See also Annex B for a more
detailed description of the assessment factors.
Level of inherent risks
3.2.5 Out of the eight inherent risks, there are certain risks,
namely, credit risk (including counterparty credit risk), market risk and operational (and legal) risk, that are within the scope of Pillar 1 and hence are covered by the BCR minimum CAR (see column 2). The other inherent risks (including residual risks), as listed below, are to be assessed under the SRP (see column 3):

• credit concentration risk (as a major source of
  residual credit risk);
• residual operational (and legal) risk;
• interest rate risk in the banking book;
• liquidity risk;
• strategic risk; and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• reputation risk.
  3.2.6 The MA assesses an AI’s level of inherent risks covered
  under the SRP, taking into consideration all relevant qualitative and quantitative factors, including their respective significance to the AI’s overall risk profile and the degree of potential loss that may be posed by these risks in relation to the AI’s earnings and capital. The direction of such risks (i.e. “increasing”, “stable” or “decreasing”) 10 , including those arising from new products, services or business activities, in the next 12 months is also considered. The resultant level of inherent risk is categorised as “low”, “moderate” or “high” 11. Other common assessment factors
  3.2.7 In addition to the level of inherent risks, the MA assesses
  an AI’s performance under the following assessment factors (see columns 4 to 6) with a view to ascertaining the AI’s ability to manage and mitigate the inherent risks:
• Systems and controls – this refers to the
  assessment of an AI’s overall operating soundness, including the adequacy of:
• risk management systems (i.e. systems used for
  identifying, measuring, monitoring, controlling, mitigating and reporting the eight inherent risks);
• internal control systems and environment
  (including organisation structure, delegation of authority, segregation of duties, control culture, internal audit and compliance functions);

10 If the level of credit risk is “low” but the direction of this risk is “increasing”, the MA may consider whether there is a sufficient basis for increasing the level of credit risk to “moderate”. 11 By way of example, the credit concentration risk of an international bank with fairly diversified portfolios by counterparty, sector, or geographical location will likely be regarded as “low” whereas that of a domestic bank with a highly concentrated loan portfolio (e.g. with a few large or connected borrowers) will likely be regarded as “high”.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• infrastructure to meet business needs (such as
  IT capability, staff competence, and outsourcing); and
• other support systems (such as management
  information systems (“MIS”), accounting systems and anti-money laundering controls);
• Capital strength and CAAP – this refers to the
  assessment of:
• the quality of capital held by an AI and its access
  to additional capital and capability to withstand economic cycles and other external risk factors (e.g. the impact of mergers/acquisitions, competition or adverse events on the AI’s operations); and
• the quality and effectiveness of an AI’s CAAP
  (including capital planning and longer-term capital maintenance) for managing the AI’s capital adequacy in relation to its risk profile, the loss absorbency of its capital (e.g. the sufficiency of its CET1 capital) to protect itself from insolvency, the overall environment within which the CAAP operates, as well as its compliance with the CAAP standards (for AIs that are subject to the CAAP standards set out in section 4); and
• Corporate governance – this refers to the
  assessment of the adequacy of an AI’s corporate governance arrangements (see also paras. 3.2.8 and 3.2.9).
  3.2.8 In assessing the above factors, the MA pays particular
  attention to the firm-wide risk oversight exercised by the AI’s Board and senior management, including their knowledge and experience in the AI’s major business activities and risk management systems, their participation and involvement in development of the AI’s CAAP and risk management processes, and their responsiveness to risk management and control issues

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 raised by the MA. Their willingness and ability to promote and maintain prudent remuneration policies and practices within the organisation will also be a major factor for consideration.
3.2.9 With respect to new or complex products and activities
engaged in by an AI, the MA expects senior management to understand the assumptions regarding business models, valuation and risk management practices underlying those products and activities and to evaluate the potential risk exposure if such assumptions fail. The MA also takes into account senior management’s ability to detect and rectify issues or problems arising from internal operations and to react promptly to changes in the external environment (e.g. due to competition or deterioration in macroeconomic variables) that could adversely affect the AI’s overall condition.
3.2.10 In relation to the assessment of capital strength, an AI’s
prospects and ability to obtain additional capital readily and the likelihood of it doing so when under stress, the capital support potentially available from the AI’s shareholders, and the obligations and commitments which the AI may have towards its subsidiaries and affiliates (if any) are relevant factors to be considered. In the case of an AI which is a banking subsidiary or a member of a banking group (local or foreign), the MA will further consider whether the AI has strong parental support and whether the parent bank or holding company has the resources to provide such support when needed.
3.2.11 In addition to an AI’s ability to maintain sufficient capital
for all material risks, the MA attaches importance to the AI’s strength in operating effectively throughout a severe and prolonged period of financial market stress or an adverse credit cycle. Particularly, the MA will have regard to whether the AI’s CAAP has, through stress￾testing or otherwise, addressed both short-term and long-term capital needs and considered the prudence of building excess capital over benign periods of the credit

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 cycle to enable the AI to withstand a severe and prolonged market downturn.
3.2.12 In evaluating the above factors, the MA takes into
account the business nature and scale of operations of AIs, their role in the financial system and their compliance with the supervisory standards and best practices contained in the relevant guidelines set out in
Annex A. The resultant level of performance of the
above factors is categorised as “strong”, “acceptable” or “weak”. 12 A “strong” performance on the above factors will have a positive impact on the overall risk profile of an AI, and vice versa. Specific assessment factors
3.2.13 There are two types of specific assessment factors, i.e.
risk increasing factors (see column 7) and risk mitigating factors (see column 8). They are used to cater for situations or circumstances specific to the AI concerned and which have not been dealt with, or adequately dealt with, under the BCR minimum CAR, the BCR buffer level or common assessment factors. The MA will consider these factors on a case-by-case basis, having regard to their significance to individual AIs. The use of such factors is however exceptional and subject to close scrutiny by the MA.
3.2.14 Risk increasing factors are specific factors that
negatively affect the risk profile of an AI and which may hence be indicative of a need for an increase in the AI’s Pillar 2 capital requirement. Examples of such factors include:

12 For example, the MA may grade an AI’s risk management systems as “strong” if the AI’s past history indicates that its risk management policies, systems and controls address all material risks and are effectively implemented. However, if subsequent supervisory findings have identified significant flaws in the AI’s risk monitoring and reporting procedures to the extent that senior management is not given accurate or adequate information to evaluate the risks faced by the AI, there may be scope for downgrading the AI’s “risk management systems” to “weak”.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• significant “outliers” identified in the review of
  common assessment factors. These may relate to extremely high levels of inherent risk, substantial management or control weaknesses, or significant vulnerability to adverse economic events which warrant a full assessment of the additional capital required to cover the risks involved;
• factors specific to the business and operations of
  individual AIs, such as risk concentrations that may arise within each type of risk or through a combination of exposures across different types of risk, and other material non-banking risks (e.g. rapid expansion in non-banking activities without proper expertise and management systems); and
• specific issues arising from the application of, or
  compliance with, minimum standards or requirements stipulated under the capital adequacy framework. These issues may arise from:
• residual credit risk (including counterparty credit
  risk) associated with credit risk mitigation techniques, complex credit derivatives or securitization transactions;
• use of internal models under the IRB approach,
  IMM approach or IMM(CCR) approach (e.g. capital shortfall identified in stress tests, breach of qualifying criteria or certain modelling deficiencies pending rectification); or
• operational risk capital charge not
  commensurate with the scale and complexity of an AI’s business operations (e.g. due to the AI’s operating losses or significant decline in earnings)13.

13 This issue will be considered in the MA’s assessment of residual operational (and legal) risk under para. 3.2.5. See also subsection B2.2 of Annex B for more details.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
3.2.15 Risk mitigating factors are specific factors that have a
positive impact on an AI’s risk profile and which may hence be taken into account in considering whether there is any case for lowering the AI’s Pillar 2 capital requirement. They are used by the MA as incentives for AIs to improve their risk management so that the level of their inherent risks can be effectively mitigated. As an example, if an AI can demonstrate to the MA’s satisfaction its proficiency in managing credit, market or operational risk by having sophisticated risk management systems comparable to those required for adopting the advanced approaches promulgated under Basel II and Basel III 14 (although the systems may not have been used for regulatory capital treatment in Hong Kong), the MA may recognise this as a risk mitigating factor.
3.2.16 In considering an AI’s Pillar 2 capital requirement, the
MA will determine, in consultation with the AI concerned, whether there is any risk mitigating factor that can be recognised for capital adequacy purposes (although the hurdle for recognising any such factor will be high). To facilitate his assessment, the MA may require the AI to provide any such information or documentary evidence as is deemed necessary in the circumstances of the case. The MA will assess each case based on its own merits, taking into account the information provided by the AI to justify the risk mitigating effect of the factor under consideration.
3.2.17 The MA will determine the extent to which the Pillar 2
capital requirement of an AI can be increased or reduced

14 These approaches refer to the IRB approach for credit risk, the IMM (CCR) approach for counterparty credit risk, the IMM approach for market risk, and the Advanced Measurement Approaches (“AMA”) for operational risk as set out in International Convergence of Capital Measurement and Capital Standards – A Revised Framework (Comprehensive Version) published by the BCBS in June 2006, Revisions to Basel II market risk framework published by the BCBS in July 2009 and the IMM(CCR) approach (update) and Advanced CVA method for counterparty credit risk as set out in Basel III: A global regulatory framework for more resilient banks and banking systems published by the BCBS in June 2011 (revised version).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 due to the specific assessment factors, based on his assessment of the extent to which such factors can increase or mitigate the risks of the AI. Assessment approach
3.2.18 In conducting his assessment under the SRP, the MA
uses a combination of techniques and tools, which include:

• quantitative and qualitative assessments;
• scoring of key risk factors and trends;
• statistical and sensitivity analyses;
• stress and scenario tests;
• benchmarking against industry performance; and
• peer group comparisons.
  In particular, the common assessment factors are evaluated based on a scoring system developed by the MA whereas the specific assessment factors are separately considered by the MA on a case-by-case basis, with the other techniques and tools incorporated where appropriate. Attached at Annex C is a set of scoring worksheets which help describe the manner in which the MA uses various techniques and tools to facilitate his assessment under the SRP. AIs should however note that the scoring worksheets are subject to periodic review by the MA, and are shown here for illustrative purposes only.
  3.2.19 Regardless of the approach taken, supervisory
  judgement is still an important element in the overall assessment. The MA may also seek the views of the external auditors of an AI and, where applicable, its home or host supervisor on particular issues affecting the AI.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
3.2.20 On the basis of the assessment results, the MA will
decide upon an AI’s overall risk profile (also categorised as “low”, “moderate” or “high”) to facilitate his determination of the AI’s Pillar 2 capital requirement and any other appropriate supervisory response to the AI’s condition (e.g. the scope and frequency of the next SRP or the need for any supervisory action to be taken in view of the weaknesses or deficiencies identified).
3.2.21 Diagram 4 below is an illustration of the risk profile
matrix which relates an AI’s overall risk profile to the level of inherent risks of the AI (with focus on those captured under the SRP) and its performance in other common assessment factors, i.e. systems and controls, capital strength and capability to withstand risk, CAAP (if applicable), and corporate governance. The effects of any specific assessment factors applicable to the AI will also be taken into account. Diagram 4 – Risk Profile Matrix SYSTEMS AND CONTROLS / CAPITAL STRENGTH / CAAP / CORPORATE GOVERNANCE etc. (aggregate result of assessment) STRONG ACCEPTABLE WEAK INHERENT RISK HIGH Moderate risk profile Moderate / high risk profile High risk profile MODERATE Low / moderate risk profile Moderate risk profile Moderate / high risk profile LOW Low risk profile Low / moderate risk profile Moderate risk profile
3.2.22 In order to ensure the quality and consistency of the
assessments made, the MA aggregates the assessment results of individual AIs and compares the results among peer groups. The assessment results and recommendations will also be subject to the independent

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 review procedures set out in subsection 2.8 before they are finalised.
3.2.23 The MA will discuss the assessment results in detail with
individual AIs and consult with them, if a variation of their BCR minimum CAR and/or BCR buffer level are proposed, in accordance with §97F of the Banking Ordinance (see Diagram 2 under subsection 2.8).
3.3 Setting of Pillar 2 capital requirement
3.3.1 The Pillar 2 capital requirement, which is generated from
the assessment framework under the SRP, will form the basis for determining an AI’s §97F minimum CAR and/or §97F buffer level (see subsections 3.4 and 3.5 for details on how the determination is made).
3.3.2 Although §97F of the Banking Ordinance sets no upper
limit for the variation of the capital requirement of individual AIs, the MA will continue to calibrate the Pillar 2 capital requirement under the SRP based on a maximum Pillar 2 capital requirement of 8%, which is considered appropriate in the light of past experience. The MA will, however, review the calibration from time to time to ensure that it remains suitable for the local banking sector. The MA also retains the right to impose a higher Pillar 2 capital requirement on particular AIs if this should be justified by the SRP results15. This will of course be subject to the requirements set out in §97F of the Ordinance.
3.3.3 The Pillar 2 capital requirement of an AI generally reflects
the MA’s perception of its overall risk profile, taking into account all relevant assessment factors set out in subsection 3.2. The factors may have different levels of significance to different AIs, depending on their individual circumstances. For example, some AIs may be more

15 For example, an AI may be assessed to be a significant outlier in some risk factors to the extent of affecting the AI’s solvency and the seriousness of the AI’s position cannot be accommodated by a maximum Pillar 2 capital requirement of 8%.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 affected by external factors whilst for others, management quality or internal controls may be the principal issues.
3.3.4 Broadly speaking, AIs are assigned with a Pillar 2 capital
requirement that falls within the following bands, depending on their assessment results under the SRP:
Overall risk profile Pillar 2 capital requirement Low <=1% Moderate >1% - 4% High >4% - 8% However, as discussed in para. 3.3.2, it should be noted that these indicative levels will not operate to constrain the MA from imposing a higher Pillar 2 capital requirement if he is satisfied, on reasonable grounds, that it is prudent to impose such a requirement, taking into account the risks associated with the AI concerned.
3.3.5 The Pillar 2 capital requirement is to cater for the various
Pillar 2 risks and uncertainties faced by an AI. In determining whether additional capital is required to cover a particular type of risk, the MA will consider the level of that risk as well as the extent to which such level of risk can be reduced by applying appropriate risk mitigating measures. For example, if an AI’s residual counterparty credit risk is mainly caused by poor risk management controls, and the AI holds additional collateral from counterparties as a risk mitigating measure in the course of rectifying the counterparty credit risk management weaknesses identified, the MA will have regard to the effectiveness of the risk mitigating measure (i.e. the extent to which counterparty credit risk is effectively reduced by the additional collateral held by the AI) when considering whether the AI needs to hold additional capital for its counterparty credit risk management weaknesses. The MA will also take into account the AI’s progress in strengthening its counterparty credit risk management framework.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
3.4 The P2A and the P2B components of the Pillar 2 capital
requirement
Relationship with BCR buffer level
3.4.1 There are fundamental differences between the Pillar 2
capital requirement and the constituent elements of the BCR buffer level.
3.4.2 The calculation of capital requirements in respect of
credit, market and operational risks (i.e. Pillar 1 risks) under the Banking (Capital) Rules is complemented by the SRP conducted under Pillar 2 which determines the additional capital that should be maintained by AIs to address risks not covered (e.g. interest rate risk in the banking book), or not adequately covered (e.g. credit concentration risk), under Pillar 1. Such Pillar 2 risks may differ among AIs depending on their risk profiles and management systems. The requirement to hold additional capital to cover such risks not only underpins and supports those risks but also provides AIs with an impetus to improve their systems for managing specific risks.
3.4.3 In contrast, the BCR buffer level is designed to ensure
that (i) AIs build up capital outside periods of stress which can be drawn down as losses are incurred (in the case of the CB ratio); (ii) the level of AIs’ capital is reinforced during periods of excessive growth (in the case of the CCyB ratio); and (iii) negative externalities posed by G-SIBs and D-SIBs are duly addressed (in the case of the HLA ratio). Hence, instead of addressing AI￾specific risks, the BCR buffer level is intended to be a general cushion of capital above the §97F minimum CAR to be available for use during periods of stress.
3.4.4 As a general principle, to the extent that the Pillar 2
capital requirement generated from the SRP reflects AI￾specific risks not covered, or not adequately covered, under Pillar 1, it constitutes P2A , and this portion of the

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Pillar 2 capital requirement is a constituent part of the §97F minimum CAR.
3.4.5 To the extent that the Pillar 2 capital requirement
generated from the SRP reflects a cushion of capital to bolster resilience generally without reference to a specific Pillar 2 risk, it constitutes P2B, by reference to which any need for a higher buffer level to be applicable to an AI over and above the BCR buffer level will be determined. Whilst a degree of overlap may exist between P2B and the components of the BCR buffer level, any such overlap will not be “double-counted” because in effect the AI’s BCR buffer level will be set-off against any P2B and only any P2B in excess of the BCR buffer level will result in the BCR buffer level being varied under §97F of the Ordinance. P2B, like the components of the BCR buffer level, should be constituted solely by CET1 capital.
3.4.6 Based on the SRP scorecards, P2B is primarily
generated from the following assessment factors:

• All factors assessed under “Capital Adequacy
  Assessment Process” (i.e. SRP scorecard C1). As the determination of the Pillar 2 capital requirement remains very much a supervisor-driven process, the requirement for additional capital in response to assessment of an AI’s CAAP largely represents a cushion to bolster resilience and a means to motivate AIs’ enhancement of their CAAP capability; and
• Certain factors assessed under “Capital Strength
  and Capability to Withstand Risk” (i.e. SRP scorecard C2). These include (i) asset quality (which provides a cushion of capital for credit risk covered in Pillar 1); (ii) business expansion (which provides a cushion of capital during business expansion to cater for a downturn); (iii) stress￾testing (which assesses an AI’s vulnerability during stressed situations); and (iv) qualitative assessment factors (such as access to additional

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 funding in times of need, the potential impact of redemption of subordinated debt instruments in times of stress, and strength of parental support, etc.). All such factors do not refer to an AI’s specific inherent risks, but indicate the need for some cushion of capital to bolster resilience especially during stressed periods.
3.4.7 All other assessment factors, from which P2A is
generated, relate to the inherent risks to which an AI is exposed as well as to its underlying systems and controls and corporate governance arrangements for mitigating such risks, and should not result in additional capital requirements which constitute an overlap with the BCR buffer level applicable to the AI.
3.4.8 The MA does not expect P2B generated from the
assessment factors referred to in para. 3.4.6 to constitute a significant portion of AIs’ Pillar 2 capital requirement. Notwithstanding any overlap with the BCR buffer level, these assessment factors will remain within the SRP as they serve to differentiate individual AIs’ performance for the purpose of assessing and monitoring overall capital adequacy, so that supervisory measures can be taken where appropriate. For example, an AI’s CAAP may fall short of the required standards, prompting the MA to require remedial action from the AI. Illustration of methodology
3.4.9 Diagram 5 below illustrates the Pillar 1 / Pillar 2
constituents of the three minimum capital ratios and the buffer level. Diagram 5 - Constituents of Minimum Capital Ratios and Buffer Level

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Buffer level Minimum Capital Ratios P2B in excess of the BCR buffer level, if any Components of the BCR buffer level (CB ratio, CCyB ratio and HLA ratio) P2A ( risks not captured or not adequately captured in P1) Pillar 1 (credit, market, operational risks)
3.4.10 The operation of para. 3.4.8 can be further illustrated by
a mathematical example. Looking at the minimum Total capital ratio of 8% and, for illustration purposes a BCR buffer level of 2.5%, if the Pillar 2 capital requirement of an AI is 2% (with P2A and P2B being 1.5% and 0.5% respectively), the AI’s minimum Total capital ratio would be 9.5% (i.e. 8% + 1.5%) (but see subsection 3.5 regarding the apportionment of the P2A between the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio) with the P2B of 0.5% being fully “absorbed” by the BCR buffer level.
3.4.11 In most cases, P2B is expected to be less than the BCR
buffer level. In exceptional cases where the P2B of an AI exceeds the BCR buffer level, the AI will be required to “top-up” the BCR buffer level to meet the P2B. For example, if the P2B of an AI is 3% and the BCR buffer level is 2.5%, the §97F buffer level of the AI will be increased from 2.5% to 3% (i.e. effectively the size of the P2B) whilst the minimum capital ratios would only include Pillar 1 and the P2A (see Diagram 6 below). The overlapping portion between the BCR buffer level and P2B is not double-counted. In such cases, the MA will have exercised the power under §97F of the Ordinance to vary the capital requirement rule with respect to the BCR buffer level so that the §97F buffer level applicable to the AI will incorporate any additional capital requirement derived from the Pillar 2 assessment. As a result any reference to buffer level in

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 the Banking (Capital) Rules (e.g. in relation to distribution payment requirements) should refer to the §97F buffer level. Diagram 6 - Total Capital Requirement under Different P2B scenarios
3.4.12 In cases where the P2B of an AI is relatively large
compared with that of other AIs, this may be due to the AI’s relatively weaker performance under the P2B assessment factors. As a larger P2B offers greater capital relief than a smaller P2B when “absorbed” by the BCR buffer level, this might create an adverse incentive in terms of the P2B assessment factors. To counter this incentive, the MA will in any such case critically review the underlying components of the figures to determine whether and what action the AI concerned should be required to take to improve its performance under the relevant factors.
3.5 Determination of §97F minimum CAR
3.5.1 The Pillar 2 capital requirement of an AI generated from
the SRP will be used to derive the capital add-on applicable to the BCR minimum CAR (i.e. the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio) BCR buffer level P2A P1 P2A P2B P1 P2B Total capital requirement Scenario 1 BCR buffer level > P2B Scenario 2 BCR buffer level < P2B Minimum ratio requirement BCR buffer level P2B in excess of BCR buffer level Total capital requirement

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 in accordance with the apportionment approach set out below. Apportionment method
3.5.2 From 1 January 2016, only the P2A component of the
Pillar 2 capital requirement will be allocated to the three minimum capital ratios (whilst the P2B component will be used to determine whether the BCR buffer level of the AI needs to be increased). The MA will allocate the P2A component to the three minimum capital ratios (i.e. the CET1 capital ratio, Tier 1 capital ratio and Total capital ratio) on a 4.5 / 6 / 8 split. For example, assume the P2A component and P2B component of an AI are 1.5% and 0.5% respectively, its minimum capital ratios (not including the buffers) are shown below. Minimum Capital Ratios CET1 Tier 1 Total BCR minimum CAR 4.5% 6% 8% Apportioned P2A (according to 4.5 / 6 / 8 split) 0.844% 1.125% 1.500% BCR minimum CAR + Apportioned P2A 5.344% 7.125% 9.500% P2B 0.5% (not included in minimum capital ratios)
3.5.3 The above apportionment approach will necessitate that
AIs closely monitor, plan for, and address any potential or resultant changes in the levels of capital required in each of the CET1 capital, Additional Tier 1 capital and Total capital ratios, whenever there is any change in the size of the Pillar 2 capital requirement.
3.6 Integration with risk-based supervisory process
3.6.1 Diagram 7 below illustrates the relationship between the
SRP and the risk-based supervisory process.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Diagram 7 – Relationship between SRP and Risk-based Supervision Risk-based supervision Supervisory review process To assess AIs’ overall risk profile To determine §97F minimum CAR and §97F buffer level (if applicable) of AIs Board and senior management oversight Board and senior management oversight / corporate governance Risk management systems Risk management systems Comprehensive internal controls Internal control systems and environment Infrastructure to meet business needs Other support systems Inherent risks (see Diagram 3 above) Inherent risks captured by BCR minimum CAR Inherent risks captured by Pillar 2 Direction of risk capital requirement Capital strength and capability to withstand risk (including CAAP where applicable) RISK PROFILE §97F MINIMUM CAR & §97F BUFFER LEVEL (if applicable)
3.6.2 The MA’s assessment of an AI’s capital strength and
capability to withstand risk (including a review of the AI’s CAAP where applicable) conducted as part of the SRP, supplements the ongoing risk-based supervisory process by providing detailed analyses on the AI’s capital strength and earning capacity. Other considerations
3.6.3 To reduce frequent fluctuations in the regulatory capital
requirement of an AI, the MA will consider whether the

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 factors leading to a change in the Pillar 2 capital requirement are temporary in nature or require further observation. For example, if there are reasonable expectations that certain system deficiencies will be quickly rectified by an AI, the MA may consider withholding temporarily the proposed increase in Pillar 2 capital requirement pending a review of the AI’s corrective actions. Conversely, if a reduction in an AI’s Pillar 2 capital requirement is proposed in the light of the AI’s actions taken to address supervisory concerns raised by the MA, the MA may consider withholding temporarily the proposed reduction until a more comprehensive assessment of whether the improvements have been effectively implemented is completed.
3.6.4 Whilst the setting of an appropriate Pillar 2 capital
requirement for individual AIs is an important aspect of the SRP, the MA recognises that capital alone is not a substitute for sound risk management and control environments. In fact, certain risks (e.g. reputation or liquidity risk) may not be adequately addressed by holding additional capital alone. A more appropriate response would be to mitigate a risk by way of adequate systems and controls, or by a combination of adequate systems and controls and additional capital and resources (e.g. a larger liquidity buffer in the case of liquidity concerns).
3.6.5 In certain circumstances (e.g. during the period in which
system and control weaknesses have been identified but have yet to be fully remedied), the MA may make use of an increase in regulatory capital as a supervisory tool to focus the minds of management of an AI on the need for improving risk management and rectifying control deficiencies. Thus, the MA may increase the AI’s Pillar 2 capital requirement temporarily and, where necessary, take other appropriate supervisory actions (e.g. requiring the AI to reduce the risk inherent in its activities, products and systems), pending corrective actions by the AI.
3.7 Use of stress tests

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Role of stress-testing under SRP
3.7.1 An important aspect of the SRP is to assess the potential
vulnerability of an AI to adverse events or other external factors affecting the AI (e.g. economic cycle risk) and the need for the AI to hold additional capital for such risk.
3.7.2 In performing this assessment under the SRP, the MA
will have regard to the results of stress tests conducted by an AI, which may provide useful information about the effects of “stressed” situations on the AI’s financial condition, particularly the impact on its asset quality, profitability and capital adequacy.
3.7.3 Stress tests include sensitivity tests and scenario
analyses. A sensitivity test typically involves shifting the values of individual risk factors (e.g. worsening of credit spreads or adverse changes in interest rates or other macroeconomic variables) and determining the effect of such changes on an AI’s business and financial positions.
3.7.4 A scenario analysis measures the combined effect of
adverse movements in a wider range of risk factors affecting an AI’s business operations at the same time (e.g. an economic recession coupled with a tightening of market liquidity and declining asset prices). It involves various processes including scenario development, forecasting or estimation of stress outcomes, capital projections, and impact assessment. Stress scenarios may be derived from stochastic models or historical events, and can be developed with varying degrees of precision, depth and severity.
3.7.5 Stress tests, which supplement other risk management
approaches and measures, help improve an AI’s understanding of the vulnerabilities that it faces under exceptional, but plausible, events, and provide the AI with an indication of how much capital might be needed to absorb losses if such events occur. These events can be financial, operational, legal or relate to any other risk that may have an economic impact on the AI concerned.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
3.7.6 The results derived from stress tests should be regularly
used by AIs in their determination of the appropriate appetite / tolerance for different types of risk, and in estimating the amount of capital that should be set aside to cover them. Stress-testing obligations on AIs
3.7.7 Under the SRP, AIs are expected to carry out regularly
rigorous and forward-looking stress tests, that are appropriate to the nature of their business and the major sources of risk faced by them, for risk management purposes. The MA assesses the effectiveness of an AI’s stress-testing programme in accordance with the general standards set out in IC-5 “Stress-testing”, and considers whether the use of stress-testing forms an integral part of the AI’s overall governance and risk management culture. The MA may challenge the key assumptions driving the stress-testing results and their continuing relevance in view of existing and potential changing market conditions. This will be done as part of his review of the AI’s risk management systems.
3.7.8 AIs should integrate relevant stress-testing results into
their CAAP so as to ensure that there is sufficient capital to withstand the impact of possible adverse events or changes in market conditions on them. In his review of an AI’s CAAP, the MA takes into account the stress￾testing approach adopted by the AI (including the methodologies and assumptions used), examines the AI’s projected capital resources and capital requirements under adverse scenarios, and considers the extent to which the AI has provided for unexpected events in setting its capital level. See Annex D regarding the supervisory requirements on the application of stress tests for the assessment of capital adequacy.
3.7.9 In addition, AIs using the IRB approach to calculate
credit risk, the IMM approach to calculate market risk, or the IMM(CCR) approach to calculate counterparty credit risk are required to conduct respectively credit risk, market risk or counterparty credit risk stress tests in

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 compliance with the relevant minimum requirements in the Banking (Capital) Rules. The MA reviews the stress-testing results to ascertain whether AIs have sufficient capital to meet the minimum capital requirements in plausible but adverse stressed conditions.
3.7.10 If the MA is not satisfied with an AI’s capital adequacy
after taking into account its stress-testing results, the MA may consider increasing the AI’s Pillar 2 capital requirement and/or require the AI to reduce its risks. Where necessary, other appropriate supervisory measures may also be taken. Supervisory stress tests
3.7.11 In reviewing AIs’ capability to withstand risk, the MA
conducts sector-wide stress tests regularly to assess and compare individual AIs’ vulnerability to the same set of severe market shocks or crisis situations (e.g. based on hypothetical scenarios that are similar to, or more severe than, those experienced during the 1997/1998 Asian Crisis or the 2007/2008 global financial crisis), making use of the statistical data provided by AIs or results generated from their stress tests.
3.7.12 Other stress tests will also be applied where appropriate.
For example, the MA applies liquidity stress tests to retail banks based on the quarterly cash flow data submitted by them to assess their vulnerability to liquidity crises or bank-run situations when determining the level of their liquidity risk.
3.7.13 The MA will consider whether those “outlier” AIs that
show significant vulnerability to “stressed” situations compared with their peers warrant a higher Pillar 2 capital requirement and/or a reduction in risk exposures.
3.8 Supervisory guidance on risk management practices
3.8.1 A key feature of the SRP lies in its emphasis on the
comprehensive recognition of risk in an AI’s capital

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 planning and management processes. Apart from requiring AIs to maintain adequate capital to support the risks associated with them, the SRP encourages them to develop and use better risk management techniques for monitoring and controlling such risks, especially those specific risks not directly or fully addressed under Pillar 1.
3.8.2 The MA will continue to develop or enhance supervisory
guidelines on risk management and control standards applicable to the SRP (see Annex A for a list of relevant supervisory guidelines) with a view to:

• encouraging AIs to adopt international standards
  and best practices in managing their risks;
• enabling them to be better prepared for meeting the
  relevant standards under the SRP; and
• ensuring a consistent application of the standards.
  3.9 Ongoing monitoring of capital adequacy
  3.9.1 The MA monitors and evaluates AIs’ capital adequacy
  on an ongoing basis, including their compliance with the qualifying criteria for the relevant approaches adopted by them under the Banking (Capital) Rules. For example, these may relate to the use of the IRB approach for calculating credit risk, the IMM approach for calculating market risk, the IMM(CCR) approach for calculating counterparty credit risk, or the recognition of credit risk mitigation techniques and securitization transactions for capital adequacy purposes.
  3.9.2 If an AI is found to have a continuing decline in its capital
  levels, the MA will require the AI to provide a capital restoration plan and the timetable for achieving the necessary capital restoration. The MA will establish an action plan to monitor the AI closely. If the AI’s capital is not maintained or restored within the specified timeframe, the MA is likely to take other supervisory actions he considers appropriate, such as restricting the

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 AI from business expansion or limiting its business, operations or network, pending restoration of the capital to an adequate position.
3.9.3 If the findings gathered from ongoing offsite reviews or
onsite examinations reflect concerns about an AI’s compliance with certain qualifying criteria or conditions under the Banking (Capital) Rules, the MA may seek further explanations from the AI or conduct a more detailed examination to assess the concerns. If necessary, the MA may commission a special review under §59(2) of the Banking Ordinance.
3.9.4 As AIs have an obligation to manage their capital and
ensure that it is sufficient to cover the risks undertaken by them, they are expected to maintain adequate and effective internal monitoring systems (e.g. through internal validations or audits) to ensure that their capital does not fall below prudent levels, and that they continue to meet the minimum standards and eligibility criteria required for the use of particular approaches or methodologies under the Banking (Capital) Rules.
3.9.5 The MA would expect AIs to advise him of any significant
decline in capital levels or non-compliance with the standards or criteria under the Banking (Capital) Rules referred to in para. 3.9.4 (and the causes of such decline or non-compliance) and the remedial actions to be taken as soon as practicable. In the event that an AI’s capital falls below the internal capital targets agreed with the MA (see para. 2.2.5), the AI should inform the MA and set out a plan for restoring its capital position. Depending upon the circumstances and frequency with which these situations occur, the MA may regard them as indicative of system and control weaknesses.
4. Supervisory standards on CAAP
4.1 General

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
4.1.1 Under the SRP, AIs are expected to have a CAAP for
assessing their overall capital adequacy in relation to their risk profile and a strategy for maintaining their capital levels, unless otherwise exempted by the MA (see para. 4.1.3). The CAAP should fit their individual circumstances and needs, having regard to the risk profile and level of sophistication of their operations. The MA has the responsibility of evaluating AIs’ CAAP and their capital adequacy through the SRP, the results of which will be taken into account in determining their Pillar 2 capital requirement and, ultimately, their §97F minimum CAR and §97F buffer level (if applicable).
4.1.2 Generally, an AI’s CAAP is expected to be integrated
with its capital planning process. This section sets out the MA’s approach to reviewing AIs’ CAAP, and the supervisory standards expected of the CAAP and the related capital planning process.
4.1.3 The requirements for conducting CAAP are applicable to
all AIs except for the following:

• AIs that have the MA’s approval for adopting the
  basic approach for credit risk permanently are not subject to the CAAP standards in the light of their small and simple operations. Nevertheless, they remain responsible for ensuring that there is sufficient capital to meet their business and operational needs; and
• AIs that are subsidiaries of a local banking group are
  not required to establish their own CAAP if their capital is managed on a group basis and incorporated into the group CAAP.
  4.1.4 The MA recognises that there is no single correct
  approach to conducting the CAAP. As such, the focus of the MA is on providing high level guidance rather than prescriptive criteria on CAAP methodologies or techniques that should be employed. This also takes into account the fact that market practices for conducting the CAAP, and the development of relevant

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 methodologies and techniques (e.g. on how non￾quantifiable risks such as reputation and strategic risks are to be measured), continue to evolve. The onus, therefore, is on AIs to explain and demonstrate how their CAAP meets supervisory standards, and why they consider their capital targets appropriate given the scale and complexity of their business.
4.1.5 The MA assesses the reasonableness of the outcome of
an AI’s CAAP in his review. Whilst the MA will not seek to reconcile precisely the §97F minimum CAR set by the MA with the outcome of the AI’s CAAP (which will likely reflect economic capital as opposed to regulatory capital), it is the case that with the greater focus under Basel III on capital of higher loss-absorbing quality (i.e. CET1 capital), the minimum CET1 capital ratio and the minimum Tier 1 capital ratio set by the MA within the §97F minimum CAR will be expected to be more comparable to the outcome of the AI’s CAAP than hitherto.16
4.1.6 AIs may have different capital adequacy goals (e.g.
some may target a certain credit rating and some may seek to hold sufficient capital for long-term sustainable growth). At a minimum, the MA would expect an AI to establish a CAAP to assess the capital needed to cover all material risks, achieve its business plan and enable it to continue to operate its business on a going concern basis (with sufficient Tier 1 capital to protect itself from insolvency). The CAAP should also enable an AI to measure its risks and allocate capital against such risks more precisely.

16 Generally speaking, economic capital is more concerned with shareholders’ funds than with other sources of subordinated funding (i.e. the amount of losses that can be absorbed before shareholders’ funds are exhausted) and hence is more akin to the nature of Tier 1 capital. Nevertheless, the approach to evaluating economic capital may differ among AIs depending on the capital objective or the desired level of confidence interval set. Regulatory capital goes beyond the amount needed for survival and includes Tier 2 capital (which serves as an additional protective cushion for depositors).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
4.1.7 As mentioned in para. 1.4.4, the MA’s assessment of an
AI’s CAAP will feed into the MA’s overall assessment of the AI’s capital adequacy, including the setting of the AI’s Pillar 2 capital requirement, and may result in the institution of supervisory measures if significant weaknesses are observed in the CAAP. It is therefore in the interest of AIs to enhance their CAAP capabilities on a continuing basis.
4.2 Internal control and governance
Responsibilities of the board and senior management
4.2.1 The Board and senior management of an AI have the
primary responsibility for ensuring that the AI has adequate capital to support its risks. At a minimum, the capital required should enable the AI to operate as a going concern and be sufficient to provide for business growth.
4.2.2 The Board and senior management should ensure that
adequate and effective capital planning and management policies are established (see paras. 4.3.4 to 4.3.6 for more details). The Board and senior management should review these policies, with changes approved by the Board, at least annually or whenever such review is prompted by specific events (e.g. an opportunity for a significant acquisition has emerged), and establish additional policies where necessary, to ensure that all such internal policies are always in compliance with the applicable supervisory and regulatory requirements.
4.2.3 The Board and senior management should ensure that
the AI has in place a capital plan which clearly outlines its current and future capital needs, anticipated capital expenditures, desirable capital level, external capital sources and any capital action required. This analysis of capital requirements in relation to an AI’s strategic objectives is a vital element of the strategic capital planning process. The capital plan should be reviewed

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 and approved by the Board or a designated committee of the Board at least annually.
4.2.4 In addition to any identified capital action(s) required
(and included in the AI’s capital plan as per para. 4.2.3 above), additional potential capital actions (e.g. reducing dividend payment, issuing regulatory capital instruments and/or reducing balance sheet etc) available to preserve capital or cushion against unexpected events should also be considered and included in the AI’s capital planning and management policies and/or capital plan.
4.2.5 The Board and senior management should consider
developing some guiding principles for determining the appropriateness and priority of a particular action under different scenarios, taking into account relevant considerations such as economic value added, costs and benefits and market conditions. Capital actions (required or potential) should be set out in quantified terms and any that are impractical to execute should not be included in the AI’s capital planning and management policies and/or capital plan.
4.2.6 The Board and senior management should ensure that
the capital planning process is tailored to reflect the desired strategic objectives for the AI, and that all relevant staff are fully aware of the AI’s corporate goals and objectives. The Board or its designated committee should determine the principles underpinning the capital planning process. These principles may include the forward strategy for the AI, an expression of risk appetite and a perspective on striking the right balance between reinvesting capital in the AI’s operations and providing returns to shareholders. A management committee or similar body should work under the auspices of the Board or its designated committee to guide and review the capital planning process.
4.2.7 More broadly, a sound firm-wide risk management
framework is the foundation for an effective assessment of the adequacy of an AI’s capital position. The Board and senior management should ensure that such a

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 framework is in place, enabling the AI to set its appetite and tolerance for risks, and supporting the ability of the Board and senior management to manage the AI’s risks from an integrated, firm-wide perspective and to identify and react to emerging and growing risks in a timely and effective manner.
4.2.8 To achieve a sound firm-wide risk management
framework, the Board and senior management should:

• have a thorough understanding of the AI’s risks on a
  firm-wide basis, especially the risks associated with new or complex products and activities (e.g. those arising from new business models (in the 2007/2008 Global Financial Crisis the risks arising from the “originate-to-distribute” business model became apparent) or from securitization activities), and how such risks interact with other risks and relate to adequate capital levels under both normal and stressed conditions;
• ensure that the AI’s risk management framework
  includes detailed policies that set specific firm-wide prudential limits on the AI’s activities, which are consistent with its risk-taking appetite and capacity;
• ensure that the infrastructure, systems and controls
  necessary to manage the AI’s risks are in place, and are effective and commensurate with its overall risk profile;
• ensure that accountability and lines of authority are
  clearly delineated and effectively communicated throughout the organisation;
• provide specific guidance for the implementation of
  the AI’s business strategies, and monitor compliance with internal policies and limits established for managing the various types of risk associated with the AI;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• establish adequate operating and control procedures
  to ensure that the AI is operating in compliance with regulatory capital and disclosure standards and requirements and to monitor the performance of staff in administering and controlling the capital position of the AI; and
• remain adequately informed on an ongoing and
  timely basis about the AI’s risks as financial markets, risk management practices and the AI’s activities evolve.
  4.2.9 It is important for the Board and senior management to
  ensure that the definition of the AI’s capital used in its CAAP is stated clearly and consistently applied, particularly as there are various definitions of capital that may be used within the banking industry. For example, some AIs may for internal purposes choose a narrow definition for capital, such as confining it to ordinary shares, whilst others may define capital more broadly. The Board and senior management should understand such differences and their implications. As the components of capital are of varying quality, have varying characteristics and do not all have the same ability to absorb losses on a going concern basis, the Board and senior management should thoroughly comprehend the relationship between the AI’s capital definition and its assessment of capital adequacy. Any changes in the AI’s internal definition of capital and the reason for those changes should be properly documented.
  4.2.10 The Board and senior management should also
  ensure that the AI’s capital policy, CAAP and escalation protocols (see also para. 4.2.16) are working in tandem and consistently with an appropriate risk reporting and stress testing framework.
  4.2.11 Failure to adhere to the above requirements may call into
  question whether the Board and senior management

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 have adequately discharged their responsibility under para. 4.2.1. Internal controls and audits
4.2.12 There should be a process of internal controls,
independent reviews and audits to ensure the adequacy, effectiveness and reliability of the CAAP and the overall capital planning process, and to monitor the actual performance against the approved capital goals and targets as well as the conformity with the strategy and objectives stated in the CAAP. The frequency of the independent reviews and audits may vary depending on the size and complexity of individual AIs but should not be less than once every year.
4.2.13 The CAAP and risk management process should be
subject to periodic reviews to ensure their integrity, accuracy and reasonableness. Areas that should be reviewed include:

• the appropriateness of risk appetite / tolerance
  levels and capital planning, the effectiveness of the CAAP, and the strength of internal control infrastructure given the nature, scope and complexity of the AI’s business;
• where applicable, the appropriateness and validity of
  third-party inputs or other tools used for management information purposes (e.g. credit ratings, risk measures and models);
• the identification of large exposures and risk
  concentrations;
• the accuracy and completeness of data input into
  the AI’s assessment process;
• the reasonableness and validity of scenarios used in
  the assessment process; and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• the use of stress-testing, including an analysis of the
  underlying assumptions and inputs.
  4.2.14 All deficiencies and weaknesses identified in the CAAP,
  as well as any non-compliance with approved internal policies and management guidelines on capital adequacy or the Banking (Capital) Rules, must be promptly reported to the Board and senior management for early rectification.
  4.2.15 Special attention should be paid to reviewing those areas
  of the CAAP that may be affected by changes in the operational or business environment, such as the introduction of new products and activities.
  4.2.16 The AI’s capital planning process and CAAP should
  produce a consistent and coherent view of its current and future capital needs, after incorporating inputs from relevant units of the AI in respect of the AI’s current strategy, the risks associated with that strategy and an assessment of how those risks contribute to capital needs as measured by internal and regulatory standards. In the case where assumptions are made by different units and they relate to the units’ capital needs which have to be allocated centrally, there should be formal processes in place to escalate competing assumptions made and differences in capital allocation across different units of the AI for discussion and approval by senior management.
  4.3 Key elements of CAAP
  General
  4.3.1 AIs are expected to develop a CAAP that is:
• comprehensive in terms of the identification and
  measurement of the risks associated with an AI’s business and the assessment of how much capital is needed to support these risks;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• risk-based and forward-looking, with emphasis on
  the importance of capital planning, management and other qualitative aspects of risk management and controls, and takes into account the AI’s strategic plans and how these relate to macroeconomic factors;
• integrated into the management process and
  decision-making culture of the AI. For more sophisticated AIs, the CAAP should be integrated into their day-to-day management process. For example, in addition to allocation of capital to business units, the CAAP would likely play a part in making credit decisions or other general business decisions (e.g. expansion plans and budgets). The results of the CAAP may also feed into the process of determining business strategies and risk appetite / tolerance levels. Although smaller AIs tend to have less sophisticated capital planning and assessment systems, their CAAP should at least produce results that enable the ongoing assessment and management of their risk profile (e.g. the results may influence their lending behaviour or use of risk mitigants) and inform the setting of risk appetite / tolerance; and
• capable of producing a reasonable outcome on the
  overall level of capital required and the assessment supporting such outcome.
  4.3.2 The CAAP should capture all material risks of an AI,
  including the eight inherent risks covered under the MA’s risk-based supervisory framework, and the interactions of these risks under both normal and stressed conditions. The overall environment within which the CAAP should operate is also important. AIs should, in particular, be able to identify other external risk factors that may arise from the regulatory, economic or business environment. In addition, adequate corporate governance and proper risk management and internal control arrangements constitute the foundation of an effective CAAP.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
4.3.3 The basic elements of a sound CAAP should include:

• policies and procedures to identify, measure, monitor,
  control, and report the risks inherent in an AI’s activities;
• a process to relate the AI’s internal capital to its risks;
• a process to state the AI’s capital adequacy goals in
  relation to risks, taking into account its strategic focus and business plan; and
• a process of internal controls, independent reviews
  and audits to ensure the integrity of the overall management process. Capital planning and management policies
  4.3.4 It is likewise important that internal policies are in place
  for capital planning and management purposes and meet the standards and criteria required in the relevant supervisory guidelines (see Annex A for more details).
  4.3.5 An AI should have a capital policy that will allow the AI to
  maintain ready access to funding, meet its obligations and continue its business during and after a stressful scenario. At a minimum, such a capital policy should include:
• the approach for determining the AI’s overall capital
  adequacy having regard to its risk profile and risk tolerance as approved by the Board and the senior management;
• the AI’s short-term and long-term capital adequacy
  goals in relation to its risk profile, taking into account its strategic focus and business plan;
• the approved capital targets that are consistent with
  the AI’s overall risk profile and financial position;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• the monitoring framework and relevant minimum
  thresholds and triggers (referencing a suite of capital- and performance-based indicators) for senior management’s attention and action; and
• the range of strategies that can be employed to
  address anticipated and unanticipated capital shortfalls and measures that would be taken in the event capital falls below a targeted level.
  4.3.6 Other management policies should be in place to
  supplement the capital policy in relation to:
• firm-wide risk management, which takes into
  account all material risks (both quantifiable and non￾quantifiable)17 as well as risks that do not appear to be significant in isolation, but when combined with other risks could lead to material losses or consequences18;
• stress-testing, which should adequately address
  economic cycle risk and measure the AI’s ability to withstand adverse conditions (see subsection 3.7 for more details);
• valuation practices, which should apply to all
  positions (including complex, structured products and financial instruments) that are measured at fair value and cover different circumstances, especially during times of stress;

17 Apart from the eight inherent risks identified for the purpose of risk-based supervision, other material risks, such as those posed by concentrations, securitization and off-balance sheet exposures that are relevant to the AI, should also be considered. 18 For example, the direct loss of an AI arising from an operational risk event (e.g. loss of confidential customer data) may be limited in itself. However, if this event affects a large number of customers and attracts substantial adverse market publicity, there may be significant damage to the AI’s reputation, apart from the potential claims for damages filed by the customers and other regulatory consequences for the AI for breaching data privacy rules and client confidentiality obligations.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• remuneration systems, which should consider risk￾adjusted performance measures and focus on
  achieving longer-term capital preservation and financial strength rather than focusing on, and thereby potentially encouraging, the generation of short-term accounting profits;
• dividend payout, which should neither hinder the AI
  from capital formation to support business growth nor weaken its capital position or financial soundness;
• provisioning levels and provisioning methodology,
  which should ensure that the level of provisions established and maintained by the AI is adequate to absorb estimated losses inherent in the AI’s asset portfolios, binding commitments and contingent liabilities; and
• income recognition and associated methodology,
  which should, among other things, clearly define under what situations the AI can or cannot recognise income and set out the details of the methodologies adopted. Risk management policies and procedures
  4.3.7 The policies and procedures to identify, measure,
  monitor, control, and report the risks inherent in an AI’s activities should meet the following standards:
• risk measurement systems should be sufficiently
  comprehensive and rigorous to capture the nature and magnitude of the risks faced by the AI, whilst differentiating risk exposures consistently among risk categories and levels of riskiness. Such systems should also be capable of performing risk

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 data aggregation 19 across different risk types or business lines;

• adequate controls should be in place to ensure the
  objectivity and consistency of risk identification and measurement and that all material risks (both on￾and off-balance sheet) are adequately addressed;
• detailed analyses should be conducted to support
  the accuracy or appropriateness of the risk measurement techniques used;
• limitations of risk quantification and measurement
  methods should be identified and understood through appropriate processes;
• inputs used in risk measurement should be of good
  quality;
• those risks that are not easily quantifiable should be
  evaluated using qualitative assessment and management judgement. Nevertheless, AIs should recognise the biases and assumptions embedded in, and the limitations of, the qualitative approaches used, with a view to ensuring that the potential impact of the relevant risk is not underestimated;
• the economic substance of risk exposures, including
  reputation risk and valuation uncertainty, should be fully recognised and incorporated into the risk management process;
• changes in the AI’s risk profile should be promptly
  incorporated into risk measures, whether the

19 Risk data aggregation means defining, gathering and processing risk data according to the AI’s reporting requirements to enable the AI to measure its performance against its risk tolerance/appetite. An effective CAAP should use risk data aggregation techniques to estimate the amount of capital required, regardless of whether or not the AI uses risk-modelling techniques to assess capital adequacy. If an AI uses risk-modelling techniques to assess capital adequacy, the AI should comply with the additional requirements set out in subsection 4.4.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 changes are due to new products or new businesses, increased volumes, changes in concentrations, the quality of the portfolio or the overall economic environment;

• when measuring risks, comprehensive and rigorous
  stress tests should be performed to identify possible events or market changes that could have serious adverse effects or significant impact on the AI’s capital and operations (see Annex D for more details);
• clear links between capital and liquidity monitoring
  should be established20; and
• adequate consideration should be given to
  contingent exposures arising from loan commitments, securitization and other transactions or activities that may create such exposures (see
  Annex E for more details).
  4.3.8 To facilitate firm-wide risk management and oversight,
  AIs should have in place appropriate infrastructure and MIS that contain, at a minimum, the following key elements:
  For aggregation of risks
• allow for the aggregation of exposures and risk
  measures across business lines and platforms (including the banking and trading books) in managing risks and monitoring limits;
• support customised identification of concentrations
  and emerging risks;

20 For instance, the capital position of an AI can have an effect on its ability to obtain liquidity, especially in times of stress. An AI should evaluate its capital adequacy with regard to its liquidity profile and the liquidity of the markets in which it operates, and have a mechanism in place to trigger any necessary action should circumstances warrant.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• support the ability to evaluate the impact of various
  types of economic and financial shocks that affect the whole organisation;
• offer sufficient flexibility to incorporate hedging and
  other risk mitigating actions to be carried out on a firm-wide basis whilst taking into account the various related basis risks; To enable proactive risk management
• should be capable of providing regular, accurate and
  timely information on the AI’s aggregate risk profile as well as the main assumptions used for risk aggregation;
• should be adaptable and responsive to changes in
  the AI’s underlying risk assumptions;
• should incorporate multiple perspectives of risk
  exposure to account for uncertainties in risk measurement; and
• should be sufficiently flexible so that the AI can
  generate forward-looking firm-wide scenario analyses that capture management’s interpretation of evolving market conditions and stressed conditions.
  4.3.9 If AIs use third-party inputs or other tools (e.g. credit
  ratings, risk measures and models, etc.) to produce risk management information, they should have adequate procedures in place to ensure that such inputs and tools are subject to initial and ongoing validation.
  4.3.10 If AIs employ risk mitigating techniques, they should
  understand the risk to be mitigated and the potential effects of that mitigation (including its enforceability and effectiveness), and have in place appropriate policies and procedures to control risks associated with these techniques (see subsection B6.2 under Annex B for more details).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
4.3.11 AIs should understand that it is often difficult to quantify
measurement errors that may exist in risk measurement. As a result, the level of capital maintained should cater for an increase in uncertainty related to modelling and business complexity. AIs should suitably account for measurement errors when calculating capital requirements, and be able to demonstrate the adequacy of capital to address such errors.
4.3.12 AIs conducting risk aggregation among various risk types
or business lines should understand the challenges in such aggregation. They should seek to address any potential concentrations across more than one risk dimension, recognising that losses could arise in several risk dimensions at the same time, stemming from the same event or a common set of factors. For example, a localised natural disaster could generate losses from credit, market and operational risks at the same time. (See Annex F for more details.) Internal capital allocation process
4.3.13 The process of relating an AI’s internal capital to its risks
should meet the following requirements:

• the amount of capital held should reflect not only the
  measured amount of risk but also an additional amount to account for potential uncertainties in risk measurement (e.g. measurement error or modelling risk) (see also para. 4.3.11);
• the AI’s capital should reflect the perceived level of
  precision in the risk measures used, the potential volatility of exposures and the relative importance of the activities producing the risk;
• capital levels should reflect the fact that historical
  correlation among exposures can change rapidly; and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• the AI should be able to demonstrate that its
  approach to relating capital to risk is conceptually sound and that outputs and results are reasonable. Setting of capital adequacy goals
  4.3.14 There should be a process to state the AI’s capital
  adequacy goals in relation to risks, taking into account its strategic focus and business plan:
• explicit goals and targets need to be established for
  evaluating the AI’s capital adequacy with respect to its risks;
• the AI should develop an internal strategy for
  maintaining capital levels which should not only reflect the desired level of risk coverage but also incorporate factors such as loan growth expectations, future sources and uses of funds, and dividend policy. There may be other considerations that the AI considers relevant or important in determining how much capital it should hold (e.g. external rating goals, market image, strategic goals, etc.). If these other considerations are included in the CAAP, the AI will be required to show how the considerations have influenced its decisions concerning the amount of capital to be held;
• the AI’s approved capital plan should state its
  objectives and time horizon for achieving them, and set out in broad terms the capital planning process and the responsibilities for that process. The capital plan should recognise that accommodating additional capital needs requires significant lead time, and take into account the potential difficulties of raising additional capital during downturns or other times of stress. It should also set out how the AI will comply with regulatory capital requirements, any relevant limits related to capital, and a general contingency plan for dealing with divergences and unexpected events (e.g. raising additional capital,

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 restricting business activities or using risk mitigating techniques for risk management purposes, etc.);

• the AI should obtain a forward-looking view on the
  AI’s capital adequacy through stress-tests and scenario analyses. The AI should conduct stress tests that take into account the risks of the environment and the prevailing stage of the economic cycle in which it is operating, to assess the impact of possible adverse events or scenarios on its capital. The AI should analyse what impact new legislation or competitors’ actions may have on its performance, in order to ascertain what changes in the environment it could sustain. The requirements and scenarios for stress-testing should be proportionate to the nature, size, risk profile and complexity of the AI’s business activities. Most importantly, the AI should aim at attaining a capital level that can withstand the stressed conditions in all the relevant stress tests (e.g. the supervisor-driven stress tests and other relevant stress tests conducted by the AI, and supervisory top-down solvency stress tests conducted by the MA, as applicable).
• the AI should evaluate whether its long-run capital
  targets might differ from its short-run goals, based on current and planned changes in its risk profile and the lead time for raising new capital;
• it is not necessary for the AI to use formal economic
  capital models for setting capital goals and targets and assessing its capital adequacy, although it is expected that more sophisticated AIs will elect to do so (in which case the additional criteria set out in subsection 4.4 have to be satisfied);
• the capital goals and targets should be reviewed and
  approved by the Board or designated committee of the Board regularly (at least annually) to ensure their appropriateness; and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• appropriate adjustments to the CAAP should be
  promptly initiated if changes in the business, strategy or operational environment suggest that the CAAP is no longer adequate.
  4.3.15 AIs should recognise that the §97F minimum CAR
  imposed on an AI represents a regulatory floor requirement below which the AI’s overall capital level must not fall, even if the AI’s management believes that a lower capital level is justified.
  4.3.16 AIs should ensure that adequate capital is held against
  all material risks not just at a point in time, but over time, to account for changes in their strategic direction, evolving economic conditions and volatility in the financial environment. Design of CAAP
  4.3.17 AIs may design their CAAP in different ways to cater for
  their individual needs and circumstances. The following are some options that AIs may have reference to:
• using the BCR minimum CAR as a starting point and
  adding considerations which are not captured, or not adequately captured, by the BCR minimum CAR. For many small and less complex AIs, a relatively simple CAAP is entirely acceptable. One possibility might be to base their CAAP primarily on the methodology set out in the Banking (Capital) Rules, supplemented as necessary for any other generic factors which have a particular bearing on their risk profile (e.g. in terms of size, sector or products). For example, to obtain a capital goal, an AI may simply take the BCR minimum CAR and adjust it with a self-determined “capital surcharge” 21 which is

21 The term “capital surcharge” referred to in para. 4.3.17 covers the situation in which an AI determines the additional capital it should maintain on top of the BCR minimum CAR based on its own internal capital assessment.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 calibrated from elements outside the consideration of the BCR minimum CAR and from other forward￾looking elements (including the effect of stressed conditions). The AI should be able to demonstrate that it has adequately analysed all material risks outside the BCR minimum CAR and found that all such risks were covered by the “capital surcharge”;

• using different methodologies for different risk types
  (including all risks captured by the BCR minimum CAR and the self-determined “capital surcharge”) and then calculating a simple sum of the resulting capital “needs”;
• using a more sophisticated and complex system,
  e.g. “bottom-up” transaction-based approaches with integrated correlations; or
• using a combination of the above.
  4.3.18 AIs should ensure that decisions regarding the design
  and operation of the CAAP should not be unduly influenced by competing business objectives.
  4.3.19 AIs should enhance and refine their CAAP over time,
  taking into account changes in their risk profile and activities as well as advances in risk measurement and management practices. Documentation of CAAP
  4.3.20 AIs should have complete documentation covering the
  CAAP. Such documentation should at least include:
• a description of the overall process;
• all related policies and management guidelines;
• all committees and individuals involved in the CAAP,
  including their responsibilities;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• the methodologies, assumptions and procedures
  used in the CAAP, covering all aspects ordinarily expected for the sound use of quantitative methods, including model selection, limitations, data selection and maintenance, controls and validation;
• the frequency of CAAP-related reporting; and
• the procedures for the periodic evaluation of the
  appropriateness and adequacy of the CAAP.
  4.3.21 The documentation of the CAAP should be subject to
  periodic review and approval by the Board (at least annually).
  4.3.22 The CAAP and related policies, management guidelines
  and procedures should be communicated and implemented firm-wide and supported by sufficient authority and resources.
  4.4 Additional criteria for use of risk-modelling techniques
  4.4.1 Larger and more sophisticated AIs may prefer using risk￾modelling techniques (e.g. economic capital or other
  models) to perform risk aggregation and to assess capital adequacy within a certain degree of confidence. Nevertheless, this approach is not mandatory.
  4.4.2 AIs using risk-modelling techniques to assess capital
  adequacy should ensure that their CAAP is a comprehensive process seeking to identify their capital needs on the basis of both quantifiable and non￾quantifiable risks. AIs should not rely on quantitative methods alone to assess capital adequacy. Non￾quantifiable risks, if material, should also be included using qualitative assessment and management judgement. For example, in modelling the potential consequences of individual risks, account needs to be taken not only of the immediate direct profit and loss impact of possible loss events, but also of their potential consequential cost in terms of damage to AIs’ reputation and future earning capacity.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
4.4.3 Under no circumstances should the CAAP be a process
which focuses only narrowly on the calculation and use of allocated capital or economic value added for individual products or business lines for internal profitability analysis. This approach can be important to an AI in targeting activities for future growth or retrenchment. However, the AI is required to first determine (by whatever methods are deemed most appropriate to the AI’s circumstances) the amount of capital necessary for each activity or business line as a tool for evaluating the overall capital adequacy of the AI. Thus, the process for determining the necessary capital should not be confused with the related management efforts to measure relative returns of the AI or of individual business lines, given an amount of capital already invested or allocated.
4.4.4 AIs must have in place adequate policies, controls and
procedures to validate, on a regular basis, the methodology and data and the robustness of the systems and processes involved in modelling the probabilities of occurrence, and the potential consequences of individual risks and their aggregation. Such policies, controls and procedures should be appropriate for their nature of business and level of sophistication, as well as the relative importance of each component of the CAAP. The internal validation process should encompass, but should not be limited to, the collection and review of developmental evidence, process verification, benchmarking, outcomes analysis, and monitoring activities used to confirm that processes are operating as designed. AIs should also be able to demonstrate that their validation process is adequate to enable them to assess the performance of the risk￾modelling techniques consistently and meaningfully.
4.4.5 The MA will assess whether the overall assessment and
validation processes are commensurate with the nature, size and complexity of the AI’s business and whether the outcomes generated from the processes are reasonable. The MA will also assess the extent to which the risk-

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 modelling techniques, and the risk-adjusted performance measurement they support, are actually employed in managing the AI’s business. Obviously it will be difficult to assign much credibility to a model in respect of which an AI lacks either the confidence, or the perceived need, to use it for the purpose of making its business decisions.
4.5 Requirements for consolidated capital
4.5.1 AIs are required to conduct their CAAP on a consolidated
basis if they have any subsidiary that is subject to §3C of the Banking (Capital) Rules.
4.5.2 AIs conducting their CAAP at the group level should
ensure that their consolidated capital is adequate to:

• support the volume and risk characteristics of all
  parent and subsidiary activities; and
• provide a sufficient cushion to absorb potential
  losses arising from such activities.
  4.5.3 AIs should also be able to demonstrate to the satisfaction
  of the MA that:
• their CAAP has been conducted on a consolidated
  basis and the total capital estimated as appropriate for the group has been allocated to each group member, according to their risk profile;
• all group members, including the AI itself, have fully
  evaluated the risks they face (including reputation risk arising from the failure of another group member, and the risks they face due to exposure to, or dependence on, other group members);
• capital is freely transferable within the group (even in
  situations where the group is under financial stress, especially in relation to the group’s cross-border operations where jurisdictional issues come into play); and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• in case there is capital that is not, or that is unlikely
  to be, freely transferable between legal entities within the group, the CAAP has been adjusted to exclude such capital from the consolidated capital adequacy assessment.
  4.5.4 In assessing the capital adequacy of the consolidated
  position, the MA will apply the same standards and requirements as he applies for assessing the capital adequacy of an AI on a solo basis.
  4.6 Application to subsidiary AIs
  4.6.1 Unless otherwise specified in paras. 2.6.322 and 4.6.2, all
  subsidiary AIs are required to ensure that they are adequately capitalised on a stand-alone basis and have their own CAAP, commensurate with, and proportionate to, the nature, size and complexity of their business in Hong Kong, for supervisory review purposes. The MA will continue to exercise his legal duty under the Banking Ordinance to monitor their capital adequacy and their compliance with the Banking (Capital) Rules through the SRP.
  4.6.2 Where appropriate, subsidiary AIs of a foreign banking
  group may adopt the CAAP methodology used by their parent bank at the group level or, if their capital is centrally managed at the group level, rely on the group CAAP for assessing their capital adequacy. This is on the basis that the group CAAP is conducted in accordance with supervisory standards and criteria that are comparable with those required by the MA, and that the CAAP outcome for the subsidiary AIs has taken into account their local business strategies and associated risks.

22 Under para. 2.6.3, a local banking group may develop a group CAAP covering the positions of its subsidiary AIs if their capital is centrally managed at the group level.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
4.6.3 Any foreign-owned subsidiary AIs that apply the group
CAAP for assessing their capital adequacy should be able to explain and demonstrate to the satisfaction of the MA how the capital assessment or allocation is made and how the assessment process meets supervisory standards and criteria comparable to those of the MA. They have the primary responsibility for providing the MA with any information, documentation and evidence that he may require for conducting the SRP. For example, the MA may require a subsidiary AI to provide an independent review or audit report in relation to the adequacy and integrity of the overall assessment process and/or the validity of the models used for the assessment.
4.6.4 If a foreign-owned subsidiary AI is unable to satisfy the
above-mentioned criteria, the AI will be required to establish and maintain its own CAAP in Hong Kong to meet the MA’s supervisory standards.
4.6.5 In reviewing the capital adequacy of foreign-owned
subsidiary AIs, the MA will also take into account the strength and availability of parental support and other relevant input from the home supervisor. For example, the MA may request the home supervisor to provide information and comments in respect of the capital adequacy of the parent bank or the results of its evaluation of the group CAAP systems.
4.6.6 The Board and senior management of subsidiary AIs
should note that their responsibility as mentioned in para.
4.2.1 remains unchanged irrespective of whether a group
CAAP methodology is adopted by a subsidiary AI.
4.7 Review by the MA
4.7.1 In reviewing and evaluating an AI’s CAAP, the MA will
have regard to the supervisory standards set out in this
section. Key factors to be considered include:

• the soundness of the overall CAAP given the nature
  and scale of the AI’s business activities;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• the degree of management involvement in the
  process, for example, whether the target and actual capital levels are properly monitored and reviewed by the Board (or a designated committee) and senior management;
• the extent to which the internal capital assessment
  is used routinely within the AI for decision-making purposes;
• the extent to which the AI has provided for
  unexpected events in setting capital levels; and
• the reasonableness of the outcome of the CAAP in
  terms of whether:
  − the amount of capital required as demonstrated by the CAAP is sufficient to support the risks faced by the AI; − whether the levels and composition of capital chosen by the AI are comprehensive, relevant to the current operating environment, appropriate for the nature and scale of the AI’s business activities and can withstand stressed scenarios in all the relevant stress tests (e.g. the supervisor-driven stress tests and other relevant stress tests conducted by the AI, and supervisory top-down solvency stress tests conducted by the MA, as applicable); and
• the appropriateness and comprehensiveness of the
  potential capital actions identified in the CAAP to address any capital shortfall.
  4.7.2 AIs should be able to explain and demonstrate to the
  satisfaction of the MA:
• how their CAAP meets supervisory requirements;
• how their material risks are defined, categorised and
  measured (if their own terminology is adopted), and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 how their approach relates to their obligations under the Banking (Capital) Rules; and

• how the internal capital targets are determined and
  how these targets are consistent with their overall risk profile and the current operating environment as well as current and planned business needs. AIs are also expected to explain the similarities and differences between the level of capital calculated under their CAAP and their regulatory capital requirements.
  4.7.3 The MA expects that AIs with complex operations should
  have a more structured and well-defined risk management framework to monitor the effectiveness of internal control processes and risk exposures in comparison to AIs with simple organisational structures and less complex operations and activities, for which a less sophisticated firm-wide risk management framework may be more appropriate.
  4.7.4 In assessing whether AIs have sufficient capital to enable
  them to continue to operate their business on a going concern basis, the MA will place particular importance on, among other things, the capacity of an AI’s capital structure to absorb losses and how this structure could be adversely affected by changes in performance23. The MA recognises that Tier 1 capital is an important component of an AI’s capital structure because it allows AIs to absorb losses on an ongoing basis and is permanently available for this purpose. It also allows AIs to conserve resources when they are under stress as AIs have discretion as to the amount and timing of dividends

23 For example, an AI experiencing a net operating loss (perhaps due to realisation of unexpected losses) will not only face a reduction in its retained earnings but also possible constraints on its access to capital markets. These constraints could be exacerbated if detrimental conversion options are exercised. These adverse effects could be further accentuated if adverse events take place at critical junctures for raising or maintaining capital (e.g. as term capital instruments are approaching maturity or new capital instruments are being issued).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 and other distributions 24 . Therefore, AIs should determine the optimal level of Tier 1 (in particular CET1 capital) and Tier 2 capital to be maintained to meet their capital goals. AIs should also note that the capital structure implied by the BCR minimum CAR is only a minimum standard. AIs should attach more weight to CET1 and Tier 1 capital components in their capital structure if it is prudent to do so.
4.7.5 If an AI’s CAAP does not meaningfully link the
identification, evaluation and monitoring of the risks that arise from the AI’s business activities to the determination of its capital needs, the MA will require the AI to improve the CAAP for better integration with internal risk measurement and analysis. The MA will monitor the progress made by the AI in implementing the corrective actions.
4.7.6 Where the amount of capital which the MA considers that
the AI should hold is not the same as that generated from the AI’s CAAP (particularly where the amount of capital generated is lower than that expected by the MA), the MA will discuss the difference with the AI. The MA will take into consideration the results of the CAAP and any explanations from the AI in relation to the outcome and appropriateness of the CAAP when determining the Pillar 2 capital requirement.
4.7.7 To facilitate his review, the MA will ask for information
such as the results of an AI’s CAAP, together with an explanation of the process used. The MA will require the AI to provide information not only on the amount of capital it considers appropriate, but also on the composition of that capital. In the case of a group CAAP, there should be a breakdown of group capital so as to facilitate evaluation of the extent to which diversification

24 In fact the Basel III capital framework has leveraged on this characteristic and imposed earnings conservation requirements for banks to observe when their capital level falls within the capital buffer range. This is reflected in the Part 1B Division 2 of the Banking (Capital) Rules.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 benefits have been incorporated into the underlying assumptions.
4.7.8 The MA may seek other additional information from the
AI where necessary.
—————————
Contents Glossary Home Introduction

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
Annex A: List of major supervisory guidelines applicable to
assessment of capital adequacy
A1 Introduction
A1.1 This annex sets out the major supervisory guidelines applicable to the assessment of AIs’ capital adequacy under the SRP. The MA will have regard to AIs’ compliance with the relevant supervisory standards and best practices contained in these guidelines (particularly in relation to systems and controls and corporate governance) when considering the impact of various assessment factors on an AI’s capital adequacy. A1.2 This list is provided for AIs’ reference only, and should not be regarded as a complete and exhaustive list. With a view to promoting the adoption of international standards and best practices within the banking sector, the MA will continue to issue new, and update existing, supervisory guidelines to provide guidance to AIs on various risk and control factors covered under the SRP. A1.3 AIs should refer to the Supervisory Policy Manual and other guidelines and circulars issued by the MA for a complete set of supervisory guidelines issued to the banking industry. A2 Guidelines under Supervisory Policy Manual by subject Supervisory approach SA-1 Risk-based supervisory approach SA-2 Outsourcing Corporate governance CG-1 Corporate governance of locally incorporated authorized institutions CG-2 Systems of control for the appointment of managers CG-3 Code of conduct CG-5 Guideline on a sound remuneration system

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 CG-6 Competence and ethical behaviour Internal controls IC-1 General risk management controls IC-2 Internal audit function IC-4 Complaint handling procedures IC-5 Stress-testing IC-6 The sharing and use of consumer credit data through a credit reference agency IC-7 The sharing and use of commercial credit data through a commercial credit reference agency Capital adequacy CA-G-1 Overview of capital adequacy regime for locally incorporated authorized institutions CA-G-3 Use of internal models approach to calculate market risk CA-G-4 Validating risk rating systems under the IRB approaches CA-S-4 Capital adequacy requirements for investment guarantees under mandatory provident fund schemes CA-S-5 Use of internal models to measure market risks for investment guarantees under MPF schemes CA-S-10 Financial instrument fair value practices CA-B-1 Countercyclical Capital Buffer (CCyB) - Approach to its Implementation CA-B-2 Systemically Important Banks CA-B-3 Countercylical Capital Buffer (CCyB) – Geographic Allocation of Private Sector Credit Exposures Consolidated supervision CS-1 Group-wide approach to supervision of locally incorporated authorized institutions Credit risk management Risk management

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 CR-G-1 General principles of credit risk management CR-G-2 Credit approval, review and records CR-G-3 Credit administration, measurement and monitoring CR-G-5 Country risk management CR-G-6 Interest recognition CR-G-7 Collateral and guarantees CR-G-8 Large exposures and risk concentrations CR-G-9 Connected lending CR-G-10 Problem credit management CR-G-12 Credit derivatives [To be expanded and retitled “Credit risk transfer”] CR-G-13 Counterparty credit risk management Specific lending activities CR-S-2 Syndicated lending CR-S-4 New share subscription and share margin financing CR-S-5 Credit card business Interest rate risk management IR-1 Interest rate risk management Liquidity risk management LM-1 Liquidity risk management [To be revised as “Regulatory framework for supervision of liquidity risk”] LM-2 Sound systems and controls for liquidity risk management Operational risk management OR-1 Operational risk management Reputation risk management RR-1 Reputation risk management Strategic risk management SR-1 Strategic risk management Trading activities

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 TA-1 Market risk management [Under development] TA-2 Foreign exchange risk management Technology risk management General technology risk management TM-G-1 General principles for technology risk management TM-G-2 Business continuity planning Electronic banking TM-E-1 Risk management of e-banking TM-E-2 Regulation of advertising material for deposits issued over the internet Securities and leveraged foreign exchange business SB-1 Supervision of regulated activities of SFC-registered authorized institutions SB-2 Leveraged Foreign Exchange Trading – Conduct of Unsolicited Calls Mandatory Provident Fund MP-2 Provisioning requirements for investment guarantees under Mandatory Provident Fund Schemes Prevention of money laundering and terrorist financing ML-1 Guideline on Anti-Money Laundering and Counter￾Terrorist Financing Disclosure CA-D-1 Guideline on the application of the Banking (Disclosure) Rules Recovery planning RE-1 Recovery planning A3 Other Guidelines and Circulars

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 A3.1 Other relevant guidelines and circulars are available for AIs’ access on the HKMA’s public website (http://www.hkma.gov.hk/eng/key-information/guidelines-and￾circulars/circulars/2016/) and private website. The major subjects covered by guidelines and circulars not included in
section A2 above are highlighted for reference:
 Consumer protection;
 Specific lending activities, e.g. property lending, etc;  Debt collection;  Liquidity risk management in relation to RTGS;  Market risk management;  RMB business and associated risk management; and  Risk management of securities, insurance and MPF activities.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
Annex B: Factors for assessing capital adequacy under SRP
B1 Introduction
B1.1 The purpose of this annex is to illustrate the MA’s approach to assessing the capital adequacy of AIs by setting out the key assessment factors used by the MA under the SRP. This list of factors is compiled for AIs’ reference, and should not be regarded as a complete and exhaustive list. B1.2 Broadly speaking, the MA’s assessment under the SRP focuses on the following aspects:

• the level of inherent risks faced by an AI (in particular those
  risks that are not captured, or not adequately captured, under Pillar 1);
• the adequacy of the AI’s systems and controls relating to
  each type of inherent risk;
• the AI’s capital strength and capability to withstand risk
  (including, where applicable, the effectiveness of its CAAP);
• the adequacy of the AI’s corporate governance
  arrangements; and
• any other factors (risk increasing or risk mitigating) that are
  specific to the AI concerned.
  Given their common applicability to AIs, the first four items listed above are referred to as “common assessment factors”. The last item is referred to as “specific assessment factors”, which will be considered by the MA on a case-by-case basis. B1.3 In reviewing the common assessment factors (particularly in respect of systems and controls and CAAP), the MA places special emphasis on an AI’s ongoing compliance with the Banking (Capital) Rules, including those qualifying criteria and minimum requirements to which the AI is subject (e.g. relating to the adoption of the IRB approach, IMM approach or IMM(CCR) approach), and the extent to which the supervisory standards

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 and best practices contained in the relevant guidelines issued by the MA (see Annex A) have been complied with. The MA also considers the quality of the AI’s systems and controls (including the level of firm-wide oversight exercised by the Board and senior management), the manner in which business risks and activities are aggregated (and any resultant risk concentrations are identified and controlled), and senior management’s track record in responding to emerging or changing risks. B1.4 The MA takes into account the business nature and the scale of operations (i.e. size, risk profile and complexity) of individual AIs and their significance to financial stability or other supervisory objectives in determining whether a factor is applicable or material to the assessment. B1.5 The MA employs a variety of methodologies and techniques to assess the effects of these factors, including the adoption of a scoring system for the common assessment factors, which, where appropriate, incorporates the use of stress-testing, peer group comparisons, benchmarking against industry performance and other relevant qualitative and quantitative analyses. The specific assessment factors are separately considered by the MA on a case-by-case basis, using similar methodologies and techniques. B2 Inherent risks not captured or not adequately captured under Pillar 1 B2.1 Credit concentration risk

• Generally, a risk concentration is any single exposure or
  group of similar exposures to the same borrower or counterparty (who may be a protection provider), geographical area, industry, economic sector or other risk factors with the potential of producing losses large enough (relative to an AI’s capital, earnings, total assets, or total risk exposures) to threaten the AI’s financial position or ability to maintain its core operations, or of producing a material change in the AI’s risk profile.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• Because lending is the primary activity of most AIs, credit
  concentration risk is often the major source of risk concentration for an AI. As such, credit concentration risk is separately assessed under the common assessment factors. Other sources of risk concentration (e.g. those arising from funding sources or through a combination of exposures across different risk factors), if material, are assessed under specific assessment factors (see subsection B6.1 and Annex F for more details).
• Credit concentration risk is normally driven by some
  common or correlated risk factors (e.g. changes in economic or market conditions affecting specific industries or sectors), which, in times of stress, will increase the likelihood of default of, or credit deterioration in, individual counterparties or groups of related counterparties making up the concentration. Such concentration risk arises from direct exposures to counterparties and may also occur through exposures to the same credit protection provider or in relation to the obtaining of the same type of credit protection (e.g. the collateral obtained for share margin financing may be concentrated on a few listed stocks).
• In assessing the level of credit concentration risk, the MA
  pays particular attention to the sources of risk concentration arising from:
• large exposures to individual counterparties or groups of
  related counterparties (including credit protection providers);
• “clustered” loan portfolios (i.e. portfolios with a large
  number of sizable single exposures);
• business activities (including lending, trading and
  investment);
• exposures to particular economic sectors or
  geographical locations;
• concentration of exposures by product, service, market
  or collateral; and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• other concentrations, such as those arising from
  concentration on a particular type of off-balance sheet exposure (e.g. credit derivatives or other complex financial instruments). B2.2 Residual operational (and legal) risk
• Gross income, used in the basic indicator approach and the
  standardized approach for the calculation of operational risk capital charge under the Banking (Capital) Rules, is only a proxy for the scale of operational risk exposures of an AI and can, in some cases (e.g. for AIs with low earnings or profit margins), underestimate the capital which should be held against operational risk.
• There is thus a need to determine any residual risk of
  operational loss resulting from an AI’s internal processes, staff and systems, or from external events (including lawsuits).
• In conducting the SRP, the MA considers whether the level
  of operational risk capital imposed on individual AIs under the Banking (Capital) Rules can adequately reflect their operational risk exposures, for example, in comparison with other AIs of similar size and with similar operations. The MA pays particular attention to risk factors that may not be fully accounted for in the estimation of such capital. These include incomplete identification of risks, the adoption of higher risk business models, and the existence of significant contingent liabilities.
• The MA also reviews the nature, frequency, and materiality
  of operational loss events incurred by AIs, and has regard to any of their business activities, functions or operational processes that may pose a higher level of operational risk (e.g. undue reliance on outsourced activities or significant operations in politically unstable areas). B2.3 Interest rate risk in the banking book
• This is the risk to an AI’s financial condition resulting from
  adverse movements in interest rates. The MA assesses the

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 level of interest rate risk in the banking book associated with an AI’s business activities from two separate but complementary perspectives, i.e. earnings and economic value.

• In assessing the level of an AI’s interest rate repricing risk,
  the MA, among other things, models a standardised 200- basis-point parallel rate shock to the AI’s interest rate risk exposures to measure the impact of the shock on its earnings over the next 12 months and on its economic value. The MA is particularly attentive to those AIs where the impact of the shock on their economic value is more than 20% of their capital base. Where appropriate, the MA will apply stress-testing techniques, especially in assessing an AI’s basis, options and yield curve risks.
• The MA will determine whether AIs whose interest rate
  exposures may lead to a significant decline in their earnings or economic value are exposed to a higher level of interest rate risk. B2.4 Liquidity risk
• Liquidity is crucial to the ongoing viability of an AI. An AI
  having a relatively weak liquidity position or less effective liquidity risk management systems may tend to be more vulnerable to financial stress, and hence would need to be safeguarded by a stronger capital position. The capital position of an AI can have an effect on its ability to obtain liquidity, especially during a period of stress.
• When evaluating an AI’s capital adequacy, the MA takes into
  account its liquidity risk profile and the liquidity of the markets in which it operates under both normal and stressed conditions.
• Factors to be considered include the level, trend and
  volatility of the AI’s liquidity ratio (that is, the Liquidity Coverage Ratio (LCR) in the case of a category 1 institution,

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 or the Liquidity Maintenance Ratio (LMR) in the case of a category 2 institution) 25, its loan-to-deposit ratio and maturity profile, the stability and concentration of its funding sources and other relevant factors such as its borrowing capability and access to money markets (particularly during emergency or crisis situations), its potential exposure to contingent liquidity obligations, and the availability of liquidity support from its major shareholders in case of need.

• In addition, the MA assesses the adequacy and quality of an
  AI's stock of liquid assets that can be used by the AI to weather severe stress events (including prolonged market stresses), having regard to the results of liquidity stress tests conducted by the AI. In the case of retail banks, their ability to withstand bank-run scenarios will be further considered, based on the results of applying liquidity stress tests to the quarterly cash flow data submitted by these banks. B2.5 Strategic risk
• This is the risk of current or prospective impact on an AI's
  earnings, capital, reputation or standing arising from changes in the environment in which the AI operates and from adverse strategic decisions, improper implementation of decisions, or lack of responsiveness to industry, economic or technological changes.
• Strategic risk is a function of the compatibility of an AI’s
  strategic goals, the strategies developed to achieve these goals, the resources deployed to meet these goals, and the quality of implementation. The resources needed to implement an AI's strategies are both tangible and intangible. They include capital and funding, communication channels, staffing and operating systems, delivery networks, and managerial resources and capabilities.

25 See the Banking (Liquidity) Rules for definitions applicable to the LCR, LMR, category 1 institution and category 2 institution.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• In assessing an AI’s level of strategic risk, the MA considers
  a number of factors, including:
  – the compatibility or suitability of the AI’s strategic goals and objectives (e.g. relative to its size and complexity); – the AI’s responsiveness to changes in the environment (including those developments resulting in economic, technological, competitive or regulatory changes); – the adequacy of resources (both tangible and intangible) provided by the AI to carry out strategic decisions; – the AI’s track record in implementing strategic decisions (such as past performance of overseas operations and joint ventures and in offering new products and services); – any adverse impact on the AI (e.g. reputation or financial position) arising from its strategic decisions; and – any other warning signals of high potential strategic risk. B2.6 Reputation risk
• This is the risk that an AI's reputation is damaged by one or
  more than one reputation event26, as reflected from negative publicity regarding the AI’s business practices, conduct or financial condition. Such negative publicity, whether true or not, may impair public confidence in the AI, result in costly litigation, or lead to a decline in its customer base, business or revenue.
• The major factors that the MA takes into account in
  assessing an AI’s level of reputation risk are listed below.

26 A reputation event includes any action, incident or circumstance in relation to an AI which induces, or is likely to induce, reputation risk for the AI. For example, such an event may arise from market rumours, severe regulatory sanctions, or heavy financial losses. Some of these events, if not acted upon swiftly and effectively, may turn into a full-blown crisis (such as a bank run).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 These are not necessarily all-inclusive, but will serve as a guide for assessment purposes:
− the market or public perception of the financial strength of the AI’s major shareholders, its management and financial stability, and the prudence of its business practices; − management’s willingness and ability to adjust, where necessary, the AI’s strategies to enhance its reputation and standing (e.g. in response to changes in market perception, rules and regulations, or legal barriers) ; − the AI’s history of formulating business strategies and making commercial decisions that affect its financial position, business conduct and reputation, including those that reflect on the fairness and integrity of its business dealings (e.g. in relation to the provision of banking services, charging of fees, etc.); − the AI’s history of, and plans for, analysing risk in new products and services, developing relevant policies and conducting due diligence; − the nature and volume of customer complaints and management’s willingness and ability to respond to those complaints; − management’s ability to handle any scandal or negative publicity to minimise damage to the AI’s reputation; − the existence of highly visible or conspicuous litigation (and historical losses arising from such litigation); − the level of the AI’s exposures associated with off￾balance sheet vehicles (e.g. exposures to sponsored securitization structures), and its history of, or potential for, providing implicit support to such vehicles in times of stress due to reputation considerations (see Annex E for more details);

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 − the existence of appropriate fiduciary or other liability insurance to mitigate potential losses arising from litigation or claims; and − the AI’s history with respect to conduct of business practices and compliance with laws and regulations, and management’s willingness and ability to address concerns uncovered in internal or regulatory reviews.

• For AIs that are subsidiaries of a banking group (local or
  foreign) or are branches of foreign-owned banks, the MA will additionally consider whether the financial position, reputation or conduct of the parent bank or head office, or any other member of the group could undermine confidence in the AI through “contagion”. The risk of contagion is not confined to financial weaknesses. Adverse publicity about illegal or unethical conduct by these entities may also damage the AI’s reputation. B3 Systems and controls relating to each type of inherent risk B3.1 Under the SRP, the MA evaluates the adequacy and effectiveness of systems and controls for managing the eight types of inherent risk (i.e. credit, market, interest rate, liquidity, operational, legal, reputation and strategic) identified for the purposes of risk-based supervision. B3.2 The MA’s assessment of an AI’s systems and controls for managing the inherent risks generally includes the following factors:
• Risk management systems – the MA reviews the adequacy
  of the AI’s risk management policies, procedures and limits as well as the effectiveness of its risk identification, measurement, monitoring and reporting processes to ensure compliance with the established policies, procedures and limits. The AI’s level of compliance with risk management standards set out in the MA’s supervisory guidelines in respect of different types of risk will also be a basis for assessment;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• Internal control systems and environment – the MA
  assesses the appropriateness of the AI’s organisation structure, the adequacy of its internal control systems (e.g. segregation of duties and responsibilities, risk and quality control and fraud detection) and the effectiveness of its audit and compliance functions;
• Infrastructure to meet business needs - the MA reviews the
  capability and reliability of the AI’s IT systems, the adequacy, competence and stability of management and staff resources, the appropriateness and adequacy of outsourcing arrangements as well as management oversight and controls over back-office or supporting functions located outside Hong Kong (if any); and
• Other supporting systems - these normally include
  accounting and management information systems, compilation of prudential returns and information, and systems and controls for prevention of money laundering and terrorist financing activities. The MA assesses the adequacy of these supporting systems. B3.3 The MA reviews an AI’s systems and controls based on the findings and results gathered from his offsite reviews or onsite examinations, and makes use of any information obtained from various sources such as banking returns, prudential interviews, tripartite meetings and routine supervisory contacts. The MA will also pay attention to the timeliness and effectiveness of corrective actions taken by the AI to address deficiencies identified, whether by supervisors or other independent reviewers (e.g. internal and external auditors). B3.4 The MA will have regard to the size, complexity and geographical diversity of an AI’s business operations in determining whether the systems and controls in place are adequate and commensurate with such operations. B4 Capital strength and capability to withstand risk (including CAAP) B4.1 Review of CAAP

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• The MA assesses the CAAP of AIs that are subject to the
  CAAP standards set out by him against those standards. Among other things, the MA will:
• assess the degree to which the AI’s CAAP and internal
  capital targets have incorporated the full range of material risks faced by it;
• review the adequacy of risk measures used in assessing
  internal capital adequacy and the extent to which these risk measures are used operationally in setting limits, evaluating business line performance, and evaluating and controlling risks more generally;
• consider, in particular, whether the AI’s remuneration
  and valuation practices have any adverse effects on its capital adequacy27;
• determine whether capital targets are comprehensive
  and relevant to the current operating environment, and are properly monitored and reviewed by senior management;
• determine whether the composition of capital is
  appropriate for the nature and scale of the AI’s business; and
• consider the extent to which the AI has provided for
  unexpected events in setting its capital levels, whether the analysis covers a wide range of external factors, conditions and scenarios, and whether the stress-testing techniques and scenarios used are commensurate with the AI’s activities.
• For AIs that are not subject to the CAAP standards, the MA
  assesses their capital planning and management processes, taking into account their business size and complexity.

27 For example, remuneration policies that encourage excessive short-term profit-taking may pose longer-term risks to the AI, whilst the lack of robust valuation methodologies and procedures may understate the potential risks arising from illiquid positions.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 B4.2 Review of capital strength and capability to withstand risk

• An overall assessment of capital adequacy should take into
  account all factors that affect an AI’s financial condition. Therefore, apart from those mentioned in subsection B4.1 above, the MA will consider the following factors:
  Capital structure, level and trends
• The MA compares the level and trend of an AI’s actual
  CAR with the §97F minimum CAR assigned to the AI (also taking into account the AI’s BCR buffer level or §97F buffer level, whichever applicable) and with the average levels of CAR maintained by its peers to determine if its CAR has been kept at prudent levels. In addition, the projected asset growth and earnings performance should reasonably support an AI’s ability to maintain its capital levels without undue reliance on capital injections. For a newly authorized AI, the level of its CAR should be reasonable in relation to its business plans and competitive environment.
• The MA also reviews the quality of an AI’s capital by
  analysing the composition of its capital base (e.g. the level of CET1 / Tier 1 capital in relation to total capital base). Strategic planning − The MA assesses whether an AI’s capital planning is supported by an effective strategic plan which should clearly outline the AI’s capital needs, anticipated capital expenditures, desirable capital level, and external capital sources. The Board and senior management should regard capital planning as a crucial element for achieving the desired strategic objectives, and should effectively communicate the AI’s corporate goals and objectives throughout the organisation. Business expansion

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 − The MA assesses whether an AI has adequate capital resources to support its business growth. The MA will pay particular attention to situations where rapid lending growth may become a cause for concern if this is achieved by reducing the AI’s underwriting standards and increasing its risk profile. Dividends − Excessive cash dividend payments may weaken an AI’s capital adequacy. The MA reviews an AI’s dividend policy as well as its historical and planned cash dividend payout ratios to determine whether dividend payments are impairing capital adequacy. Access to additional capital − AIs that do not generate sufficient capital internally may require external sources of capital. Large, independent AIs may solicit additional funding from the capital markets to support their business growth or acquisition plans. Smaller AIs may rely solely on their parent banks or major shareholders to provide additional funds, or on the issue of new capital instruments to existing or new investors. − The MA assesses an AI’s ability to obtain additional funding from the capital markets in times of need, taking into account the potential difficulties in raising additional capital during downturns or other times of stress, and the strength and availability of its parental support in the provision of new capital. If the AI has subsidiaries and affiliates, the MA will review its commitment and responsibility to provide capital to these subsidiaries and affiliates. − The MA also expects an AI to have a plan that enables it to operate effectively throughout a severe and prolonged period of financial market stress or an adverse credit cycle, as well as contingency plans that address

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 unexpected capital or liquidity needs during crisis situations. Asset quality and provisions − The MA takes into account the potential impact of an AI’s asset quality, particularly the severity of its problem and classified assets and the adequacy of its bad debt provisions, on its capital adequacy. Earnings − The MA assesses an AI’s earning ability to ascertain the stability of its capital. Poor earnings or losses can adversely affect an AI’s capital adequacy by preventing the AI from replenishing its capital internally in the case of poor earnings or by depleting its CET1 capital in the case of losses. Off-balance sheet items − Once funded, off-balance sheet items become subject to the same capital requirements as on-balance sheet items. The MA reviews an AI’s off-balance sheet activities (including securitization transactions) to assess whether its capital levels are sufficient to support the on￾balance sheet assets that would result from a significant portion of the off-balance sheet items being funded within a short time, and to evaluate the possibility of the AI having to bring a portion of securitized assets (e.g. in respect of the AI’s sponsored securitization structures) onto its balance sheet and the likely impact of this on its capital and financial positions (see Annex E for more details). Market value of an AI’s stock − For a listed AI, its stock price is reflective of investors’ confidence in, and support for, the AI, the lack of which could impair the AI’s ability to raise additional capital. If an AI’s stock is trading at low prices, it may indicate investors’ lack of confidence in the AI, or that there are

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 other problems besetting the AI. The MA reviews whether the stock of the AI or, where applicable, its listed parent bank or holding company has been trading at reasonable prices (e.g. in terms of a reasonable multiple of its earnings or a reasonable percentage (or multiple) of its book value) in order to identify whether there are any concerns that warrant his attention. Capital instruments with redemption features

• The MA assesses the potential performance of an AI’s
  capital instruments during times of stress and the ability of the instruments to absorb the AI’s losses and support its ongoing business operations.
• The MA will pay particular attention to the impact of
  redemption (including early redemption) of capital instruments with redemption features on an AI’s overall capital structure. The AI should thoroughly assess such impact if the redemption could have a material effect on the level or composition of its capital base. If an AI plans to redeem a capital instrument with the proceeds of, or replace it by, a like amount of a similar capital instrument, the AI should consider the likelihood that it will actually be able to do so within the time planned.
• In reviewing an AI’s funding and financial condition, the
  MA also takes into account the potential impact of redemption of capital instruments that are not eligible for inclusion in the calculation of the AI’s §97F minimum CAR. Unrealised asset values
• AIs may have assets on their books that are carried at
  significant discounts below current market values. The excess of the market value over the book value (historical or acquisition cost) of assets such as investment securities or bank premises may represent capital to the AI.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• The Banking (Capital) Rules allow certain amounts of
  unrealized gains on asset values to be included in the calculation of the regulatory capital base. In some cases, such as for example unrealized gains on real property revaluation, the amount which can be included is subject to restriction, which effectively results in a certain amount of unrealized gain being “disallowed” from inclusion. In the SRP review of an AI’s overall capital adequacy, the MA however takes these asset values into account, considering in particular the nature of the assets, the reasonableness of their valuation, their marketability, and the likelihood of their sale. Whilst adopting this broader view, the MA is nevertheless concerned to identify cases where there appears to be undue reliance on unrealised gains to satisfy actual and projected capital requirements. Even though Basel III allows unrealised gains on securities to be recognized in the regulatory capital base, the MA will expect AIs not to place undue reliance on unrealised gains in constituting their CET1 capital.
• In assessing an AI’s capability to withstand risk, the MA
  conducts sector-wide stress tests to assess individual AIs’ vulnerability to severe market shocks or crisis situations (e.g. based on hypothetical scenarios that are similar to, or more severe than, those experienced during the 1997/1998 Asian Crisis or the 2007/2008 Global Financial Crisis). The MA also considers whether “outlier” AIs that show significant vulnerability to “stressed” situations, compared with their peers, warrant a higher §97F minimum CAR, §97F buffer level and/or a reduction in risk exposures. B5 Corporate governance B5.1 A sound risk management process, strong internal controls and well documented policies and procedures are the foundation for ensuring the safety and soundness of an AI. As such, the Board and senior management of an AI are expected to have a reasonable understanding of the nature and level of risks being taken by the AI and how such risks relate to adequate capital levels. They should also be responsible for ensuring that the

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 formality and sophistication of the firm-wide risk management and control processes are appropriate in the light of the AI’s risk profile and business plans. B5.2 The Board and senior management of an AI should promote continuous and robust dialogue and information sharing among members of senior management and across business lines and risk management and control functions so that sources of significant risk to the AI as a whole can be promptly identified, analysed and mitigated. B5.3 When assessing the quality of an AI’s corporate governance, the MA reviews the above aspects in addition to other relevant requirements detailed in various guidelines issued by the MA. In particular, the Board and senior management will be evaluated in terms of:

• their risk management knowledge and experience;
• their participation and involvement in development of the
  AI’s risk management processes;
• their awareness of, and responsiveness to, risk
  management and control issues raised by the MA; and
• their willingness and ability to promote and maintain prudent
  remuneration policies and practices within the organisation. B6 Risk increasing factors B6.1 General
• Risk increasing factors are specific factors that negatively
  affect the risk profile of an AI and which may hence be indicative of a need for an increase in the AI’s Pillar 2 capital requirement. Such factors may relate to:
• Material risks specific to the AI’s business and operations
  or material risk concentrations identified within the AI’s business activities. For example, an AI may be exposed to business concentration risk by relying heavily on a

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 particular business activity, or the risk posed by its non￾banking activities (such as securities dealing or insurance-related activities) is becoming increasingly high, as a result of rapid expansion in the absence of adequate expertise and management systems;

• Significant “outliers” identified in the review of common
  assessment factors. These may relate to extremely high levels of inherent risk, substantial management problems or control weaknesses, or significant vulnerability to adverse economic events which warrant a full assessment of the additional capital required to cover the risks involved; and
• Specific issues arising from the application of the capital
  adequacy framework. In particular, these issues relate to an AI’s ongoing compliance with various minimum standards and requirements applicable to it for the purpose of calculating regulatory capital for credit, market or operational risk. The MA will consider such issues under the SRP if they are not adequately catered for under Pillar 1. Such issues may result in an AI being required to rectify deficiencies by improving its systems and controls or reducing its risk exposures, or to hold additional capital pending rectification of the deficiencies. See subsections B6.2 and B6.3 for a consideration of such issues in relation to credit risk (including counterparty credit risk) and market risk. Those relating to operational risk are mentioned under subsection B2.2.
• The MA should determine the extent to which the Pillar 2
  capital requirement of an AI should be increased due to a risk increasing factor based on his assessment of the extent to which such a factor has the potential to increase the risk of the AI. B6.2 Specific issues in relation to credit risk Credit risk mitigation

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• An AI may be exposed to residual credit risk associated with
  credit risk mitigation if the techniques used give rise to risks that could render the overall risk reduction less effective. Examples of these risks include:
• inability to seize, or realise in a timely manner, collateral
  pledged (on default of the obligor);
• refusal or delay by a guarantor to pay;
• ineffectiveness of untested documentation; and
• high cost credit protection transactions where there is an
  immediate regulatory capital benefit but a delayed recognition of losses or costs of protection in earnings by an AI. The relevant supervisory requirements and guidance relating to high cost credit protection transactions are set out in Annex G. There may also be specific wrong-way risk if there is a high correlation in the creditworthiness of a credit protection provider and the obligor due to their performance being dependent on common economic factors.
• The MA will determine if there are instances suggesting the
  lack of appropriate policies and procedures on the part of the AI to control these residual risks, and assess the need for taking appropriate action (e.g. increasing the AI’s Pillar 2 capital requirement). IRB approach
• An AI’s adoption of the IRB approach may give rise to some
  issues which will be subject to the MA’s review in determining the appropriate supervisory actions to be taken (including whether the AI’s regulatory capital requirement should be increased pending rectification of deficiencies). Examples include:
• deficiencies or flaws identified in the risk quantification or
  back-testing methodologies or processes associated with IRB models;

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• deviations from the reference definition of default used
  for risk estimation (e.g. use of external data or historical internal data not fully consistent with the reference definition of default prescribed by the MA);
• weaknesses arising from the application of credit risk
  stress tests under the IRB approach, such stress-testing being a requirement for using this approach. For example, the stress-testing processes or methodologies employed may not be appropriate to an AI’s circumstances or a capital shortfall (i.e. capital insufficient to cover the minimum capital requirements under the IRB approach according to the credit risk stress tests performed) is identified but not adequately addressed; and
• inadequate systems and controls (applicable to AIs
  adopting double default treatment) in monitoring the deterioration in the credit quality of protection providers and in assessing the impact of protection providers falling outside the eligibility criteria (due to rating changes) on their capital requirements at the time of default. Basic approach
• AIs using the basic approach are not subject to a higher
  capital charge for their past due exposures. If such exposures have reached a significant level compared with an AI’s peers, the MA may consider whether a capital adjustment under the SRP is necessary to reflect the higher risk associated with the problem exposures. Standardized approach
• AIs should have methodologies that enable them to assess
  the credit risk involved in exposures to individual borrowers or counterparties as well as at the portfolio level. AIs should assess exposures, regardless of whether they are rated or unrated, and determine whether the risk weights applied to such exposures are appropriate for their inherent risk.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• In those instances where an AI determines that the inherent
  risk of a credit exposure, particularly if it is unrated, is significantly higher than that implied by the risk-weight to which it is assigned, the MA expects the AI to consider the higher degree of credit risk in the evaluation of its overall capital adequacy.
• For more sophisticated AIs, the MA expects the credit
  review assessment of capital adequacy conducted as part of their CAAP, at a minimum, to cover four areas: risk rating systems, portfolio analysis / aggregation, securitization / complex credit derivatives, and large exposures and risk concentrations. Securitization
• The MA will be alert for any indication that may call into
  question an AI’s compliance with the relevant requirements on the recognition of risk transference for its securitization transactions. If the MA determines that the level of risk transfer for a particular transaction has been overstated and does not justify the capital relief granted, it may lead to an increase in capital requirements for the transaction concerned or, where necessary, an increase in the overall level of capital the AI is required to hold.
• Similarly, if there is indication that an AI has provided implicit
  support to transactions that it has securitized, the MA will consider the appropriateness of taking one or more supervisory actions (including an increase in the AI’s §97F minimum CAR) as specified in Part 7 of the Banking (Capital) Rules.
• In the event that an AI is engaged in complex securitization
  transactions the risks of which are not adequately accounted for under Pillar 1 (e.g. as a result of market innovations introducing new features to a securitization), the MA may consider imposing a specific capital treatment for such transactions or adjust the AI’s §97F minimum CAR to account for the additional risk incurred.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• The MA will also review any other issues arising from an AI’s
  compliance with the securitization requirements (e.g. in relation to call options and early amortization provisions) to determine the need for a capital adjustment or other supervisory actions.
• Annex E provides further discussion on the various risks
  associated with securitization and other off-balance sheet activities and the MA’s expectations of how such risks should be addressed by AIs in their CAAP and managed, as well as the MA’s approach to assessing such risks under the SRP. The MA will consider the need for additional capital or supervisory measures if there are major concerns in the way an AI addresses these risks. Counterparty credit risk
• The MA will focus substantially on an AI’s systems of control
  to manage the AI’s counterparty credit risk in assessing its capital adequacy in relation to such risk under the SRP.
• For an AI that uses the IMM(CCR) approach to calculate
  counterparty credit risk, where it is apparent to the MA that the estimates from the calculation do not adequately reflect the AI’s exposure to such risk, the MA will determine the appropriate action to be taken, which may include directing the AI to (i) revise its estimates; (ii) apply higher estimates of exposure or exposure at default (“EAD”) under the IMM(CCR) approach; or (iii) not recognise internal estimates of EAD for regulatory capital purposes.
• The MA will also assess AIs’ exposures to central
  counterparties under the SRP. In particular, an AI should review, and the MA will assess, whether there is a need for the AI to hold additional capital against such exposures, including any unlimited funding commitments arising from an AI’s default fund contributions (which are not entirely prefunded) to a central counterparty.
• Detailed supervisory requirements and guidance in relation
  to counterparty credit risk are set out in Annex H.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 B6.3 Specific issues in relation to market risk IMM approach

• A variety of issues may arise from an AI’s adoption of the
  IMM approach for the calculation of market risk. These include:
• deficiencies or flaws identified in the risk quantification or
  back-testing methodologies or processes associated with market risk internal models;
• deficiencies arising from valuation issues, such as
  inappropriate valuation adjustments to less well diversified portfolios or portfolios consisting of less liquid cash instruments;
• weaknesses arising from the application of market risk
  stress tests under the IMM approach, such stress-testing being a requirement for using this approach. For example, the stress-testing assumptions or methodologies may not be appropriate or commensurate with an AI’s trading activities or a capital shortfall (i.e. capital insufficient to cover the minimum capital requirements under the IMM approach according to the market risk stress tests performed) is identified but not adequately addressed; and
• weaknesses arising from capturing specific risk under the
  IMM approach. For example, model effectiveness is undermined by positions with limited price transparency or by illiquid positions, or the approach to capturing incremental risks28 is inadequate.
• The MA will determine the appropriate supervisory actions to
  be taken in respect of these issues (including whether the

28 These include default risk and credit migration risk that are incremental to the risks captured in the VaR-based capital charge calculations.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 AI’s §97F minimum CAR should be increased pending rectification of weaknesses). B7 Risk mitigating factors B7.1 Risk mitigating factors are specific factors that will have a positive impact on the risk profile of an AI and hence may reduce the need for, or amount of, any Pillar 2 capital requirement. They are used by the MA as incentives for AIs to improve their risk management so that the level of their inherent risks can be effectively mitigated. Risk mitigating factors may include:

• AIs using less advanced approaches for calculating
  regulatory credit or operational risk capital requirements, but possessing IRB/AMA capabilities for risk management purposes; and
• risk mitigating effect of insurance cover recognisable under
  AMA.
  B7.2 The MA will conduct a stringent review to determine whether an AI has any risk mitigating factors that can be recognised for capital adequacy purposes, in consultation with the AI concerned. Each case will be considered based on its own merits. To facilitate his assessment, the MA may require the AI to submit any such information or documentary evidence as is deemed necessary to justify the risk mitigating effect of any particular factor under consideration. B7.3 The MA will determine the extent to which the Pillar 2 capital requirement of an AI can be reduced due to a recognised risk mitigating factor based on his assessment of the extent to which such factor can generally mitigate the risk of the AI in all circumstances.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
Annex C: Scoring worksheets to facilitate assessment
under SRP

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 CREDIT CONCENTRATION RISK (A1) Position as at HK$m % of Score Maximum Exposures / claims considered concentrated Benchmarks (% of) DD/MM/YYYY C.B. obtained score / large if any of the benchmarks is exceeded T.L. T.A. C.B.

1. Concentration in lending activities
   1a. Credit concentration in industry / economic sectors Return item O/S Balance As % of Benchmark Risk- RW Exposure Aggregate of Concentration criteria for 1a:
   HK$m T.L. T.A. C.B. exceeded? weight HK$m RW exposure (a) Residential mortgages H5(a) & H5(b) from 1a Residential mortgages (b) Credit card advances H5(c) Credit card advances (c) Other loans to professional H5(d) & H5(e) PLUS Loans to professional & private individuals and private individuals Property development and investment (d) Property dev. and inv. B1(e) & B2(e) Aggregate of Taxi and PLB loans (e) Taxi and PLB loans G3 & G4 additional Share financing (f) Share financing H3(c) & H4(c) RW exposure Trade financing (g) Trade financing J from 1b Other economic sectors (individual) (h) Others (if concentrated) : - Return items : A1(c), 2, 3, 4, 5(c), 6, 7, 8, 9; B3; C; D; E3; F; G1, 2, 5; H1, 2(e), 6; and K 1b. Business concentration arising from lending activities T.L. as % of total assets RW Additional Concentration criteria for 1b with reference to:
   Return item Exposure As % Multiplier RW Exposure HK$m of T.L. HK$m (a) Total loans (T.L.) as percentage of total (a) Residential mortgages H5(a) & H5(b) assets; (b) Credit card advances H5(c) (b) Exposures in each sector as percentage (c) Other loans to professional H5(d) & H5(e) of T.L.; and and private individuals (c) Sum of exposures in two or more sectors (d) Property dev. and inv. B1(e) & B2(e) exceeding certain percentage of T.L. (e) Taxi and PLB loans G3 & G4 (f) Share financing H3(c) & H4(c) (g) Trade financing J (h) Others (if concentrated) :
   HK$m
   Criteria met?
   Sectoral exposures
   O/S Balance

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 CREDIT CONCENTRATION RISK (A1) Position as at HK$m % of Score Maximum Exposures / claims considered concentrated Benchmarks (% of) DD/MM/YYYY C.B. obtained score / large if any of the benchmarks is exceeded T.L. T.A. C.B.
2. Concentration in negotiable debt instruments held
2a. Credit concentration in negotiable debt instruments (NDIs) held O/S Balance As % of Benchmark Risk- RW Exposure Aggregate of Concentration criteria for 2a:
HK$m T.L. T.A. C.B. exceeded? weight HK$m RW exposure (a) Negotiable certificate of deposits (NCDs) N.A. from 2a NCDs N.A. (b) NDIs other than NCDs (Other NDIs) N.A. Other NDIs N.A. Total PLUS Additional 2b. Business concentration arising from trading or investment in NDIs RW exposure Total NDIs as % of total loans from 2b Concentration criteria for 2b:
Total RW Additional Total NDIs held N.A. N.A.
Exposure Multiplier RW Exposure
HK$m HK$m
Total NDIs held
3. Geographical concentration
(a) Large cross-border claims on countries with sovereign rating equal Aggregate Claims on individual countries N/A N/A to or above A- (S&P) / A3 (Moody's) / A- (Fitch) Largest (b) Large cross-border claims on countries with sovereign rating below Aggregate Claims on individual countries N/A N/A A- (S&P) / A3 (Moody's) / A- (Fitch) / without ratings Largest
4. Concentration of exposure to non-bank Chinese entities Aggregate Total exposure N/A N/A
5. Concentration of exposure to counterparties
(a) Non-exempt large exposures No. of large exposures Aggregate Non-exempt exposures under S.81 of BO N/A N/A Largest (b) Large bank exposures No. of large exposures Aggregate Bank exposures N/A N/A Largest (c) Aggregate of large exposures to non-bank connected parties Aggregate Exposures to non-bank connected parties N/A N/A
6. Other concentrations
Score obtained
No. of countries
Portfolio mix
NCDs Other NDIs
% %

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 INTEREST RATE RISK IN THE BANKING BOOK (A2) Score Maximum obtained score

1. Repricing risk
   Scenario : 200 basis point parallel interest rate movement for all currencies (a) Impact on AI's earnings (absolute sum of all currencies) Position End-Q1 End-Q2 End-Q3 End-Q4 Average Score Impact amount HK$'m Impact obtained Impact on earnings

• As % of average annual operating results before provision for the past 3 years (i) - Average score of
• As % of capital base at reporting date (ii) (i) and (ii)
  (b) Impact on AI's economic value (absolute sum of all currencies) Position End-Q1 End-Q2 End-Q3 End-Q4 Average Score Impact amount HK$'m Impact obtained
• As % of capital base at reporting date Impact on econ. value

2. Basis risk
   (a) Scenario : All rates except fixed and managed rates on interest-bearing assets rise by 200 basis points and last for 12 months. Position End-Q1 End-Q2 End-Q3 End-Q4 Average Score Impact amount on AI's earnings (absolute sum of all currencies) HK$'m Impact obtained

• As % of average annual operating results before provision for the past 3 years
• As % of capital base at reporting date
  Average score obtained (iii)
  (b) Scenario : Managed rates on interest-bearing assets drop by 200 basis points and last for 12 months while other rates remain unchanged. Position End-Q1 End-Q2 End-Q3 End-Q4 Average Score Impact amount on AI's earnings (absolute sum of all currencies) HK$'m Impact obtained
• As % of average annual operating results before provision for the past 3 years
• As % of capital base at reporting date Impact on earnings
• Higher score between
  Average score obtained (iv) (iii) and (iv)

3. Options risk
   Condition (a) : RML > 20% of total loans Condition (b) : Weighted average yield of RML > Yield of 1-year Exchange Fund Bills RML amount HK$'m Weighted average yield of RML Total loans HK$'m Yield of 1-yr Exchange Fund Bills % of RML Yield differential If both (a) and (b) are met, assume 30% of RMLs are repaid before maturity date Position DD/MM/YYY Impact amount on AI's earnings (i.e. RML amount x 30% x Yield differential) HK$'m Score obtained Impact on earnings

• As % of average annual operating results before provision for the past 3 years (v) - Average score of
• As % of capital base at reporting date (vi) (v) and (vi)

4. Yield curve risk (Please assess the impact of yield curve risk, if material, on the AI's earnings. Details of assessment should be shown below or separately.)
   Impact on earnings
   Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Assessment results

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 REPUTATION RISK (A5) P.1 of 2 Rating Low (L) Moderate (M) High (H) Comments Annex

1. Market / public perception Strong Acceptable Weak
   (a)
   (b)
   (c)
   (d)
2. New business development Strong Acceptable Weak
   (a)
   (b)
   (c)
   (d)
   (e)
3. Nature and volume of customer complaints Insignificant Moderate Serious
   (a)
   (b)
   (c)
   (d)
4. Litigation Insignificant Moderate Serious
   (a)
   (b)
   Are there any customer complaints that are indicative of serious supervisory concern? Are there any customer complaints that have resulted (or likely to result) in substantial compensation or an adverse impact on the AI's reputation? Is the AI's management willing and able to respond to customer complaints? Factors for assessment Is the AI's management willing and able to adjust business strategies based on market perception? Does the AI have a well developed plan for introducing or Is there a general perception that the financial position of the AI's major shareholders is adequate or strong? Is there a general perception that the management and financial position of the AI is adequate or strong? Is there a general perception that acquiring new business activities? the complexity and riskiness of the AI's business activities are commensurate with its size and operations and risk management capacity? Does the AI have a successful track record in:

• launching new business lines, products or services; or
  Is there any highly visible or conspicuous litigation?
• acquiring new subsidiaries / businesses (e.g. a mortgage or
  credit card portfolio)?
  Is the AI's management willing and able to adjust business strategies based on regulatory changes or legal barriers? Does the AI have a successful track record in formulating business strategies and making commercial decisions that bolster its financial position, business conduct and reputation (including the fairness and integrity of its business dealings)? Is the AI's management willing and able to analyse risk in new products and services, develop relevant policies and conduct due diligence? Is the volume of customer complaints acceptable based on the AI's size and complexity of business? Are there any litigation cases that have resulted (or are likely to result) in substantial financial losses or an adverse impact on the AI's reputation? The factors listed below should be used when assessing the overall level of reputation risk. The suggested questions are not necessarily all-inclusive, but should serve as a guide to be used in determining the risk rating for each factor.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 REPUTATION RISK (A5) P. 2 of 2 Rating Low (L) Moderate (M) High (H) Comments Annex
5. Negative publicity No Insignificant Serious
(a)
(b)
6. Compliance with laws and regulations Strong Acceptable Weak
(a)
(b)
(c)
(d)
7. Fiduciary or other liability insurance Highly adequate Adequate Inadequate
8.
None or not Moderate Serious
Please itemise the signals below : identified significance significance Overall rating Maximum score Maximum score Maximum score Score obtained Overall comment on reputation risk :
Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Other warning signals of high potential reputation risk (e.g. does the AI have a high level of exposures to off-balance sheet vehicles (SIVs/conduits etc.) that may put pressure on it to provide implicit support in times of stress for reputation considerations?) Are there any cases of non-compliance that are indicative of serious supervisory concern? Have significant findings about the AI's regulatory compliance, conduct and business practices been uncovered in internal and regulatory reviews? Is the AI's management willing and able to respond to these findings? Factors for assessment Is there appropriate fiduciary or other liability insurance to cover the AI's potential exposure? Are there frequent cases of non-compliance with laws and Has the AI experienced any scandal or negative publicity that has resulted in substantial financial losses or an adverse impact on its reputation? Has the AI's management properly handled such events and taken adequate remedial actions to minimise the damage to reputation caused? regulations (particularly in the conduct of asset management, investment advisory and securities dealing activities as well as the compliance with regulatory requirements to combat money laundering and terrorist financing)?

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 STRATEGIC RISK (A6) Rating Low (L) Moderate (M) High (H) Comments Annex

1. Compatibility / suitability of strategic goals & objectives Strong Acceptable Weak
   (a)
   (b)
   (c)
2. Responsiveness to changes in business environment High Medium Low
3. Adequacy of resources to carry out business strategies Highly adequate Adequate Inadequate
   (a)
   (b)
4. Implementation of business strategies Strong Acceptable Weak
   (a)
   (b)
5. Impact of strategic decisions Low Moderate High
   (a)
   (b)
   (c)
6. Other warning signals of high potential strategic risk None or not Moderate Serious
   Please itemise the signals below : identified significance significance Overall rating Maximum score Maximum score Maximum score Score obtained Overall comment on strategic risk :
   Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Does the AI have adequate resources to carry out business strategies in terms of such factors as management resources and capabilities, capital and funding, staffing and operating systems, communication channels and delivery networks? Have there been any strategic decisions, or external pressures arising from such strategic decisions, that resulted in a significant adverse impact on the AI's financial position? Have there been any strategic decisions that could not be reversed without significant cost or difficulty? Is the AI's business fairly diversified (e.g. by product, geography or customer demographics) that will help reduce the overall impact of adverse market conditions? Are the AI's business strategies and decisions indicative of its responsiveness to changes in the external environment (such as industry, economic, technological, competitive, regulatory, and other environmental changes)? Are the AI's strategic goals and decisions compatible with its corporate mission, goals, culture, values, business direction and risk tolerance? Are the AI's financial objectives consistent and commensurate with its short and long term goals? Are the AI's strategic decisions generally prudent or overly aggressive relative to its size and complexity? The factors listed below should be used when assessing the overall level of strategic risk. The suggested questions are not necessarily all-inclusive, but should serve as a guide to be used in determining the risk rating for each factor. Have the AI's major business units and operations, including

• offering new products and services;
• shifting of business focuses (including re-focuses);
• conducting strategic investments / forming joint ventures; and
  overseas branches, banking subsidiaries and associates, achieved satisfactory performance in line with their business targets? Factors for assessment Does the AI have the potential or capability to enter to new markets, businesses or products? Does the AI have a successful track record in :
• implementing merger and acquisition plans?

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 INTERNAL CONTROL SYSTEM AND ENVIRONMENT (B2) Total Firm-wide rating rating* Credit Market Interest rate Liquidity Operational Legal Reputation Strategic 1. 2. 3. (a) (b) (c) (d) (e) 4. S : Strong A : Acceptable W : Weak

• A firm-wide rating reflects an AI's ability to integrate and manage all material risks from a firm-wide perspective.
  Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Individual rating
  Annex
  Rating
  Fraud detection
  Result / progress of implementation of the recommendations from regulators, internal and external auditors on internal controls Overall rating Score obtained Quality and effectiveness of the Board and senior management oversight Maximum score Appropriateness of organisation structure and adequacy of control environment Factors for assessment External audit Internal audit Centralised compliance Centralised risk & quality control Adequacy and effectiveness of individual components within the internal control system Comments

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 INFRASTRUCTURE TO MEET BUSINESS NEEDS (B3) Total Firm-wide rating rating* Credit Market Interest rate Liquidity Operational Legal Reputation Strategic 1. 2. 3. 4. 5. 6. S : Strong A : Acceptable W : Weak

• A firm-wide rating reflects an AI's ability to integrate and manage all material risks from a firm-wide perspective.
  Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review.
  Annex
  Rating
  Result / progress of implementation of the recommendations from regulators, internal and external auditors on infrastructure Overall rating IT capability, reliability and stability Comments Individual rating Score obtained Appropriateness and adequacy of outsourcing arrangements Maximum score Factors for assessment Staff competence, sufficiency and stability Maintenance of sufficient office space to ensure adequacy of internal controls and efficient operations Adequacy and effectiveness of management oversight and controls over "back office operations / support functions" outside Hong Kong

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 CAPITAL ADEQUACY ASSESSMENT PROCESS ("CAAP") (C1)
Part I - Applicable to AIs which are required to comply with the CAAP standards
Rating Strong (S) Acceptable (A) Weak (W) Comments Annex 1. (a) Highly competent Acceptable to competent Marginally acceptable or weak (b) Proportional Marginally proportional Not in proportion (less than required) (c) Satisfactory Acceptable Less than satisfactory (d) Adequate Acceptable Inadequate (e) High Moderate Low 2. (a) Satisfactory Acceptable Less than satisfactory (b) Capable Marginally capable Incapable (c) Clear and reasonable Acceptable Unclear or with doubt (d) All the time Most of the time Sometimes 3. (a) Not necessary Minor with minimal concerns Significant with serious concerns (b) Not applicable Satisfactory Less than satisfactory Overall rating Maximum score Maximum score Maximum score Score obtained Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Identifying and measuring all material risks Adequacy and effectiveness of the overall CAAP Competence of the board and senior management in discharging their responsibilities in CAAP Proportionality of the CAAP to the risk profile and level of sophistication of the AI's operations Usefulness and effectiveness of the CAAP in the AI's risk management and decision-making processes New supervisory actions required Results of rectification of previous supervisory actions Factors for assessment Capability of relating capital to the level of risk Stating explicit capital adequacy goals / targets with respect to risk Conformity to the AI's stated capital adequacy goals / targets / objectives Supervisory actions required / taken Adequacy of controls over the integrity and functionality of the CAAP Ability of the CAAP to ensure the AI's compliance with the regulatory capital requirements Adequacy and effectiveness of individual elements in the CAAP (including stress-testing on capital adequacy)

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 CAPITAL ADEQUACY ASSESSMENT PROCESS ("CAAP") (C1)
Part II - Applicable to AIs which are not required to comply with the CAAP standards (assessment based on individual AIs' business size and complexity)
Rating Strong (S) Acceptable (A) Weak (W) Comments Annex 1. (a) Accurate and complete No significant weaknesses Unsatisfactory (b) Accurate and complete No significant weaknesses Unsatisfactory (c) Very good Generally satisfactory Poor (d) Adequate and effective No significant weaknesses Unsatisfactory 2. (a) Formal and with adequate policy and procedures Informal although generally satisfactory Unsatisfactory / not commensurate with AI's operations (b) Adequate consideration Acceptable Inadequate / no consideration (c) Clear, appropriate and well documented Informally defined although acceptable Unclear (d) Adequate and well documented Informal although acceptable Insufficient / no consideration 3. (a) Not necessary Minor with minimal concerns Significant with serious concerns (b) Not applicable Satisfactory Less than satisfactory Overall rating Maximum score Maximum score Maximum score Score obtained Note : All figures in the shaded areas are purposely not disclosed and subject to HKMA's periodic review. Factors for assessment Adequacy and effectiveness of controls over compliance with capital requirements Accuracy and completeness in categorising and reporting all components of capital base Accuracy and completeness in risk-weighting and reporting all on- and off-balance sheet items Documentation of categorisation and reporting procedures for regulatory capital measurement purposes Adequacy and effectiveness of internal monitoring systems in ensuring that actual CAR does not fall below regulatory minimum and trigger ratio Capital planning and management processes Consideration of all material risks and capital needs in capital planning and management Responsibilities in capital planning and management Contingent capital planning Supervisory actions required / taken New supervisory actions required Results of rectification of previous supervisory actions Adequacy and effectiveness of capital planning and management

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
Annex D: Supervisory requirements on application of stress
tests under CAAP
D1 General requirements
D1.1 AIs should conduct rigorous, forward-looking stress tests that can alert them to adverse unexpected outcomes related to a broad variety of risks and provide them with an indication of how much capital might be needed to absorb losses should severe stress events occur. D1.2 AIs should regularly conduct stress tests (especially firm-wide stress tests) that are appropriate for their size and nature of operations to assess their vulnerabilities to possible adverse events or changes in market conditions and the need for them to hold additional capital should such events or changes occur. Recognising that market conditions can change rapidly, AIs are normally expected to conduct stress tests on a quarterly basis. Depending on the nature of the major sources of risk identified and their possible impact on AIs’ financial conditions, some stress tests (e.g. those relating to trading activities) may need to be carried out more frequently (say, daily or weekly). D1.3 Stress-testing should form an integral part of an AI’s overall governance and risk management culture. The Board and senior management should have active involvement in setting stress-testing objectives, defining scenarios, discussing the results of stress tests, assessing potential actions and making decisions in response to concerns identified. Senior management should take an active interest in the development and operation of stress-testing. The Board and senior management should also be informed of, and should fully understand, the limitations of an AI’s stress tests. Any stress￾testing results should be reported to the Board and senior management in a timely and appropriate manner (so as to facilitate comprehension and understanding) and communicated within an AI appropriately so that the results can contribute to strategic decision-making, foster internal debate regarding assumptions (such as the cost, risk and speed with which new capital could be raised or positions could be hedged

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 or sold), and facilitate the development of risk mitigation or contingency plans across a range of stressed conditions. D1.4 Stress tests should be used to identify existing, or potential, firm-wide risk concentrations. They should also be used to provide an independent risk perspective and complement other risk management tools, such as those that are based on complex, quantitative models using historical data and estimated statistical relationships. In particular, stress-testing outcomes for a particular portfolio should provide insights about the validity of statistical models (e.g. VaR models) at high confidence intervals. D1.5 AIs should feed the results of relevant stress tests (e.g. the supervisor-driven stress tests and other relevant stress tests conducted by the AI, and supervisory top-down solvency stress tests conducted by the MA, as applicable) into their capital and liquidity planning processes, and take these results into account when evaluating the adequacy of their capital and funding sources and examining future capital resources and liquidity requirements under adverse scenarios in order to ensure that they have the ability to raise funds at reasonable cost, when necessary. D1.6 AIs’ regulatory capital requirements may vary as economic conditions fluctuate over time. Such requirements will also depend on where in the economic cycle AIs find themselves at any given time. Deterioration in business or economic conditions, in particular, may result in the need for an AI to raise capital or, alternatively, to contract its business activities, at a time when market conditions are most unfavourable to raising capital. To reduce the impact of cyclical effects, an AI should aim at maintaining an adequate capital buffer during the upturn in an economic cycle such that it has sufficient capital available to protect itself from a severe market downturn. D1.7 To assess their expected capital requirements over an economic cycle, AIs may wish to project their financial position, taking account of their business strategy and expected growth, according to a range of assumptions as to the state of the economic or business environment which they may face. For example, the CAAP of an AI may include an analysis of the

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 impact that the actions of the AI’s competitors could have on its performance, in order to see what changes in its environment the AI could sustain. Projections over a one to three year period would likely be appropriate in most circumstances. The AI may then calculate its projected capital requirements and assess whether they could be met from expected financial resources. D1.8 AIs should have regard to the general standards set out in IC￾5 “Stress-testing” for more guidance on the use of stress￾testing techniques. D2 Specific requirements D2.1 The purpose of stress tests is to identify potential risks under stressed conditions and analyse the adequacy of an AI’s capital in response to such conditions. The nature, depth and detail of the analysis will depend, in part, upon the AI’s risk profile and its vulnerabilities to adverse changes in the external environment as well as the robustness of its risk prevention, detection and mitigating measures. D2.2 In carrying out stress tests, AIs should take reasonable steps to identify an appropriate range of risks and the circumstances and events in which those risks would crystallise. Such circumstances and events should reflect severe, but plausible, scenarios. Possible correlations among risk types should be identified together with the interaction between different risk factors and the potential feedback effects. D2.3 Particular attention should be paid to developing stress scenarios to address, where applicable, the following types of risk:

• an AI which is engaged in originating securitization
  transactions should manage warehouse and pipeline risk by including exposures held for prospective securitization purposes in its regular stress tests, regardless of the probability of such exposures being securitized. This is because many of the risks associated with these exposures are likely to emerge when the AI is unable to

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 access the securitization market due to either AI-specific or more general market stress;

• an AI should carefully assess the risks with respect to
  commitments to off-balance sheet vehicles and third-party institutions related to structured credit securities and the possibility that assets will need to be taken onto the balance sheet for reputation reasons. Therefore, in its stress-testing programme, the AI should include scenarios assessing the size and soundness of such vehicles and institutions relative to its own financial, liquidity and regulatory capital positions. This analysis should cater for structural, solvency, liquidity and other risk issues, including the effects of covenants and triggers; and
• an AI should also assess the effect of reputation risk in
  terms of other risk types, namely credit, liquidity, market and other risks, to which the AI may be exposed. This could be done by including reputation risk scenarios in regular stress tests. For example, the provision of non￾contractual support (capital and/or liquidity) by an AI to the off-balance sheet vehicles sponsored by the AI due to reputation concerns may be included in the stress tests to determine the impact of such support on its credit, market and liquidity risk profile. D2.4 In applying stress tests, AIs are expected to determine an appropriate time horizon to be covered by the tests. This will depend upon:
• how quickly an AI would be able to identify events or
  changes in circumstances that might lead to a risk crystallising resulting in a loss; and
• after the AI has identified such event or circumstance, how
  quickly and effectively it could act to prevent or mitigate any loss resulting from the risk crystallising and to reduce exposure to any further adverse event or change in circumstances.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 D2.5 The time horizon over which stress tests would need to be carried out for market risk arising from the holding of investments, for example, would depend upon:

• the extent to which there is a regular, open and
  transparent market for those assets, which would allow fluctuations in the value of the investment to be more readily and quickly identified; and
• the extent to which the market for those assets is liquid
  (and would remain liquid in the changed circumstances contemplated in the stress tests), which would allow AIs, if needed, to sell their holdings so as to prevent or reduce the exposure to future price fluctuations. D2.6 In identifying stress scenarios, and assessing their impact, AIs should take into account, where material, how changes in circumstances might impact upon:
• the nature, scale and mix of their future activities; and
• the behaviour of counterparties, and of the AIs themselves,
  including the exercise of choices (e.g. options embedded in financial instruments or contracts of insurance). D2.7 In determining whether there would be adequate capital in the event of each identified stress scenario, AIs should:
• only include capital that could reasonably be relied upon
  as being available in the circumstances of the identified scenario; and
• take account of any legal or other restriction on the use of
  capital.
  D2.8 AIs should conduct stress tests which enable them to assess their exposures not only in their current position in the economic cycle, but also with respect to possible changes in the cycle which might be expected over the next few years. D2.9 AIs may consider scenarios in which expected future profits will provide capital reserves against future risks. However, it would

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 be appropriate to take into account only those profits that can be foreseen with a reasonable degree of certainty as arising before the risk against which they are being held could possibly arise. In estimating future reserves, AIs should deduct future dividend payment estimates from projections of future profits. D2.10 AIs may substitute more sophisticated modelling techniques for traditional stress tests. This approach is acceptable providing that major risks are identified and the modelling is capable of estimating the impact on their financial position where the risks crystallise, or are assumed to crystallise, with a particular probability.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
Annex E: Assessment of securitization risk and off-balance
sheet exposures under CAAP / SRP E1 Introduction E1.1 Securitization has increasingly been used by banks as an alternative source of funding and as a mechanism to transfer risk to investors. Whilst the risks associated with securitization are not new to banks, the 2007/2008 Global Financial Crisis highlighted some aspects of credit risk, concentration risk, market risk, liquidity risk, legal risk and reputation risk, which certain banks had previously failed to adequately address. For instance, a number of banks that were not contractually obligated to support sponsored securitization structures were unwilling to allow these structures to fail due to concerns about reputation risk and future access to capital markets. Their support of these structures exposed the banks to additional and unexpected credit, market and liquidity risks as they brought assets onto their balance sheets, imposing significant pressure on their financial position and capital ratios. E1.2 In the light of the wide range of risks arising from securitization activities, which can be compounded by rapid innovation in securitization techniques and instruments, the regulatory capital requirements under Pillar 1 may not be sufficient to cover all risks arising from such activities. These risks usually include:

• credit, market, liquidity and reputation risks in respect of
  each securitization exposure;
• potential delinquencies and losses associated with the
  underlying exposures of securitization transactions;
• exposures from credit enhancement or liquidity facilities
  provided to special purpose entities; and
• exposures from guarantees provided by monoline insurers
  and other third parties.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 E1.3 This annex sets out the MA’s expectation on how AIs should manage specific risks arising from any securitisation exposures they incur and assess such risks in their CAAP. The MA’s approach to reviewing AIs’ securitization transactions and addressing issues associated with such transactions under the SRP are also explained. E2 Supervisory requirements General E2.1 To help ensure that the Board and senior management understand the implications of securitization exposures for liquidity, earnings, risk concentration and capital, AIs should cover all relevant exposures and potential exposures (both contractual and non-contractual) in their risk management processes and MIS and address such exposures in their CAAP. E2.2 AIs adopting an “originate-to-distribute” business model, or using securitization to enhance credit intermediation and profitability, are expected to have risk management processes that meet the supervisory requirements under this section. Other AIs are also expected to meet the supervisory requirements, where applicable. E2.3 The MA will take into account the compliance of an AI with the relevant supervisory requirements set out in this annex when assessing the AI’s risk management processes and CAAP under the SRP. Approach to supervisory review E2.4 The MA will monitor, as appropriate, whether AIs have taken adequate account of the economic substance of securitization transactions in their determination of capital adequacy under the CAAP. In cases where the regulatory capital requirements under Pillar 1 would not sufficiently reflect the risks to which an AI is exposed in respect of its securitization exposures, the MA may consider the need to increase the AI’s capital requirements under the SRP.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 E2.5 Among other things, the MA may review where relevant:
 an AI’s own assessment of its capital needs and how that has been reflected in the capital calculation as well as the documentation of securitization transactions to determine whether the capital requirements accord with its risk profile (e.g. substitution clauses);  the manner in which an AI has addressed the issue of maturity mismatch in relation to retained securitization positions in its economic capital calculations as well as any structuring of maturity mismatches in transactions to artificially reduce capital requirements; and  an AI’s economic capital assessment of actual correlation between underlying exposures in the pool and how that has been reflected in the capital calculation. Where the MA considers that an AI’s approach is not adequate, he will determine what appropriate action should be taken, which may include denying capital relief in the case of originated assets or increasing the AI’s capital requirements against securitization exposures acquired by the AI. Risk evaluation and management E2.6 During the 2007/2008 Global Financial Crisis, weaknesses in certain banks’ risk management of securitization and off￾balance sheet exposures resulted in large unexpected losses. To help mitigate these risks, an AI’s on- and off-balance sheet securitization activities should be included in its risk management disciplines, such as product approval, risk concentration limits, and assessments of risks associated with such activities, including credit, market, operational, reputation and liquidity risks. E2.7 AIs should conduct their own analyses of the underlying risks when investing in structured products and should not solely rely on the external credit ratings assigned to such products, including securitization exposures, by the credit rating agencies. AIs should be mindful that, whilst external ratings are a useful starting point for credit analysis, they are no

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 substitute for a full and proper understanding of the underlying risks, especially where the ratings for certain asset classes have a short history or have been shown to be volatile. AIs should also be alert to, and cautious of, situations where deterioration in the quality of an investment product may not be promptly and properly reflected in the rating. As such, AIs should conduct credit analysis of a securitization exposure at the time of acquisition and on an ongoing basis, and have in place the necessary quantitative tools, valuation models and stress tests of sufficient sophistication to reliably assess all relevant risks. E2.8 To facilitate their assessment of securitization transactions, AIs should have the necessary procedures in place to capture in a timely manner updated information on such transactions, including market data, if available, and updated performance data from the securitization trustee or servicer. In addition, AIs should ensure that they fully understand the credit quality and risk characteristics of the underlying exposures in securitization and structured credit transactions generally, including any risk concentrations. They should also review the maturity of the exposures underlying securitization and structured credit transactions relative to the issued liabilities in order to assess potential maturity mismatches. E2.9 AIs should track credit risk in securitization exposures at the transaction level, within each business line and across business lines, and produce reliable measures of aggregate risk. They should also track all meaningful concentrations in securitization exposures, such as name, product or sector concentrations, and feed this information into firm-wide risk aggregation systems that track, for example, credit exposure to a particular obligor. E2.10 AIs’ own risk assessments need to be based on a comprehensive understanding of the structure of securitization transactions. In performing such assessments, AIs should identify the various types of triggers, credit events and other legal provisions that may affect the performance of their on￾and off-balance sheet exposures and integrate these triggers, credit events and provisions into their credit, liquidity and

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 balance sheet management. The impact of the events or triggers on their liquidity and capital positions should also be considered. E2.11 As market-wide disruptions may pose difficulty to the securitization of warehoused or pipeline exposures, AIs should, as part of their risk management processes, consider and, where appropriate, mark-to-market warehoused positions as well as those in the pipeline. They should also consider scenarios which may prevent them from securitizing their assets as part of their stress-testing, and identify the potential effect of such exposures on their liquidity position, earnings and capital adequacy. E2.12 AIs should develop prudent contingency plans specifying how they would respond to funding, capital and other pressures that may arise when access to securitization markets is reduced. Contingency plans should also address how AIs would address valuation challenges for potentially illiquid positions held for sale or for trading purposes. The risk measures, stress-testing results and contingency plans should be incorporated into AIs’ risk management processes and CAAP, and should result in an appropriate level of capital in excess of the minimum capital requirements under Pillar 1. E2.13 AIs that employ risk mitigating techniques to reduce their risks arising from off-balance sheet and securitization activities should fully understand the risks to be mitigated, the potential effects of risk mitigation, whether the mitigation is fully effective and the risks which may arise from the risk mitigation itself. This is to help ensure that they do not understate the true level of risk in their capital assessment (see Annex G for guidance on high cost credit protection transactions which may be relevant to securitization exposures). In particular, AIs should consider whether they would realistically be compelled to provide support to the securitization structures in stressed scenarios due to their reliance on securitization as a funding tool or for other reputational or strategic reasons.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Reputational risk and implicit support29 E2.14 Prior to the 2007/2008 Global Financial Crisis, many banks failed to recognise the reputation risk associated with their off￾balance sheet vehicles. In order to preserve their reputation, some of them felt compelled to provide liquidity support, going beyond their contractual obligations, to their structured investment vehicles (“SIVs”) or to purchase asset-backed commercial paper (“ABCP”) issued by their sponsored vehicles. By providing this implicit support, these banks signalled to the market that the risks inherent in the securitized assets were essentially still held by them and, in effect, had not been transferred. As a result of the provision of the support, the banks not only assumed additional credit, market and liquidity risks, but also put pressure on their capital ratios. E2.15 Consequently AIs should incorporate exposures that could give rise to reputation risk into their assessment of whether the requirements for recognition of risk transference under the securitization framework within Pillar 1 have been met and the potential adverse impact of providing implicit support. Their processes for approving new products and strategic initiatives should also consider the potential provision of implicit support. Further, they should incorporate the risks arising from such exposures into their risk management processes and appropriately address them in their CAAP and liquidity contingency plans. E2.16 To support the process described in subsection E2.15, AIs should have effective policies and procedures in place to identify potential sources of reputation risk in respect of any securitization and off-balance sheet exposures to which they are exposed. In identifying such potential sources, AIs should pay particular attention to the following situations:

29 Implicit support arises when an AI provides post-sale support to a securitization transaction in excess of its contractual obligations. Such non-contractual support exposes the AI to the risk of loss, such as loss arising from deterioration in the credit quality of the transaction’s underlying exposures.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• an AI’s sponsorship of securitization structures such as
  ABCP conduits and SIVs, as well as the sale by the AI of credit exposures to securitization trusts. Reputation risk may arise as described in subsection E2.14;
• an AI’s involvement in asset or fund management,
  particularly when financial instruments are issued by entities owned or sponsored by the AI, and are distributed to the customers of the AI. In the event that the instruments are not correctly priced or the main risks underlying the instruments are not clearly or adequately disclosed, the AI may face legal action from its customers or other pressure to cover losses suffered by them; and
• an AI’s sponsorship of money market mutual funds, in￾house hedge funds and real estate investment trusts. In
  these cases, the AI may decide to support the value of shares or units held by investors on reputation grounds even though it is not contractually required to provide the support. E2.17 AIs should take account of the sources of reputation risk mentioned above in conducting their stress tests in order to enable the Board and senior management to have a firm understanding of the consequences and second-round effects of reputation risk arising from securitization and off-balance sheet activities (see Annex D for details). E2.18 AIs should also remain mindful of the potential regulatory consequences of providing implicit support to investors in securitization transactions that they have originated. Under §230(1) of the Banking (Capital) Rules, if an AI is found to have provided implicit support in contravention of that subsection, the MA may, after having had regard to the materiality of the contravention, take one or more of the measures prescribed in §230(2) of the Banking (Capital) Rules (e.g. public disclosure of the contravention, increase in §97F minimum CAR, etc.).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Significance of risk transfer E2.19 If an AI wants to obtain the capital relief provided under §229(1) of the Banking (Capital) Rules in respect of a securitization transaction that the AI has originated, it should demonstrate to the satisfaction of the MA that the requirements set out in
Schedule 9 or 10 of the Rules, as the case requires, are met.
In particular, the transfer of credit risk associated with the underlying exposures in the transaction from the AI to third parties must be significant. If the MA is not satisfied that the risk transfer is significant, he will deny capital relief under §229(1). The MA may also consider the need for increasing the AI’s capital requirements to cover any additional risk not already accounted for in the capital requirements calculated under Pillar 1. E2.20 In assessing the degree of credit risk transfer associated with a securitization transaction originated by an AI, the MA is likely to have concerns in any cases where it appears that a significant amount of risk is retained or repurchased by the originating AI. The MA will expect a significant portion of credit risk to be transferred to at least one independent third party, both at the inception of the transaction and on an ongoing basis. The MA will, for this purpose, have regard to all relevant factors, including whether a significant portion of the nominal value of the pool of underlying exposures has been transferred in the process. Where AIs repurchase risk for market-making purposes, the repurchase should be confined to part of a transaction and should not, for example, extend to the repurchase of a whole tranche. Moreover, positions repurchased for market-making purposes should be resold within an appropriate period. E2.21 The MA will have concerns if an originating AI retains or repurchases significant securitization exposures in a securitization transaction, especially if this relates to unrated exposures. In this situation, it is likely that both the poorer quality unrated assets (usually the originator retains the first loss) and most of the credit risk embedded in the underlying exposures will remain with the originating AI. Market innovations

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 E2.22 As the Pillar 1 requirements for securitization exposures (re
Part 7 of the Banking (Capital) Rules) may not be adequate to
address all potential issues associated with such exposures, the MA will consider new features of securitization transactions as they arise, and determine as part of the SRP whether additional capital needs to be maintained by AIs for such transactions. The MA’s assessment will include any potential impact that the new features of securitization transactions may have on credit risk transfer. Call provisions E2.23 The MA expects an AI not to make use of clauses that entitle the AI to call a securitization transaction, or allow a credit protection to lapse, prematurely if this would increase the AI’s exposure to losses or deterioration in the credit quality of the underlying exposures. E2.24 In addition, the MA expects AIs to only execute clean-up calls 30 for economic business purposes, such as when the cost of servicing the underlying credit exposures exceeds the benefit of servicing the exposures. E2.25 AIs should also be aware that certain clean-up calls may constitute implicit support, and hence be subject to the measures set out in §230(2) of the Banking (Capital) Rules. Under §230(4) of the Banking (Capital) Rules, a clean-up call in a securitization transaction will be treated as implicit support if the exercise of the call by the originating AI has the effect of providing credit enhancement to the transaction.

30 As defined in §227(1) of the Banking (Capital) Rules, “clean-up call”, (i) in relation to a traditional securitization transaction, means an option which permits the originator in the transaction to repurchase the outstanding securitization issues of the transaction once the amount of the outstanding securitization issues, or of the underlying exposures that have not been repaid, has fallen below a level specified in the documentation for the transaction; or (ii) in relation to a synthetic securitization transaction, means an option which permits the person providing credit protection under the documentation for the transaction to extinguish the credit protection once the amount of the reference pool of underlying exposures has fallen below a level specified in the documentation.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 Early amortization31 E2.26 The MA will assess how AIs internally measure, monitor, and manage risks associated with securitizations of revolving credit facilities. In particular, the MA will place significant emphasis on internal management and controls, as well as risk monitoring activities, with respect to securitization transactions with early amortisation features, including how an AI assesses the risk and likelihood of early amortization of such transactions. E2.27 The MA expects the sophistication of an AI’s system for monitoring the likelihood and risks of an early amortization event to be commensurate with the size and complexity of the AI’s securitization activities that involve early amortization provisions. E2.28 At a minimum, AIs are expected to (i) implement reasonable methods for allocating economic capital against the economic substance of the credit risk arising from revolving securitizations; and (ii) have adequate capital and liquidity contingency plans that evaluate the probability of an early amortization occurring and address the implications of both scheduled and early amortization. In addition, the capital contingency plan should address the possibility that an AI will face higher levels of required capital under the early amortization provisions set out in the Banking (Capital) Rules (e.g. §245 and §257). E2.29 Specifically, in relation to controlled early amortization provisions (see §245(5) and §257(5) of the Banking (Capital) Rules), the MA may also review the process by which an AI determines the minimum amortization period required to pay down 90% of the outstanding balance at the point of early amortization. Where the MA does not consider the process adequate, he will determine appropriate action to be taken,

31 As defined in §227(1) of the Banking (Capital) Rules, "early amortization provision", in relation to a securitization transaction in which the underlying exposures are revolving in nature, means a mechanism which, once triggered, allows investors in the securitization issues to be paid out prior to the originally stated maturity of the issues held by them.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 such as increasing the AI’s capital requirements and/or directing the AI to take remedial measures. E2.30 Because most early amortization triggers are tied to excess spread32 levels, the factors affecting these levels should be well understood, monitored, and managed, to the extent possible, by originating AIs in securitization transactions with early amortization features. For example, the following factors affecting excess spread should generally be considered:

• interest payments made by obligors of the underlying
  exposures;
• other fees and charges to be paid by obligors of the
  underlying exposures (e.g. late payment fees, cash advance fees and over-limit fees);
• gross charge-offs;
• principal payments;
• recoveries on charged-off loans;
• interchange income;
• interest paid on investors’ certificates; and
• macroeconomic factors such as bankruptcy rates, interest
  rate movements, unemployment rates, etc.
  E2.31 AIs should consider the effects that changes in portfolio management or business strategies may have on the levels of excess spread and on the likelihood of an early amortization event. For example, marketing strategies or underwriting changes that result in lower finance charges or higher charge￾offs, might also lower excess spread levels and increase the likelihood of an early amortization event.

32 The term “excess spread” is defined in §227(1) of the Banking (Capital) Rules. It refers to future interest and other income derived by the special purpose entity in a securitization transaction from the underlying exposures in the transaction in excess of the transaction costs specified in the documentation for the transaction, expressed as a percentage of the underlying exposures.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 E2.32 AIs should use techniques such as static pool cash collections analyses and stress tests to better understand pool performance. These techniques can highlight adverse trends or potential adverse impacts. AIs should have policies in place to respond promptly to adverse or unanticipated changes. The MA will take appropriate action where he does not consider these policies adequate, such as directing an AI to obtain a dedicated liquidity line or increasing the AI’s capital requirements.
Annex F: Assessment of risk concentrations under CAAP
F1 Introduction
F1.1 Risk concentrations can arise in an AI’s assets, liabilities or off￾balance sheet items, through the execution or processing of transactions (either product or service), or through a combination of exposures across these broad categories. Unmanaged risk concentrations are an important cause of major banking problems. AIs should have comprehensive policies and procedures in place to identify and assess risk concentrations, and incorporate an appropriate level of capital for risk concentrations in their CAAP. F1.2 An AI’s assessment of risk concentrations under its CAAP should not be a mechanical process. The AI should determine how to conduct this assessment, having regard to its business model and its own specific vulnerabilities. F1.3 AIs are expected to comply with the supervisory requirements set out in section F2 when assessing and managing their risk concentrations. As part of the SRP, the MA reviews AIs’ compliance with the supervisory requirements and evaluates the appropriateness of the level of capital they have set aside for risk concentrations. F2 Supervisory requirements F2.1 AIs should consider not only the obvious “traditional concentrations”, but also concentrations based on common or correlated risk factors that reflect more subtle or more situation-

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 specific factors than traditional concentrations, such as correlations between credit, market and liquidity risks. The typical situations in which risk concentrations can arise include:

• exposures to a single counterparty, borrower or group of
  connected counterparties or borrowers;
• exposures to industry or economic sectors, including
  exposures to both regulated and non-regulated financial institutions such as hedge funds and private equity firms;
• exposures to geographical regions;
• exposures arising from credit risk mitigation techniques,
  including exposure to similar collateral types or to credit protection providers whose creditworthiness is closely related to the performance of assets or exposures for which credit protection is purchased due to “wrong-way risk”;
• trading or market risk exposures;
• exposures to counterparties (e.g. hedge funds and hedge
  counterparties) through the execution or processing of transactions (either product or service);
• undue reliance on particular funding sources;
• holding of assets in the banking book or trading book, such
  as loans, derivatives and structured products; and
• off-balance sheet exposures, including guarantees,
  liquidity facilities and other commitments.
  F2.2 AIs should have effective internal polices, systems and controls in place to identify, measure, monitor, control and mitigate their risk concentrations in a timely manner. In identifying and assessing risk concentrations, not only should normal market conditions be considered, but also the potential build-up of concentrations under stressed market conditions, economic downturns and periods of general market illiquidity. Where applicable, AIs should assess scenarios that consider possible

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 concentrations arising from contractual and non-contractual contingent claims. AIs with significant involvement in originating exposures for securitization or other structured credit product related purposes should assess scenarios that combine the potential build-up of pipeline exposures together with the loss of market liquidity and a significant decline in asset values. F2.3 AIs should be able to identify and aggregate similar risk exposures across the organisation, including across business lines 33 , asset types (e.g. loans, derivatives and structured products), risk areas (e.g. the trading book) and geographical regions through their risk management processes and MIS. The Board and senior management of AIs should analyse and understand the firm-wide risk concentrations identified. In the case of a local banking group which adopts a CAAP covering the positions of their subsidiary AIs, risk concentrations should be analysed on both solo and consolidated bases, as an unmanaged concentration at a subsidiary AI may appear immaterial at the consolidated level, but could threaten the viability of the subsidiary operation. F2.4 Whilst risk concentrations often arise due to direct exposures to borrowers and obligors, an AI may also incur a concentration on a particular asset type indirectly through investments backed by such assets (e.g. collateralised debt obligations) as well as exposure to protection providers which guarantee the performance of the specific asset type (e.g. monoline insurers). AIs should have adequate, systematic procedures in place for identifying high correlations between the creditworthiness of a protection provider and the obligors of the underlying exposures due to their performance being dependent on common factors beyond general systemic risk (i.e. “wrong-way risk”).

33 An example from the 2007/2008 Global Financial Crisis would be subprime exposure in lending portfolios, counterparty exposures, conduit exposures and structured investment vehicles, contractual and non-contractual exposures, trading activities, and underwriting pipelines.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 F2.5 AIs should employ a number of techniques, as appropriate, to measure risk concentrations. These techniques include sensitivity analysis by applying shocks to various risk factors, use of business level and firm-wide scenarios, and use of integrated stress-testing and economic capital models. Identified concentrations should be measured in a number of ways, including for example consideration of gross versus net exposures, use of notional amounts, and analysis of exposures with and without counterparty hedges. F2.6 When conducting regular stress tests, AIs should incorporate all major risk concentrations and identify and respond to potential changes in market conditions that could adversely impact their performance and capital adequacy. F2.7 AIs should establish internal position limits for concentrations to which they may be exposed. Similar exposures should be aggregated across business platforms (including the banking and trading books) to determine whether there is a concentration or a breach of an internal position limit. Procedures should also be in place to identify any limit breaches and promptly report such breaches to senior management, as well as to ensure that appropriate follow-up actions are taken. F2.8 AIs should have credit risk mitigation strategies in place that have senior management approval. This may include altering business strategies, reducing limits or increasing capital buffers in line with the desired risk profile. Whilst implementing risk mitigation strategies, AIs should be aware of possible concentrations that might arise as a result of employing risk mitigation techniques. F2.9 AIs should have an appropriate infrastructure and MIS that allow for the aggregation of exposures and risk measures across business lines and support customised identification of concentrations and emerging risks. Procedures should also be in place to communicate risk concentrations to the Board and senior management in a manner that clearly indicates where in the organisation each segment of a risk concentration resides.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
Annex G : Assessment of high cost credit protection
transactions under SRP
G1 Introduction
G1.1 Credit risk mitigation techniques are recognised in the calculation of credit risk under the capital adequacy framework. However, potential for regulatory capital arbitrage has been identified through the use of high cost credit protection transactions. This annex:

• highlights the issues associated with such transactions;
• sets out the factors that AIs should take into account in
  analysing any such transactions that they may use for the purpose of credit risk mitigation or transfer of credit risk; and
• describes the MA’s approach to scrutiny of any such
  transactions entered into by an AI in his assessment of the AI’s capital adequacy under the SRP. G2 High cost credit protection transactions G.2.1 High cost credit protection transactions typically involve (i) a delay in recognising losses and the costs of protection in earnings by an AI which has purchased the credit protection; and (ii) an immediate regulatory capital benefit being received by that AI in the form of a lower risk weight on an exposure on which it is nominally transferring risk. G2.2 In some of these transactions, the premiums or fees and other direct or indirect costs paid for credit protection, combined with other terms and conditions, call into question the degree of credit risk mitigation or credit risk transfer of the transaction. Rather than contributing to a prudent risk management strategy, the primary effect of such transactions may be to embed a high percentage of expected losses into the premiums and fees paid, under the premise that the transaction would receive favourable risk-based capital treatment in the short

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 term and defer recognition of losses over an extended period, without meaningful risk mitigation or transfer of risk. G2.3 As an example, assume that an AI purchases credit protection on a first loss retained securitization position where the cost of protection is equal to the recorded value of the securitization tranche on which protection is being purchased or where the terms and conditions of the contract ensure that the premiums paid throughout the life of the contract will equal the amount of the realised losses. Regulatory capital arbitrage may exist where the immediate capital relief recognised for the purchased credit protection ultimately will be offset by the premiums paid and recognised in earnings over the life of the contract. G2.4 Whilst the above example focuses on the use of credit risk mitigation in a securitization transaction, arbitrage opportunities exist more generally under the credit risk mitigation framework. However, arbitrage opportunities are more likely to occur when credit risk mitigation techniques are used for securitization transactions where the difference in the risk weight before and after purchasing protection can be significant. G3 Supervisory requirements General G3.1 AIs should consider the relevant costs of any credit protection they purchase, whether in the context of the securitization framework or within the credit risk mitigation framework, when assessing their capital adequacy. G3.2 In the case of credit protection transactions that have unusually high cost or innovative features, AIs should further analyse and document the economic substance of such transactions to assess the degree of risk transference and the associated impact on their overall capital adequacy. The analysis should also specify how such transactions align with their overall risk management strategy.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 G3.3 AIs should bring to the attention of the MA any high cost or innovative transactions that fall within subsection G2.2 to ensure they are subject to appropriate prudential treatment. Specific factors to be considered G3.4 In evaluating the degree of credit risk mitigation or credit risk transfer of a transaction, an AI should consider, among other things:

• a comparison of the present value of premiums and other
  costs not yet recognised in capital relative to the expected losses in respect of the protected exposures over a variety of stress scenarios;
• the pricing of the transaction relative to market prices,
  including appropriate consideration of non-cash premium payments;
• the timing of payments under the transaction by the
  protection buyer, including potential timing differences between the AI’s provisioning for, or write-downs of, the protected exposures and payments by the protection seller;
• a review of applicable call dates to assess the likely
  duration of the credit protection relative to the potential timing of future credit losses;
• an analysis of whether certain circumstances could lead to
  the AI’s increased reliance on the counterparty at the same time that the counterparty’s ability to meet its obligations is weakened; and
• an analysis of whether the AI can prudently afford the
  premiums given its earnings, capital, and overall financial condition. Supervisory assessment G3.5 An AI’s analysis of its credit protection transactions will be assessed by the MA under the SRP. In particular, the MA may review any internal memos or records outlining the rationale for

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 a credit protection transaction and the AI’s analysis of the anticipated costs and benefits of the transaction. G3.6 The MA will pay particular attention to credit protection transactions that exhibit the characteristics stated below.

• Protection premiums are high relative to the amount of the
  exposures being protected – for example, when the cost of protection over the life of the protection contract equals, or exceeds, the amount of the exposures for which protection is being purchased. Rebate mechanisms (i.e. where the protection seller agrees to refund parts of the premium to the protection buyer according to the performance / deterioration of the protected exposure) will, prima facie, be regarded as an indication of excessive premium and, consequently, regulatory arbitrage.
• Transactions where the exposure being protected has not
  been fair valued and losses on the exposure have not been recognised in earnings – this situation can increase the potential for a transaction to involve regulatory capital arbitrage in the form of deferral of loss recognition.
• Transactions where the potential for reduction in risk
  weight or regulatory capital as a result of the transaction is greatest – this is most likely in transactions where the exposures for which protection is purchased would otherwise be assigned a high risk weight, for example, exceeding 150%. Nevertheless, the potential for arbitrage still exists for relatively lower risk-weighted reference exposures, and the MA will also focus on individual transactions that raise concerns due to unique deal features.
• Protection premiums are not proportional to the exposures
  being protected – this can occur, for example, when (i) premiums are guaranteed over time without respect to write-downs or default of the reference exposure (i.e. the premium payments are not a proportion of the amount of positions of the protected portfolio that are still performing);

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 or (ii) upfront premiums or premiums payable at termination have not been recognised in retained earnings.

• Structural features of the transaction that can increase the
  total cost of credit risk mitigation – these features can include (i) high transaction costs for the protection buyer; (ii) obligations of the protection buyer to the counterparty to post additional collateral; (iii) additional payments at maturity required of the protection buyer; and (iv) early termination of the transaction at the option of the protection buyer. Other features that should lead to increased scrutiny include pre-agreed mechanisms, for example “at￾market unwinds”, where the protection seller and protection buyer agree that the transaction can be terminated in the future at an agreed upon “market” value where calculation of the “market” value is pre-specified. G3.7 The MA will also review the appropriateness of an AI’s approach to the recognition of credit protection for first loss credit enhancements in respect of securitization transactions (see the example in subsection G2.3). In such cases it is likely that expected loss on the first loss positions will still be retained by the AI even if it has bought credit protection given that the pricing for such protection will reflect the higher risk involved. Therefore the MA will expect an AI’s policies to take account of this in determining its economic capital.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016
Annex H : Assessment of counterparty credit risk under CAAP
/ SRP
H1 Introduction
H1.1 Whilst counterparty credit risk (“CCR”) is a type of credit risk, it differs from traditional credit risk in that an economic loss would only occur to an AI if a transaction, or a portfolio of transactions, with a counterparty has a positive economic value to the AI at the time of default of that counterparty. Hence, unlike an AI’s exposure to credit risk through a loan, where the exposure to credit risk is unilateral and only the lending AI faces the risk of loss, CCR creates a bilateral risk of loss, i.e. the market value of the transaction can be positive or negative to either counterparty to the transaction. The market value is uncertain and can vary over time with the movement of underlying market factors. H1.2 Under the Banking (Capital) Rules, AIs are required to maintain regulatory capital for two major aspects of CCR, viz. counterparty default risk (i.e. the risk of the default of the AI’s counterparties) and CVA risk (i.e. the risk of mark-to-market losses in a transaction with a counterparty arising from credit value adjustments34). Subject to the MA’s approval, AIs may adopt a modelling approach (i.e. the IMM(CCR) approach) to the calculation of counterparty default risk. H1.3 In assessing an AI’s CCR under the SRP, the MA will focus substantially on the adequacy and effectiveness of the AI’s CCR management systems, especially in respect of the key elements mentioned in subsections H2.1 to H2.9 of this annex. The MA’s approach to assessing AIs’ use of the IMM(CCR) approach, and dealing with any issues identified, is also highlighted in this annex.

34 Credit valuation adjustments, in relation to the calculation by an AI of its CCR in respect of a counterparty, refer to those adjustments made by the AI to the valuation of a netting set (as defined in §2(1) of the Banking (Capital) Rules) with the counterparty to reflect the market value of the credit risk of that counterparty.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 H1.4 Another area of assessment under the SRP relates to an AI’s exposure to central counterparties, which may be a potential source of CCR for the AI’s centrally cleared trade exposures. This annex provides guidance on AIs’ assessment of such exposures under their CAAP, as well as the MA’s approach towards such exposures under the SRP. H2 Supervisory requirements CCR systems and controls H2.1 An AI should have CCR management policies, processes and systems that are conceptually sound and implemented with integrity and that are proportionate to the sophistication and complexity of the AI’s holdings of exposures that give rise to CCR. A sound CCR management framework should include the identification, measurement, management, approval and internal reporting of CCR, with designated units for independent risk control and collateral management. See CR￾G-13 “Counterparty Credit Risk Management” for more details. H2.2 An AI’s risk management policies should take account of the market, liquidity, legal, operational and other risks that can be associated with CCR and, to the extent practicable, inter￾relationships among those risks. The AI should not undertake business with a counterparty without assessing its creditworthiness and should take due account of both settlement and pre-settlement credit risk. These risks should be managed as comprehensively as practicable at the counterparty level (aggregating counterparty exposures with other credit exposures) and at the firm-wide level. H2.3 The Board and senior management of an AI should be actively involved in the CCR control process and should regard this as an essential aspect of the business to which significant resources need to be devoted. H2.4 An AI should prepare daily reports on its exposures to CCR, which should be reviewed by a level of management with sufficient seniority and authority to enforce both reduction of

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 positions taken by individual credit managers or traders and reduction in the AI’s overall CCR exposure. H2.5 An AI’s CCR management system should be used in conjunction with the AI’s internal credit and trading limits which should be related to its risk measurement model in a manner that is consistent over time and that is well understood by credit managers, traders and senior management. H2.6 The measurement of CCR should include monitoring daily and intraday usage of credit lines. An AI should measure current exposure (gross and net of collateral held) where such measures are appropriate and meaningful (e.g. for OTC derivatives, margin lending, etc.). The AI should take account of large or concentrated positions, including concentrations by groups of related counterparties, by industry, by market, customer investment strategies, etc. H2.7 An AI should have a routine and rigorous programme of stress￾testing in place as a supplement to the CCR analysis based on the day-to-day output of its risk measurement model. The results of stress-testing should be reviewed periodically by the Board and senior management and be reflected in the CCR policies and limits set by senior management and the Board. Where stress tests reveal particular vulnerability to a given set of circumstances, management should explicitly consider appropriate risk management strategies (e.g. by hedging against that outcome, or reducing the size of the AI’s exposures). H2.8 An AI’s internal policies, controls and procedures concerning the operation of the CCR management system should be well documented, for example, through a risk management manual that describes the basic principles of the risk management system and that provides an explanation of the empirical techniques used to measure CCR. These policies and procedures should be subject to periodical review to ensure they remain adequate and appropriate. H2.9 An AI should conduct an independent review of the CCR management system (including any internal models used for CCR management and/or capital calculation purposes)

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 regularly through its internal auditing process (ideally not less than once a year). This review should include both the activities of the credit and trading units and of the independent CCR control unit 35 , and should specifically address, at a minimum, the following aspects:

• the adequacy of the documentation of the CCR
  management system and process;
• the organisation and effectiveness of the independent
  CCR control unit and collateral management unit 36 mentioned in subsection H2.1;
• the integration of CCR measures into daily risk
  management;
• the approval process for risk pricing models and valuation
  systems used by front and back-office personnel;
• the validation of any significant change in the CCR
  measurement process;
• the scope of CCR captured by the risk measurement
  model;
• the integrity of the MIS produced for risk monitoring and
  reporting purposes;
• the accuracy and completeness of CCR data;
• the accurate reflection of legal terms in collateral and
  netting agreements into exposure measurements;

35 The maintenance of this control function for CCR management purposes is generally required under CR-G-13 “Counterparty Credit Risk Management” (see paras. 4.6.7 to 4.6.9 of the module for a detailed description of this function and its responsibilities). 36 This unit performs the function of collateral management and margining related operations.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016

• the verification of the consistency, timeliness and reliability
  of data sources used to run internal models, including the independence of such data sources;
• the accuracy and appropriateness of volatility and
  correlation assumptions;
• the accuracy of valuation and risk transformation
  calculations; and
• the verification of the model’s accuracy through frequent
  back-testing.
  In the case of AIs which adopt the IMM(CCR) approach, the review should also cover relevant requirements set out in
  Schedule 2A of the Banking (Capital) Rules.
  Use of (IMM)CCR approach
  H2.10 An AI that uses an internal model to estimate its exposure amount or EAD for CCR exposures should monitor the appropriate risks and have processes to adjust its estimation of expected positive exposure (“EPE”) 37 , when those risks become significant. This includes the following:
• the AI should identify and manage its exposures to specific
  wrong-way risk;
• for exposures with a rising risk profile after one year, the AI
  should compare on a regular basis the estimate of EPE over one year with the EPE over the life of the exposure; and
• for exposures with a short-term maturity (below one year),
  the AI should compare on a regular basis the replacement cost (current exposure) and the realised exposure profile, and/or store data that allow such comparisons.

37 EPE refers to the weighted average over time of expected exposures where the weights are the proportion that an individual expected exposure represents of the entire time interval.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 H2.11 Senior management of an AI should be aware of the limitations and assumptions of the internal model used for CCR and the impact these can have on the reliability of the model output. They should also consider the uncertainties of the market environment (e.g. the timing of realisation of collateral) and operational issues (e.g. pricing feed irregularities) and how these are reflected in the model. H2.12 In assessing an internal model used to estimate EPE, the MA will review the characteristics of the AI’s portfolio of exposures that give rise to CCR, in particular:

• the diversification of the portfolio (number of risk factors to
  which the portfolio is exposed);
• the correlation of default across counterparties; and
• the number and granularity of counterparty exposures.
  H2.13 The MA expects an AI to have a robust limit monitoring system that includes the measurement and monitoring of peak exposure or potential future exposure at a confidence level chosen by the AI at both the portfolio and counterparty levels. H2.14 The MA will assess whether an AI using the IMM(CCR) approach continues to comply with Schedule 2A to the Banking (Capital) Rules, which specifies the minimum requirements to be satisfied for approval under §10B(2)(a) of the Rules to use the IMM(CCR) approach (see also subsection B1.3 of Annex B). H2.15 The MA will determine the appropriate action to be taken where an AI’s estimates of exposure or EAD under the IMM(CCR) approach do not adequately reflect the AI’s exposure to CCR. Such action might include directing the AI to revise its estimates, directing it to apply a higher estimate of exposure or EAD under the IMM(CCR) approach, or disallowing it from recognising internal estimates of EAD for regulatory capital purposes. Exposures to central counterparties

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 H2.16 A central counterparty (“CCP”) is a clearing house that interposes itself between counterparties to contracts traded in one or more financial markets, becoming the buyer to every seller and the seller to every buyer and thereby ensuring the future performance of open contracts. H2.17 Given the significance of CCPs to financial markets, it is important for individual CCPs to have robust risk management systems and be subject to adequate regulations 38 in jurisdictions in which they are based and prudentially supervised. Under the Banking (Capital) Rules, the capital treatment for an AI’s exposures to a CCP differs depending on whether that CCP is a qualifying CCP (“QCCP”). Generally, a QCCP is an entity that is licensed to operate as a CCP, is permitted by the appropriate regulator / overseer to operate as such with respect to the products offered, and satisfies certain other qualifying conditions (see the definition of QCCP set out in §226V(1) of the Rules for more details). H2.18 Where an AI has exposures to a CCP, regardless of whether that CCP is classified as a QCCP, the AI should ensure that it maintains adequate capital for such exposures. In conducting its internal capital assessment, the AI should consider whether additional capital (i.e. in excess of minimum regulatory capital calculated under Pillar 1) needs to be held if, for example, (i) its dealings with the CCP give rise to more risky exposures; or (ii) where, in the context of its dealings with the CCP, it is unclear that the CCP meets the definition of a QCCP. H2.19 Where an AI is acting as a clearing member39, the AI should assess through appropriate scenario analysis and stress-testing whether the level of capital held against exposures to a CCP adequately addresses the inherent risks of those transactions. This assessment will include potential future or contingent

38 These regulations should be consistent with the CPSS-IOSCO Principles for Financial Market Infrastructures. 39 As defined in §2(1) of the Banking (Capital) Rules, “clearing member”, in relation to a CCP, means (i) a member of, or a direct participant in, the CCP that is entitled to enter into a transaction with the CCP; or (ii) another CCP to which the CCP has a link.

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 exposures resulting from future drawings on default fund commitments, and/or from secondary commitments to take over or replace offsetting transactions from clients of another clearing member in the case of this clearing member defaulting or becoming insolvent. H2.20 An AI should monitor and report to the Board (or a designated committee) and senior management on a regular basis all of its exposures to CCPs, including exposures arising from trading through a CCP and exposures arising from CCP membership obligations such as default fund contributions40. H2.21 Under the SRP, the MA may require AIs to hold additional capital against their exposures to a QCCP, for example, where an external assessment41 has found material shortcomings in the CCP or the regulation of CCPs in the jurisdiction concerned, and the CCP and/or the CCP regulator have not since publicly addressed the issues identified. H2.22 Under the Banking (Capital) Rules, AIs must allocate a risk￾weight of 1,250% to the default fund contributions to a non￾qualifying CCP, and for that purpose, an AI’s default fund contributions must include the funded and unfunded contributions that the AI is liable to pay if the non-qualifying CCP requires the AI to do so. If the default fund contributions of an AI to a non-qualifying CCP consist of a binding commitment in respect of an unfunded default fund contribution to the CCP and the amount of the commitment is unlimited, the AI should (i) inform the MA of this situation; and (ii) determine the amount of commitment to which a 1,250% risk-weight is to apply based on its own estimation unless the MA, by notice in writing given to the AI, requires the AI to take the action specified in subsection H2.23.

40As defined in §2(1) of the Banking (Capital) Rules, “default fund contribution”, in relation to a clearing member of a CCP, means (i) the funded or unfunded contribution made by the clearing member to the CCP’s mutualised loss-sharing arrangements; or (ii) the clearing member’s underwriting of the CCP’s mutualised loss-sharing arrangements. 41 An example of external assessment is an assessment conducted by the International Monetary Fund under its Financial Sector Assessment Programme (i.e. FSAP).

Supervisory Policy Manual
CA-G-5 Supervisory Review Process V.4 – 08.04.2016 H.2.23 Under the SRP, the MA will review the basis and methodology adopted by the AI to determine the amount of unfunded commitments to which a 1,250% risk-weight should apply under Pillar 1. If the MA considers that the amount used by the AI cannot fairly reflect the risk exposure of the AI’s commitment, the MA may, by notice in writing, require the AI to use another amount or to use the method specified by the MA to estimate the amount of the commitment to which a 1,250% risk-weight should apply.