Today is the deadline for Hong Kong authorised institutions to become operationally resilient under the HKMA Supervisory Policy Manual module OR-2, issued in May 2022.
Key points
- Institutions must identify critical operations and set tolerance for disruption.
- Critical operations must be mapped, including people, technology and third parties.
- Scenario testing must show the institution can remain within tolerance.
- OR-2 works alongside TM-G-1 technology risk management and C-RAF 2.0 cyber resilience.
UK technology and service providers supporting Hong Kong banks should expect further questions on resilience, testing and recovery. The approach aligns with UK operational resilience rules.
Source: Supervisory Policy Manual OR-2 Operational Resilience (HKMA)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
