Operational Resilience: Sustaining and Uplifting (2026-06-01)

Circulars Email: HKMA E-mail Alert of 02 June 2026 (05:00 p.m. HKT)

Back to Summaries PDF Original Document
Document Information

Title: Operational Resilience: Sustaining and Uplifting (2026-06-01)

Type: Circulars

URL: https://brdr.hkma.gov.hk/eng/doc-ldg/current/20260529-5-EN

Email Received: 2026-06-02 19:12

Summary Created: 2026-06-02 14:00

English Summary
Quick section switch
Management Summary
  • Purpose / Background: Following the successful conclusion of the HKMA’s "1+3 year" journey (under SPM OR-2), which saw all AIs establish operational resilience frameworks by May 31, 2026, the HKMA is shifting its focus to sustaining and uplifting these capabilities as "business as usual" (BAU).
  • One-line conclusion: AIs must transition operational resilience from a project-based initiative to an embedded, BAU process that proactively evolves with the changing risk landscape.
  • Key Changes:
  • Transitioning governance from project-based structures to permanent, staff-empowered operational ownership.
  • Requirement to regularly review and potentially compress "tolerances for disruption" to demonstrate maturity.
  • Shift toward higher granularity in mapping and increased severity in scenario testing.
  • Integration of automation (e.g., auto-refreshing third-party dependency maps) to improve agility.
  • Explicit focus on emerging risks, specifically AI-empowered cyber threats and third-party risk management.
  • Key Dates / Deadlines: Immediate (as of June 1, 2026, the post-OR-2 implementation phase is active).
  • Applicability / Impact scope: All Authorized Institutions (AIs) in Hong Kong.
  • Recommended management actions:
  • Perform a gap analysis between current project-based resilience teams and permanent BAU operating models.
  • Review and validate critical operations and disruption tolerances to ensure they reflect current business profiles.
  • Formalize training programs to empower all staff to take ownership of operational resilience duties.
  • Update risk management and incident response frameworks to specifically account for AI-driven cyber threats.
  • Enhance technical infrastructure to automate mapping processes for new services and third-party providers.
Detailed Summary
  1. Document overview: This circular marks the end of the initial implementation period for SPM module OR-2. It serves as a regulatory directive for AIs to maintain and mature their existing operational resilience frameworks.
  1. Main requirements:
  • Governance: "Tone from the top" remains mandatory; boards must ensure that operational resilience is not siloed in project teams but embedded in daily business functions.
  • Parameter Reviews: Consistent with OR-2, the Board must review the criteria for critical operations, the actual list of operations, and disruption tolerances at least annually or upon major changes.
  • Proactive Management: AIs are required to maintain a risk-based framework for prioritizing remediation, especially concerning evolving threats like AI-enabled cyber risks.
  1. Key changes:
  • From Project to BAU: Shifting from "1+3 year" project management structures to integrated BAU ownership.
  • Maturity Goal: Moving beyond compliance to active "compression" of disruption tolerances where possible.
  • Tech-Enabled Resilience: Expectation to move toward automated mapping tools that update in real-time as service ecosystems change.
  • Increased Rigor: Testing scenarios should evolve to be increasingly severe compared to initial benchmarks.
  1. Important dates & transition:
  • June 1, 2026: Post-OR-2 monitoring begins. AIs are now in the "sustaining and uplifting" phase.
  1. Impact and risks:
  • Operational: Increased burden to integrate resilience into staff KPIs and training.
  • IT/Data: Requirement to increase mapping granularity and automate dependency tracking.
  • Compliance: Heightened scrutiny on third-party management and the ability to mitigate AI-powered cyber risks.
  1. Compliance action checklist:
  • [ ] Appoint permanent departmental owners for resilience tasks previously held by project teams.
  • [ ] Update staff training curriculum to reflect BAU resilience responsibilities.
  • [ ] Re-calibrate scenario testing to include "increasingly severe" disruption events.
  • [ ] Review current ICT and cyber security frameworks to address AI-specific threat vectors.
  • [ ] Conduct annual board review of critical operation parameters as per OR-2.
  1. Appendices/attachments summary:
  • (N/A) The document contains no separate attachments; references are made to previously issued good practice circulars (Jan 2025/April 2026) and Whole Industry Simulation Exercise reports (2023/2025), which serve as foundational guidance for ongoing maturity.
中文摘要
快速切換摘要區塊
管理層摘要
  • 目的/背景： 總結自 2022 年 5 月起為期 4 年的「1+3 年」營運韌性建設計畫（SPM OR-2 模組）。金管局確認所有認可機構（AIs）已於 2026 年 5 月底前建立並落實營運韌性框架。
  • 一句話結論： 金管局要求機構將營運韌性轉型為「恆常業務」（Business as Usual），並透過持續檢視與優化，應對不斷變化的經營環境。
  • 關鍵變更：
  1. 從「專案導向（Project-based）」轉為「常規化營運（Business-as-usual）」。
  2. 加強董事會與高層的領導作用，將韌性思維嵌入所有流程。
  3. 提升營運韌性參數（如關鍵業務、容忍度）的檢視頻率與精確度。
  4. 進化映射（Mapping）與場景測試（Scenario Testing）的深度與技術自動化程度。
  5. 強化針對新興風險（如 AI 賦能的網路攻擊、第三方服務風險）的優先修復能力。
  • 重要日期 / 截止日： 即日起進入常態化監管階段，需持續履行 SPM OR-2 之年度檢視要求。
  • 適用對象 / 影響範圍： 全體認可機構（AIs）。
  • 管理層建議行動：
  1. 解散臨時項目小組，將韌性職責移交至常規營運團隊。
  2. 針對所有員工開展培訓，建立全員參與的韌性文化。
  3. 評估並挑戰現有「容忍度指標」（Tolerances for Disruption），嘗試進一步縮減容忍空間。
  4. 導入自動化技術以優化業務映射，確保第三方服務變動能即時更新。
  5. 更新風險管理架構，特別是將 AI 網路風險納入優先緩解清單。
詳細摘要

1) 文檔概述
本文檔為 HKMA 發布的指導信函，旨在總結「1+3 年」營運韌性專案成果，並確立機構在 2026 年後維持與提升營運韌性的監管期望。該指引確認了 SPM OR-2 要求的落實情況，並強調機構需從「專案建立」邁向「常態化持續優化」。

2) 主要要求（核心架構）

  • Tone from the top（由上而下）： 董事會及高管層須領導韌性文化，確保韌性考慮事項內化於日常決策，並成功將專案架構過渡至恆常業務架構。
  • 持續檢視參數： 必須根據業務配置與風險環境，定期檢視關鍵業務清單、中斷容忍度及「嚴峻但合理」（Severe but plausible）的場景。
  • 深化測試與映射： 提升映射的細顆粒度；進行更高強度與影響力的場景測試；推動映射與供應商監控的自動化。
  • 主動風險管理： 針對 AI 驅動的網路風險與供應鏈風險，強化風險管理與事故應變架構，並建立明確的優先級修復時程。

3) 關鍵變更
對比以往側重於「建立框架」，本次變更強調「營運韌性成熟度」。機構被要求在現有基礎上「挑戰自身」，主動追求更嚴格的中斷容忍目標，而非僅僅滿足最低合規標準。

4) 重要日期與過渡安排

  • 2026 年 5 月底： 正式完成「1+3 年」導入期。
  • 往後： 執行 SPM OR-2 要求，至少每年由董事會審查關鍵業務定義、容忍度及場景 relevancy，並在業務發生重大變更時同步進行。

5) 對機構的影響與風險

  • 合規成本： 轉入常規運作可能需持續投入技術維護（自動化工具）與人員培訓成本。
  • 營運監控： AI 帶來的未知風險可能導致現有災難復原計畫（BCP）失效，需增加對於第三方服務供應商的動態審計。

6) 合規動作清單（Checklist）

  • [ ] 檢視組織架構： 是否已撤除臨時韌性項目組，職能是否已併入日常業務。
  • [ ] 員工訓練： 是否針對各級人員進行韌性責任培訓。
  • [ ] 參數檢視： 是否已挑戰目前的中斷容忍度指標（是否可進一步壓縮）。
  • [ ] 自動化導入： 是否規劃以技術手段（如自動化映射）取代手動維護。
  • [ ] 風險重評： 是否將 AI 風險納入網路安全及第三方依賴風險評估框架中。

7) 附件/附錄摘要
本文檔無傳統定義之「附件」，但文中明確提到了相關資源（Good practice guides, Industry sharing sessions, 2023/2025 年全行業模擬演習）。這些資源作為支持性文件，建議機構繼續參考，並視為未來持續進行場景測試與韌性演練的參考基準。