Hong Kong – Guideline On Authorization Of Digital Banks.
On 25 October 2024, the HKMA published a revised Guideline on Authorization of Digital Banks (“Guideline”) (superseding the previous “Guideline on Authorization of Virtual Banks”). The Guideline sets out the principles which the HKMA will take into account in deciding whether to authorize digital banks applying to conduct banking business in Hong Kong.
As set out in the Guideline, in considering whether to approve or refuse an application for authorization, the HKMA needs to be satisfied that the minimum criteria for authorization in the Seventh Schedule to the Banking Ordinance (Cap. 155 of the laws of Hong Kong) (“BO”) are met.
The Guideline also highlights the following points:
- Ownership: Digital banks are expected to be locally incorporated banks. In addition, it is generally the HKMA’s policy that a person who holds more than 50% of the share capital of a bank incorporated in Hong Kong should be a bank or a financial institution in good standing and supervised by a recognised authority in Hong Kong or elsewhere. If a locally-incorporated digital bank applicant is not owned by such a bank or financial institution, the HKMA expects the applicant to be held through an intermediate holding company incorporated in Hong Kong, with supervisory conditions imposed on this intermediate holding company.
- Ongoing supervision: Digital banks will be subject to the same set of supervisory requirements applicable to conventional banks. That said, some of these requirements will be adapted to suit the business models of digital banks under a risk-based and technology-neutral approach.
- Physical presence: Digital banks are required to maintain a physical presence in Hong Kong for interaction with regulators and customers.
- Technology risk: To manage technology-related risks, digital banks are required to have “fit for purpose” security and technology related controls in place. As part of the application process, digital bank applicants are required to engage a qualified and independent expert to perform an independent assessment of the adequacy of their planned IT governance and systems and provide the assessment report to HKMA. Before a digital bank commences operation, it is required to conduct a more detailed independent assessment of the actual design, implementation and effectiveness of its computer hardware, systems, security, procedures and controls.
- Risk management: At a minimum, digital bank applicants must go through the eight basic types of risk identified in the risk-based supervisory framework of the HKMA (i.e. credit, interest rate, market, liquidity, operational, reputation, legal and strategic risk) and establish appropriate controls to manage these risks.
- Business plan: Digital bank applicants must be able to present a credible and viable business plan which strikes an appropriate balance between the desire to build market share and the need to earn a reasonable return on assets and equity.
- Exit plan: Digital bank applicants are required to provide an exit plan in case their business model turns out to be unsuccessful.
- Customer protection: Digital banks are required to adhere to the Treat Customers Fairly Charter and observe the standards contained in the Code of Banking Practice issued by the Hong Kong Association of Banks and the DTC Association. Digital banks also have clearly to outline the rights and obligations of both the bank and customers in their terms and conditions, ensuring fairness and balance.
- Outsourcing: Outsourcing of computer or business operations of a digital bank to a third party service provider is allowed, subject to specific conditions. Digital banks should discuss their plans for material outsourcing with the HKMA in advance. It is important to note that the principles outlined in the SPM module on “Outsourcing” (SA-2), the Personal Data (Privacy) Ordinance and common law customer confidentiality must be adhered to. The HKMA must also be satisfied that his powers and duties under the BO (in particular, section 52 relating to the power of control over an institution) will not be hindered by the outsourcing arrangements.
- Capital requirement: Digital banks must maintain adequate capital commensurate with the nature of their operations and the banking risks they are undertaking.
Please click here to read the Guideline.
