HKMA Supervisory Policy Manual

Why does it matter?

Technology risk is judged as part of whether an AI still meets the minimum criteria for authorization. The SPM Introduction says that failing to follow any guideline, statutory or non-statutory, may call that into question (section 3.3), so AIs treat these modules as supervisory expectations even though statutory guidelines do not themselves have the force of law.

Key benefits include:

• Board and senior management are accountable

The Board is ultimately responsible for understanding the risks an AI runs, and senior management is accountable for designing and implementing the risk management system the Board approves (TM-G-1, section 1.3.3).

• Controls fit the institution

The framework must be commensurate with the AI's types of business, the technologies it adopts and its overall risk management systems (TM-G-1, section 1.3.4).

• Technology audit is planned

AIs are expected to assess their technology risk management process and IT controls periodically, and an annual technology audit plan should be developed (TM-G-1, section 2.4.1).

• E-banking has specific tests

Where independent assessments do not include penetration tests, TM-E-1 expects them for Internet banking annually (section 3.3.2), and a formal e-banking risk assessment at least annually (section 3.3.3).

• Incidents are drilled and reported

AIs should regularly practice incident response and notify the HKMA promptly of a significant incident (TM-E-1, sections 8.2.4 and 8.2.5; TM-C-1, section 2.4).

How does it work?

TM-G-1 has seven sections: introduction, IT governance, security management, system development and change management, information processing, communications networks, and management of technology service providers. IT governance covers IT control policies, oversight and organization of IT functions, a technology risk management function, technology audits, and staff competence and training (section 2). The module supplements IC-1, the HKMA's general risk management module (section 1.3.1).

The technology risk management process runs through four activities: identify emerging or existing technology-related risks, measure their impact, likelihood and direction, monitor them, and control them through preventive, compensating and contingency measures (section 1.3.4). The technology risk management function manages that process across business units and IT functions (section 2.3).

The other modules layer on top. TM-E-1 has nine sections on e-banking, from risk governance and customer security to fraud and incident management and system availability. TM-C-1 sets the HKMA's supervisory approach to cyber risk, including regular assessments under its Cyber Resilience Assessment Framework. TM-G-2 covers board oversight, business impact analysis, recovery strategy, business continuity plans, alternate sites, and testing and rehearsal.

Key Elements

• IT governance (TM-G-1, section 2)

IT control policies, oversight and organization of IT functions, a technology risk management function, technology audits and staff competence. Overseas offices that provide IT support to the Hong Kong operation are covered too (section 2.6).

• Security management (TM-G-1, section 3)

Information classification and protection, authentication and access control, security administration and monitoring, system security, end-user and mobile computing, and physical and personnel security.

• Change and operations (TM-G-1, sections 4 and 5)

Project management and life cycle, change management, IT operations management and support, performance monitoring and capacity planning, equipment maintenance and disaster recovery planning.

• Networks and service providers (TM-G-1, sections 6 and 7)

Network management, network security and certification, wireless local area networks, and the management of technology outsourcing, for which TM-G-1 points to SA-2, and of other technology service providers.

• E-banking (TM-E-1, V.4, 25 October 2024)

A statutory guideline that replaced V.3 (2019), V.2 (2015) and a 2016 circular on Internet banking security. It expects two-factor authentication at least once per login session before high-risk transactions on Internet banking (section 4.1.4).

• Cyber risk and continuity (TM-C-1, TM-G-2)

TM-C-1 requires regular C-RAF assessments and promotes secure tertiary data backup (sections 3.5 and 4.3). TM-G-2 expects a business continuity policy, impact analysis, recovery strategy and tested plans.

What does it cover?

The modules apply to all authorized institutions. TM-G-1 defines technology broadly as the automated means of originating, processing, storing and communicating information, covering hardware, software, data, communications networks and other electronic devices (section 1.1.1). For an overseas-incorporated AI, Board oversight of technology risk management for the Hong Kong operation rests with local senior management (TM-G-1, section 1.3.3, footnote 2).

What are its objectives?

TM-G-1 gives its purpose as general principles that AIs are expected to consider in managing technology-related risks.

Align the IT mission with the institution's strategy and ensure IT resources are used effectively (section 1.1.1).

Identify, measure, monitor and control technology-related risks.

Maintain adequate systems of control, as the Seventh Schedule requires (section 1.2.2).

Secure information through classification, authentication, access control and monitoring (section 3).

Keep services running through disaster recovery planning and management of technology service providers (sections 5.4 and 7).

Assess the framework independently through technology audits (section 2.4).

Framework in Context

The technology modules sit in the Supervisory Policy Manual beside IC-1 on risk management, SA-2 on outsourcing and OR-2 on operational resilience, a non-statutory module issued on 31 May 2022 together with the revised TM-G-2. TM-C-1 replaced the HKMA circular on cybersecurity risk management of 15 September 2015. The HKMA repository lists no revision of TM-G-1 since V.1 of 24 June 2003, so the newer modules carry the current detail on e-banking, cyber risk and continuity.

Common Framework Mappings

The frameworks below are ones institutions commonly relate to the HKMA technology risk modules when they reuse control evidence, and they are not part of the Manual. TM-G-1 itself says AIs may draw on other technology risk resources, such as ISACA and the Information Security Forum (section 1.3.3, footnote 3).

Mapped frameworks include:

CIS Controls v8.1

EU DORA

ISO 27001:2022

ISO 27002:2022

MITRE ATT&CK

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2