Management Summary
- Purpose / Background: This consultation outlines revisions to the HKMA Supervisory Policy Manual (SPM) module CR-S-5, “Credit Card Business.” The update aims to align supervisory expectations with evolving market practices, including increased digitalization (virtual cards, e-commerce), heightened fraud risks (authorized push payment scams), and modern accounting/capital standards.
- One-line conclusion: AIs must enhance risk management frameworks for credit card operations—specifically focusing on digital fraud prevention, third-party service provider oversight, and robust, forward-looking provisioning models.
- Key Changes:
- Expanded scope to include modern payment ecosystems (payment gateways, digital/virtual cards, "Buy Now, Pay Later" products).
- Strengthened operational risk requirements regarding third-party service provider dependency.
- Updated guidance on combating sophisticated fraud (e.g., phishing, pharming, and authorized push payment scams).
- Stricter alignment with accounting standards (e.g., forward-looking expected credit loss requirements).
- Clarification on debt relief expectations (e.g., 120-month ceiling for debt relief plans).
- Key Dates / Deadlines: This is a consultation document; implementation timelines will be finalized following the conclusion of the consultation process.
- Applicability / Impact scope: All Authorized Institutions (AIs) engaged in credit card issuing or merchant acquiring, directly or via subsidiaries/affiliates.
- Recommended management actions:
- Conduct a gap analysis of current credit card policies against the proposed CR-S-5 updates.
- Review outsourcing agreements and due diligence processes for third-party payment processors and gateways.
- Strengthen fraud detection systems to address evolving electronic/online fraud typologies.
- Validate that loan classification and provisioning models incorporate forward-looking economic indicators as per updated guidance.
- Formalize "sympathetic" debt relief procedures and ensure participation in Interbank Debt Relief Plans (IDRP).
Detailed Summary
1) Document overview
The module serves as a non-statutory guideline for AIs to manage risks in credit card and merchant acquiring businesses. It emphasizes prudent underwriting, rigorous operational security, and effective delinquency management.
2) Main requirements
- Governance: Boards and senior management must oversee business strategies and risk controls.
- Credit Risk: AIs must maintain prudent underwriting for applications, including "pre-approved" programs and alternative income proofs.
- Operational Risk: Requires strict data integrity, security, and disaster recovery. AIs retain ultimate responsibility for outsourced functions (e.g., payment gateways).
- Fraud Control: AIs must educate customers and monitor transactions for suspicious patterns (e.g., out-of-pattern purchases).
- Merchant Acquiring: Requires thorough vetting of new merchants, especially high-risk e-commerce entities, including negative vetting via associations and potential collateral requirements.
3) Key changes (vs. previous version)
- Scope: Now explicitly covers digital/virtual cards and modern fintech service providers (gateways/processors).
- Terminology: Updated to reflect contemporary fraud types (e.g., "Authorized Push Payment Scams" and phishing).
- Debt Relief: Extended repayment period guidance (up to 120 months) and emphasized mandatory IDRP participation.
- Provisioning: Shifted focus to forward-looking impairment modeling in line with modern accounting standards (e.g., HKAS).
4) Important dates & transition
- Currently in consultation phase. AIs should monitor for finalization notices and subsequent transition circulars issued by the HKMA.
5) Impact and risks
- Operational: Higher compliance burden regarding third-party oversight and system security testing.
- Financial: Potential impact on provisioning levels due to updated forward-looking loss requirements.
- Reputational: Increased regulatory expectation for consumer protection in digital/unsecured lending.
6) Compliance action checklist
- [ ] Update internal policy for credit card delinquency to reflect the 120-month guidance.
- [ ] Review and test fraud monitoring logic against new "phishing/pharming/push payment" typologies.
- [ ] Ensure outsourcing register includes all payment gateways/digital processors with clearly defined security audits.
- [ ] Verify that internal loan classification triggers are fully aligned with HKAS/HKMA provisioning expectations.
7) Appendices/attachments summary
- Annex A (Scoring systems): Provides guidance on the use of statistical scoring models in credit underwriting and risk assessment. The annex emphasizes that models must be regularly validated, adjusted for current economic conditions, and should not replace experienced credit judgment.