HKMA SPM
The HKMA SUPERVISORY POLICY MANUAL (SPM) is the foundational umbrella collection of supervisory policy modules + guidance issued by the HONG KONG MONETARY AUTHORITY (HKMA) governing banking + financial institution supervision in Hong Kong SAR. The SPM provides the comprehensive framework for HKMA Authorised Institutions (AIs - licensed banks + restricted-licence banks + deposit-taking companies); supplemented by specific Circulars + sectoral cybersecurity frameworks (notably C-RAF v2.0 + Cybersecurity Fortification Initiative). SPM organises ~60+ modules by SUBJECT AREAS: (a) CG CORPORATE GOVERNANCE - CG-1 (Corporate Governance of Locally Incorporated AIs) + CG-2 (Systems of Control) + CG-3 (Code of Conduct) + CG-5 (Guideline on a Sound Remuneration System) + CG-6 (Competence and Ethical Behaviour); (b) CR CREDIT RISK MANAGEMENT - CR-G General Principles + CR-G-7 (Collateral and Credit Risk Mitigation) + CR-G-13 (Counterparty Credit Risk Management) + numerous sub-modules; (c) IR INTEREST RATE RISK - IR-1 (Interest Rate Risk in Banking Book); (d) LM LIQUIDITY MANAGEMENT - LM-1 (Liquidity Risk Management) + LM-2 + LM-3; (e) MR MARKET RISK MANAGEMENT - MR-G + various sub-modules; (f) OR OPERATIONAL RISK - OR-1 (Operational Risk Management) + OR-2 (Operational Resilience); (g) IC INTERNAL CONTROL + RISK MANAGEMENT - IC-1 (Risk Management Framework) + IC-5 (Stress Testing); (h) AC AUDITING - AC-G + various; (i) TM TECHNOLOGY MANAGEMENT modules - TM-G-1 (General Principles for Technology Risk Management, covered as its own framework) + TM-G-2 (Business Continuity Planning) + TM-G-3 (Information Technology Security + Cyber Risk Mgmt) + TM-G-4 (Public Cloud) + TM-E-1 (Risk Management of e-Banking) + TM-M (Monitoring) + TM-N (New Technology) + TM-S (Supervisory); (j) RA RISK-BASED APPROACH modules; (k) AMLO AML/CFT - AML + CFT supervision + AMLO Guidelines; (l) CA CAPITAL ADEQUACY - CA-G-1 (Capital Adequacy Assessment) + Basel III implementation; (m) RR RECOVERY + RESOLUTION PLANNING - RR-1 (Recovery Planning); (n) SA OUTSOURCING - SA-2 (Outsourcing); (o) DI DEPOSIT INSURANCE; (p) various other modules covering reporting + governance + remuneration + sectoral. KEY MODULE NUMBERING: each module has a letter-prefix (e.g. CG + CR + TM) + number (e.g. 1 + 2 + G + E) + sub-number (e.g. G-1 + G-2); modules updated periodically with version control + effective dates + supervisory expectations. KEY MODULES + SUPERVISORY EXPECTATIONS: each module establishes principles + expectations + applicable to AIs based on size + complexity + risk + sophistication; HKMA supervisory dialogue + assessment + reporting + remediation cycle. INTEGRATION: SPM coordinates with HKMA Banking Ordinance + Banking (Capital) Rules + various Cap. 155 sub-regulations + Banking (Disclosure) Rules + Banking (Liquidity) Rules + Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); Cybersecurity Fortification Initiative (CFI) + C-RAF v2.0 (verified separately) operationalises cybersecurity-specific expectations. INTERNATIONAL COORDINATION: Basel Committee on Banking Supervision (BCBS) standards + IOSCO + FATF + Financial Stability Board (FSB); Singapore MAS + UK PRA + ECB + Australia APRA + Federal Reserve + OCC equivalent supervisory frameworks. RECENT UPDATES + 2024-2025+: ongoing module revisions including Operational Resilience (OR-2) + Climate Risk + ESG-related expectations + AI + cybersecurity + recovery + DORA-coordination + sustainability + DPP-coordination + emerging tech.
HKMA SPM is a compliance framework from Hong Kong SAR with 8 domains and 77 controls that map to 99 other frameworks. The largest domains are Credit risk management (CR-G, CR-L, CR-S) – HKMA SPM (20 controls), Capital adequacy (CA-G, CA-B, CA-S, CA-D) – HKMA SPM (16 controls), Operational, technology, climate, reputation, strategic and recovery (OR, TM, GS, RR, SR, RE) – HKMA SPM (11 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
Capital adequacy (CA-G, CA-B, CA-S, CA-D) – HKMA SPM
| Code | Title |
|---|---|
| hkma-spm::CA-B-1 | CA-B-1 Countercyclical Capital Buffer (CCyB): Approach to its Implementation |
| hkma-spm::CA-B-2 | CA-B-2 Systemically Important Banks |
| hkma-spm::CA-B-3 | CA-B-3 Countercyclical Capital Buffer (CCyB): Geographic Allocation of Private Sector Credit Exposures |
| hkma-spm::CA-D-1 | CA-D-1 Guideline on the Application of the Banking (Disclosure) Rules |
| hkma-spm::CA-G-1 | CA-G-1 Overview of Capital Adequacy Regime for Locally Incorporated Authorized Institutions |
| hkma-spm::CA-G-2 | CA-G-2 Maintenance of Adequate Capital against Market Risk |
| hkma-spm::CA-G-3 | CA-G-3 Use of Internal Models Approach to Calculate Market Risk |
| hkma-spm::CA-G-4 | CA-G-4 Validating Risk Rating Systems under the IRB Approach |
| hkma-spm::CA-G-5 | CA-G-5 Supervisory Review Process |
| hkma-spm::CA-S-10 | CA-S-10 Fair Value Practices |
| hkma-spm::CA-S-4 | CA-S-4 Capital Adequacy Requirements for Investment Guarantees under Mandatory Provident Fund Schemes |
| hkma-spm::CA-S-5 | CA-S-5 Use of Internal Models to Measure Market Risks for Investment Guarantees under MPF Schemes |
| hkma-spm::CA-S-6 | CA-S-6 Instruments Eligible for Inclusion in Core Capital |
| hkma-spm::CA-S-7 | CA-S-7 Term Subordinated Debt and Paid-up Term Preference Shares for Inclusion in Supplementary Capital |
| hkma-spm::CA-S-8 | CA-S-8 Perpetual Subordinated Debt and Paid-up Irredeemable Cumulative Preference Shares for Inclusion in Supplementary Capital |
| hkma-spm::CA-S-9 | CA-S-9 Use of the Fair Value Option for Financial Instruments |
Corporate governance (CG) – HKMA SPM
| Code | Title |
|---|---|
| hkma-spm::CG-1 | CG-1 Corporate Governance of Locally Incorporated Authorized Institutions |
| hkma-spm::CG-2 | CG-2 Systems of Control for the Appointment of Managers |
| hkma-spm::CG-3 | CG-3 Code of Conduct |
| hkma-spm::CG-4 | CG-4 Establishment of Overseas Banking Subsidiaries: §51A |
| hkma-spm::CG-5 | CG-5 Guideline on a Sound Remuneration System |
| hkma-spm::CG-6 | CG-6 Competence and Ethical Behaviour |
| hkma-spm::CG-7 | CG-7 Benchmark Submission |
Credit risk management (CR-G, CR-L, CR-S) – HKMA SPM
| Code | Title |
|---|---|
| hkma-spm::CR-G-1 | CR-G-1 General Principles of Credit Risk Management |
| hkma-spm::CR-G-10 | CR-G-10 Problem Credit Management |
| hkma-spm::CR-G-12 | CR-G-12 Credit Risk Transfer Activities |
| hkma-spm::CR-G-13 | CR-G-13 Counterparty Credit Risk Management |
| hkma-spm::CR-G-14 | CR-G-14 Non-centrally Cleared OTC Derivatives Transactions: Margin and Other Risk Mitigation Standards |
| hkma-spm::CR-G-2 | CR-G-2 Credit Approval, Review and Records |
| hkma-spm::CR-G-3 | CR-G-3 Credit Administration, Measurement and Monitoring |
| hkma-spm::CR-G-5 | CR-G-5 Country Risk Management |
| hkma-spm::CR-G-6 | CR-G-6 Interest Recognition |
| hkma-spm::CR-G-7 | CR-G-7 Collateral and Guarantees |
| hkma-spm::CR-G-8 | CR-G-8 Large Exposures and Risk Concentrations |
| hkma-spm::CR-G-9 | CR-G-9 Exposures to Connected Parties |
| hkma-spm::CR-L-1 | CR-L-1 Consolidated Supervision of Concentration Risks: BELR Rule 6 |
| hkma-spm::CR-L-2 | CR-L-2 Exemption of Financial Exposures: §81(6)(b)(i) |
| hkma-spm::CR-L-3 | CR-L-3 Letters of Comfort: BELR Rule 57(1)(d) |
| hkma-spm::CR-L-4 | CR-L-4 Underwriting of Securities: BELR |
| hkma-spm::CR-L-5 | CR-L-5 Major Acquisitions and Investments: BELR Part 3 |
| hkma-spm::CR-S-2 | CR-S-2 Syndicated Lending |
| hkma-spm::CR-S-4 | CR-S-4 New Share Subscription and Share Margin Financing |
| hkma-spm::CR-S-5 | CR-S-5 Credit Card Business |
Internal controls and risk management (IC) – HKMA SPM
| Code | Title |
|---|---|
| hkma-spm::IC-1 | IC-1 Risk Management Framework |
| hkma-spm::IC-2 | IC-2 Internal Audit Function |
| hkma-spm::IC-3 | IC-3 Reporting Requirements Relating to Authorized Institutions' External Auditors under the Banking Ordinance |
| hkma-spm::IC-4 | IC-4 Complaints Handling and Redress |
| hkma-spm::IC-5 | IC-5 Stress-testing |
| hkma-spm::IC-6 | IC-6 The Sharing and Use of Consumer Credit Data through Credit Reference Agencies |
| hkma-spm::IC-7 | IC-7 The Sharing and Use of Commercial Credit Data through a Commercial Credit Reference Agency |
Liquidity, market and interest rate risk (LM, MR, IR, TA) – HKMA SPM
| Code | Title |
|---|---|
| hkma-spm::IR-1 | IR-1 Interest Rate Risk in the Banking Book |
| hkma-spm::LM-1 | LM-1 Regulatory Framework for Supervision of Liquidity Risk |
| hkma-spm::LM-2 | LM-2 Sound Systems and Controls for Liquidity Risk Management |
| hkma-spm::MR-1 | MR-1 Market Risk Capital Charge |
| hkma-spm::MR-2 | MR-2 CVA Risk Capital Charge |
| hkma-spm::TA-2 | TA-2 Foreign Exchange Risk Management |
Operational, technology, climate, reputation, strategic and recovery (OR, TM, GS, RR, SR, RE) – HKMA SPM
| Code | Title |
|---|---|
| hkma-spm::GS-1 | GS-1 Climate Risk Management |
| hkma-spm::OR-1 | OR-1 Operational Risk Management |
| hkma-spm::OR-2 | OR-2 Operational Resilience |
| hkma-spm::RE-1 | RE-1 Recovery Planning |
| hkma-spm::RR-1 | RR-1 Reputation Risk Management |
| hkma-spm::SR-1 | SR-1 Strategic Risk Management |
| hkma-spm::TM-C-1 | TM-C-1 Supervisory Approach on Cyber Risk Management |
| hkma-spm::TM-E-1 | TM-E-1 Risk Management of E-banking |
| hkma-spm::TM-E-2 | TM-E-2 Regulation of Advertising Material for Deposits Issued over the Internet |
| hkma-spm::TM-G-1 | TM-G-1 General Principles for Technology Risk Management |
| hkma-spm::TM-G-2 | TM-G-2 Business Continuity Planning |
Regulated activities and financial crime (SB, TB, IB, AML) – HKMA SPM
| Code | Title |
|---|---|
| hkma-spm::AML-1 | AML-1 Supervisory Approach on Anti-Money Laundering and Counter-Financing of Terrorism |
| hkma-spm::AML-2 | AML-2 Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) |
| hkma-spm::IB-1 | IB-1 Supervision of Insurance Intermediary Business of Authorized Institutions |
| hkma-spm::SB-1 | SB-1 Supervision of Regulated Activities of SFC-Registered Authorized Institutions |
| hkma-spm::SB-2 | SB-2 Leveraged Foreign Exchange Trading |
| hkma-spm::TB-1 | TB-1 Regulation and Supervision of Trust Business |
Supervisory approach and group supervision (SA, CS, MB) – HKMA SPM
| Code | Title |
|---|---|
| hkma-spm::CS-1 | CS-1 Group-wide Approach to Supervision of Locally Incorporated Authorized Institutions |
| hkma-spm::MB-1 | MB-1 Risk-based Supervision of Approved Money Brokers |
| hkma-spm::SA-1 | SA-1 Risk-based Supervisory Approach |
| hkma-spm::SA-2 | SA-2 Outsourcing |
Your Compliance Coverage
If you comply with HKMA SPM, you already cover:
Protective Security Policy Framework (PSPF) Release 2026
3%
3 controls mapped
Compare →OWASP ASVS
3%
3 controls mapped
Compare →NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems
3%
3 controls mapped
Compare →+ 96 more: MITRE D3FEND (3%), ISO/IEC 27011:2024 (3%)
See all 99 mapped frameworks ↓Maps to 99 other frameworks
Coverage is not the same as your position
This page shows what HKMA SPM overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is HKMA SPM and who does it apply to?
HKMA SPM is a compliance framework from Hong Kong SAR with 8 domains and 77 controls. The HKMA SUPERVISORY POLICY MANUAL (SPM) is the foundational umbrella collection of supervisory policy modules + guidance issued by the HONG KONG MONETARY AUTHORITY (HKMA) governing banking + financial institution supervision in Hong Kong SAR. The SPM provides the comprehensive framework for HKMA Authorised Institutions (AIs - licensed banks + restricted-licence banks + deposit-taking companies); supplemented by specific Circulars + sectoral cybersecurity frameworks (notably C-RAF v2.0 + Cybersecurity Fortification Initiative). SPM organises ~60+ modules by SUBJECT AREAS: (a) CG CORPORATE GOVERNANCE - CG-1 (Corporate Governance of Locally Incorporated AIs) + CG-2 (Systems of Control) + CG-3 (Code of Conduct) + CG-5 (Guideline on a Sound Remuneration System) + CG-6 (Competence and Ethical Behaviour); (b) CR CREDIT RISK MANAGEMENT - CR-G General Principles + CR-G-7 (Collateral and Credit Risk Mitigation) + CR-G-13 (Counterparty Credit Risk Management) + numerous sub-modules; (c) IR INTEREST RATE RISK - IR-1 (Interest Rate Risk in Banking Book); (d) LM LIQUIDITY MANAGEMENT - LM-1 (Liquidity Risk Management) + LM-2 + LM-3; (e) MR MARKET RISK MANAGEMENT - MR-G + various sub-modules; (f) OR OPERATIONAL RISK - OR-1 (Operational Risk Management) + OR-2 (Operational Resilience); (g) IC INTERNAL CONTROL + RISK MANAGEMENT - IC-1 (Risk Management Framework) + IC-5 (Stress Testing); (h) AC AUDITING - AC-G + various; (i) TM TECHNOLOGY MANAGEMENT modules - TM-G-1 (General Principles for Technology Risk Management, covered as its own framework) + TM-G-2 (Business Continuity Planning) + TM-G-3 (Information Technology Security + Cyber Risk Mgmt) + TM-G-4 (Public Cloud) + TM-E-1 (Risk Management of e-Banking) + TM-M (Monitoring) + TM-N (New Technology) + TM-S (Supervisory); (j) RA RISK-BASED APPROACH modules; (k) AMLO AML/CFT - AML + CFT supervision + AMLO Guidelines; (l) CA CAPITAL ADEQUACY - CA-G-1 (Capital Adequacy Assessment) + Basel III implementation; (m) RR RECOVERY + RESOLUTION PLANNING - RR-1 (Recovery Planning); (n) SA OUTSOURCING - SA-2 (Outsourcing); (o) DI DEPOSIT INSURANCE; (p) various other modules covering reporting + governance + remuneration + sectoral. KEY MODULE NUMBERING: each module has a letter-prefix (e.g. CG + CR + TM) + number (e.g. 1 + 2 + G + E) + sub-number (e.g. G-1 + G-2); modules updated periodically with version control + effective dates + supervisory expectations. KEY MODULES + SUPERVISORY EXPECTATIONS: each module establishes principles + expectations + applicable to AIs based on size + complexity + risk + sophistication; HKMA supervisory dialogue + assessment + reporting + remediation cycle. INTEGRATION: SPM coordinates with HKMA Banking Ordinance + Banking (Capital) Rules + various Cap. 155 sub-regulations + Banking (Disclosure) Rules + Banking (Liquidity) Rules + Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); Cybersecurity Fortification Initiative (CFI) + C-RAF v2.0 (verified separately) operationalises cybersecurity-specific expectations. INTERNATIONAL COORDINATION: Basel Committee on Banking Supervision (BCBS) standards + IOSCO + FATF + Financial Stability Board (FSB); Singapore MAS + UK PRA + ECB + Australia APRA + Federal Reserve + OCC equivalent supervisory frameworks. RECENT UPDATES + 2024-2025+: ongoing module revisions including Operational Resilience (OR-2) + Climate Risk + ESG-related expectations + AI + cybersecurity + recovery + DORA-coordination + sustainability + DPP-coordination + emerging tech. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does HKMA SPM actually require?
HKMA SPM has 77 controls organised across 8 domains. The largest domains are Credit risk management (CR-G, CR-L, CR-S) – HKMA SPM (20 controls), Capital adequacy (CA-G, CA-B, CA-S, CA-D) – HKMA SPM (16 controls), Operational, technology, climate, reputation, strategic and recovery (OR, TM, GS, RR, SR, RE) – HKMA SPM (11 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of HKMA SPM do I already cover?
HKMA SPM maps to 99 other compliance frameworks. The top mapping partners are Protective Security Policy Framework (PSPF) Release 2026 (3% coverage), OWASP ASVS (3% coverage), NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems (3% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement HKMA SPM?
Start your HKMA SPM compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about HKMA SPM requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 77 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required