Management Summary
- Purpose / Background: This Supervisory Policy Manual (SPM) module, IC-5 (V.3), provides updated guidance on establishing an effective, firm-wide stress-testing programme. It replaces the 2012 version to address lessons learned from the 2008/09 financial crisis and the 2023 banking turmoil, emphasizing robust governance, model validation, and the inclusion of extreme market scenarios.
- One-line conclusion: AIs must implement a comprehensive, Board-approved stress-testing framework that integrates into strategic decision-making and risk appetite, with increased focus on system-wide interactions and data granularity.
- Key Changes:
- Heightened requirements for Board and senior management oversight, ensuring active engagement and challenge of stress-testing assumptions.
- Explicit inclusion of "tail risk," system-wide interactions, feedback effects, and contagion risks.
- Stronger emphasis on firm-wide risk aggregation and the use of flexible/ad-hoc testing for emerging risks (e.g., climate risk, cyber risk).
- Enhanced expectations for third-party risk management and data infrastructure capabilities.
- Greater focus on "reverse stress-testing" to identify scenarios where institutional viability is compromised.
- Key Dates / Deadlines: Effective as of 2026-04-13.
- Applicability / Impact scope: All Authorized Institutions (AIs) in Hong Kong, applied proportionately to size, complexity, and risk profile.
- Recommended management actions:
- Conduct a gap analysis of the existing stress-testing programme against IC-5 V.3 requirements.
- Ensure the Board formally approves the stress-testing objectives, policies, and procedures.
- Strengthen infrastructure to support data granularity, consistency, and the ability to perform ad-hoc sensitivity analysis.
- Integrate stress-test outputs directly into the Internal Capital Adequacy Assessment Process (ICAAP), liquidity risk management, and recovery planning.
- Establish a formal "challenge" process where business experts review and critique model assumptions and outputs.
Detailed Summary
- Document overview: This is a guidance note issued by the HKMA. It outlines expectations for stress-testing as a critical tool for assessing vulnerability (capital, liquidity, profitability) and informing strategic risk-management decisions.
- Main requirements:
- Governance: The Board bears ultimate responsibility for the oversight and approval of the stress-testing programme. Senior management must ensure active engagement in setting scenarios and formulating risk-mitigating strategies.
- Process: Must include clear policies/procedures, regular updates, and independent reviews. Tests must be actionable, meaning results should influence capital planning and risk appetite limits.
- Infrastructure: AIs must maintain accurate, complete, and granular data. Systems must allow for firm-wide aggregation and the flexibility to model new risks or ad-hoc scenarios.
- Methodology: Use a range of scenarios (not just "normal" conditions). Must address "tail risk," correlations that break down under stress, and behavioral feedback effects.
- Key changes vs previous requirements:
- The new module explicitly addresses modern threats like digital/social media-driven bank runs, cryptoasset exposures, and climate-related financial risks.
- It increases the expectation for the Board to challenge management on the plausibility of scenarios and the feasibility of mitigation plans.
- Stronger emphasis on cross-jurisdictional and group-wide consistency for multinational AIs.
- Important dates & transition:
- The module is effective 2026-04-13. AIs should align current practices with these updated expectations during their regular internal review cycles.
- Impact and risks:
- Operational/IT: Need for higher quality/more granular data and flexible modelling tools to meet HKMA's requirements for ad-hoc or supervisory tests.
- Compliance: Potential for increased scrutiny during on-site examinations; failure to show that stress tests inform actual decision-making is a material shortcoming.
- Compliance action checklist:
- [ ] Update Stress-Testing Policy to incorporate V.3 requirements.
- [ ] Perform a "reverse stress-test" to identify existential threats.
- [ ] Document the "challenge" process—evidence of Board/senior management questioning model inputs and results.
- [ ] Ensure cross-departmental collaboration (Risk, IT, Treasury, Business Units) is formalized in the governance structure.
- Appendices/attachments summary:
- The Annex provides non-exhaustive examples of risk factors (e.g., credit, liquidity, strategic, reputation, climate risks) and scenarios (e.g., domestic downturn, major global events, collateral liquidity decline). It serves as a reference for AIs to develop bespoke scenarios that accurately reflect their unique risk profile and interdependencies.