HKMA SPM crosswalk to international + sectoral standards. (a) BASEL III - BCBS Basel III capital (Pillar 1/2/3) + liquidity (LCR + NSFR) + leverage + IRRBB + FRTB + SMA operational risk + IRB + standardised approaches; HKMA implements via Banking (Capital) Rules + SPM modules (CA + IR + MR + OR + LM + CR); (b) FSB FINANCIAL STABILITY BOARD principles - operational resilience + recovery + resolution + cybersecurity + outsourcing + cyber-incident response + cyber lexicon; HKMA OR-2 + RR + SA + TM aligned; (c) FATF RECOMMENDATIONS - AML/CFT + KYC + CDD + EDD + SAR + sanctions; HKMA AMLO + sectoral AML/CFT supervision; (d) IOSCO INTERNATIONAL ORGANIZATION OF SECURITIES COMMISSIONS - coordinates with SFC for securities + futures + asset management; (e) IAIS INTERNATIONAL ASSOCIATION OF INSURANCE SUPERVISORS - coordinates with HK Insurance Authority for insurance entities; (f) IMF FSAP + Article IV consultations; (g) SINGAPORE MAS + UK PRA + ECB + AUSTRALIA APRA + FEDERAL RESERVE + OCC equivalent banking supervisory frameworks; cross-border supervisory colleges + memoranda + bilateral cooperation; (h) BCBS PRINCIPLES FOR EFFECTIVE BANKING SUPERVISION + Core Principles; (i) FSB PRINCIPLES FOR SOUND COMPENSATION PRACTICES + Implementation Standards; (j) FSB GUIDANCE ON CYBER INCIDENT REPORTING (FIRE) - HKMA aligned. SECTORAL CYBERSECURITY: HKMA C-RAF v2.0 (verified separately) + CFI; UK CBEST + ECB TIBER-EU (verified separately) + Singapore MAS AASE + Australia APRA CPS 234 + sectoral equivalents. EU DORA (Digital Operational Resilience Act, separately tracked) effective 17 January 2025 - parallel EU sectoral cybersecurity + ICT-risk + financial-entity coordination + cross-border + AIs with EU operations subject to DORA. NIST CYBERSECURITY FRAMEWORK + ISO 27001/2 + ISO 22301 BCM + ISO 27036 Supplier Relationships - voluntary international standards adopted by HK AIs. PCI DSS - card payment industry. SOC 2 Type II - service provider attestation. HK PDPO Cap. 486 (separately tracked) - personal data privacy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.