Management Summary
- Purpose / Background: The HKMA is launching "Granular Data Reporting (GDR) 3.0" to modernize the supervisory reporting framework. The goal is to move away from legacy template-based returns toward a granular, scalable data structure (DataGRID framework) that improves reliability and enables more agile, intelligent risk management.
- One-line conclusion: AIs must transition to a three-phase granular reporting model (2026–2031) featuring parallel reporting, data validation, and eventual independent audit requirements.
- Key Changes:
- Implementation of a three-phase rollout (2026–2031) to progressively replace template-based surveys.
- Requirement for mandatory reconciliation between new granular submissions and existing templates during parallel reporting periods.
- Introduction of systematic "validation points" and defined tolerance bands (e.g., ±0.1%).
- Future requirement for external audit reviews under Section 63(3) of the Banking Ordinance.
- Adoption of modern submission standards, including potential API-based reporting.
- Future exploration of "on-demand" reporting beyond fixed cycles.
- Key Dates / Deadlines:
- Q2 2026: Industry feedback on the roadmap and governance approach.
- Q3 2026: Industry input on data availability and validation/reconciliation controls.
- 2026–2028 (Phase 1): Foundation phase; integration of non-financial data and initial pilot audits.
- 2027–2029 (Phase 2): Scaling and replacement of additional surveys.
- 2030–2031 (Phase 3): Full implementation and transition to on-demand reporting.
- Applicability / Impact scope: All Authorized Institutions (AIs) are in scope. The impact spans IT infrastructure, data governance, regulatory reporting functions, and internal audit processes.
- Recommended management actions:
- Establish a dedicated GDR 3.0 steering committee to manage system integration and data governance.
- Review existing risk data architectures to ensure readiness for consolidated granular reporting.
- Conduct gap analysis on data availability for potential Phase 1 areas (e.g., corporate loans, OTC derivatives).
- Prepare for active participation in the HKMA industry engagement sessions starting Q2 2026.
- Develop internal reconciliation capabilities to support the upcoming parallel reporting requirements.
Detailed Summary
1) Document overview
GDR 3.0 is a multi-year supervisory initiative to transform reporting from manual template-based surveys to granular, system-integrated data submissions. The framework is guided by the "DataGRID" principles (Granularity, Reliability, Ingenuity, Discoverability).
2) Main requirements
- Data Governance: AIs must build scalable infrastructure capable of consolidating risk data, including unstructured and non-financial data.
- Validation Controls: Implement systemic validation points for all GDR submissions, maintaining a tolerance band (e.g., ±0.1%) for reconciliation discrepancies.
- Reconciliation: During parallel reporting periods, AIs must reconcile granular data against existing template-based benchmarks.
- Quarterly/less frequent: Reconcile across 2 periods.
- Bi-monthly/more frequent: Reconcile across 3 periods.
- Audit: GDR submissions will eventually be subject to audit reviews pursuant to Section 63(3) of the Banking Ordinance.
3) Key changes
- Shift from "template-based" to "data-field-based" reporting.
- Inclusion of non-financial data (e.g., cyber resilience, operational risk).
- Move toward automated submission methods (API, XML, CSV).
4) Important dates & transition
- 2026–2028: Phase 1 (Foundation/Governance setup).
- 2027–2029: Phase 2 (Scaling and survey replacement).
- 2030–2031: Phase 3 (Full optimization and on-demand reporting).
5) Impact and risks
- Operations: Requires significant investment in automated data pipelines to reduce manual processing.
- Compliance: Persistent non-compliance with new granular requirements will trigger supervisory measures.
- Audit: Potential complexity in audit scope for highly granular fields; early involvement in pilot audits is encouraged.
6) Compliance action checklist
- Perform "data stock-take" of current risk data sources.
- Provide feedback to HKMA in Q2/Q3 2026 regarding data field readiness and potential de minimis exemptions.
- Define internal "validation points" for system-reconstruction of data.
- Integrate GDR 3.0 requirements into the 2027 UAT schedule for Phase 1.
7) Appendices/attachments summary
- Potential Data Scope: Lists current and expanded financial data areas (e.g., Corporate loans, OTC derivatives, Commitments) and non-financial areas (e.g., Cyber resilience, Tech risk management) to be phased in over the 2026–2031 timeline. This list serves as a reference for AIs to identify necessary data infrastructure upgrades.