Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
1
Purpose
Section 196 of the Financial Institutions (Resolution) Ordinance (Cap.
628) (“FIRO”) empowers the Monetary Authority (“MA”) as resolution authority in relation to banking sector entities to issue a code of practice (“Code of Practice”) about any matter relating to the functions given to the MA as a resolution authority by the FIRO.
This publication is a chapter of the Code of Practice. It explains the MA’s policy in relation to operational continuity in resolution (“OCIR”) and sets out the MA’s expectations regarding the ex-ante arrangements authorized institutions (“AIs”) should put in place to secure the continuity in resolution of services that are essential to the continued performance of critical financial functions (“CFFs”)1 as well as to support post- stabilization restructuring in a timely manner. It provides guidance to AIs on the MA’s approach to resolution planning and resolvability assessment (including the removal of impediments to orderly resolution)
1 Under section 2(1) of the FIRO, critical financial function means an activity or operation carried on, or a service provided, by a financial institution -
(a) on which an entity (other than a group company of the financial institution) relies; and (b) that, if discontinued, would be likely to -
(i) lead to the disruption of services that are essential to the economy of Hong Kong;
(ii) undermine the general confidence of participants in the financial market in Hong Kong; or (iii) give rise to contagion within the financial system of Hong Kong,
for any reason including the size, interconnectedness, complexity or cross-border activities of, or the market share held by, the financial institution or the group of companies of which the financial institution is a member.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
2
as regards OCIR. In this chapter, references to the MA refer to the MA acting in the capacity as resolution authority.
This chapter of the Code of Practice should be read in conjunction with the Code of Practice chapter RA-2, “The HKMA’s Approach to Resolution Planning”2 (“RA-2”) and the Code of Practice chapter CI-1,
“Resolution Planning – Core Information Requirements”3 (“CI-1”).
Application
To all AIs.
Structure
1. Introduction
2. CFFs, essential services and preferred resolution strategies 3. Service delivery models
4. OCIR arrangements and matters to be addressed 5. The MA’s approach to implementation
—————————
2 https://www.hkma.gov.hk/media/eng/doc/key-functions/banking-stability/resolutions/RA- 2_The_HKMA_approach_to_resolution_planning.pdf
3 https://www.hkma.gov.hk/media/eng/doc/key-functions/banking-stability/resolutions/CI- 1_Resolution_Planning_Core_Information_Requirements.pdf
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
3
1. Introduction
1.1 OCIR refers to continuity in resolution of services that are essential to the continued performance of CFFs as well as to support post-stabilization restructuring in a timely manner.
These services are referred to in this chapter as “essential services”. The ability to ensure OCIR is consistent with the objectives and standards of the Key Attributes of Effective Resolution Regimes for Financial Institutions4 published by the Financial Stability Board (“FSB”). This chapter is informed by the FSB’s Guidance on Arrangements to Support Operational Continuity in Resolution (“FSB OCIR Guidance”)5 and other relevant FSB guidance6. Lack of adequate arrangements to support OCIR has been identified by the FSB as one of the key obstacles to orderly resolution in its Resolvability Assessment Process7. OCIR is therefore a key aspect of resolution planning for individual AIs and failure to sufficiently address and mitigate OCIR risk may constitute a significant impediment to the orderly resolution of an AI.
1.2 The resolution regime under the FIRO reflects the importance of OCIR and empowers8 the MA to take appropriate action to support OCIR. The stability and effective working of the financial system of Hong Kong, including the continued performance of
4 https://www.fsb.org/wp-content/uploads/r_141015.pdf
The objectives specify that resolution regimes should, among other things, ensure continuity of systemically important financial functions of a firm in resolution.
5 https://www.fsb.org/wp-content/uploads/Guidance-on-Arrangements-to-Support-Operational- Continuity-in-Resolution1.pdf
6 Guidance on Identification of Critical Functions and Critical Shared Services:
https://www.fsb.org/wp-content/uploads/r_130716a.pdf
7 Refer to paragraph 1.3 of the FSB OCIR Guidance for details.
8 Refer for example to sections 79 and 81 of the FIRO.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
4
CFFs, are at the heart of the objects of the FIRO9 and the resolution objectives under the FIRO10 . In performing, or considering performing, functions under the FIRO, the MA must have regard to the resolution objectives11. The MA will therefore consider OCIR when conducting resolution planning and in devising strategies for securing an orderly resolution of an AI (or a holding company of the AI) and developing resolution plans to support such strategies12. The MA will also consider OCIR when conducting a resolvability assessment of an AI (or a holding company of the AI) to determine whether there are any impediments to its orderly resolution13.
1.3 Essential services generally fall into two main categories: finance- related (including treasury-related services, trading, asset management, cash-handling, risk management and valuation) and operational (including information technology (“IT”) infrastructure and software, personnel and human resources (“HR”) support, procurement and facilities management and transaction processing)14. In line with the FSB OCIR Guidance, the guidance in this chapter focuses on arrangements to support the continuity of essential services that are operational and transactional in nature and that can be reduced to enforceable contractual terms, rather than services that involve risk-taking or strategic judgement (e.g. certain parts of treasury or risk
9 Refer to section 4 of the FIRO.
10 Refer to section 8(1)(a) of the FIRO.
11 Refer to section 8(1) of the FIRO.
12 Refer to section 13(1) of the FIRO.
13 Refer to section 12(1) of the FIRO.
14 Refer to paragraph 2.3 of the FSB OCIR Guidance.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
5
management functions)15.
1.4 As part of its bilateral resolution planning programme, the HKMA expects an AI to be able to demonstrate that it has assessed the risks to OCIR and that appropriate arrangements to mitigate these risks (“OCIR arrangements”) are in place or being put in place.
The rest of this chapter provides guidance on the MA’s expectations regarding the matters that an AI should address when putting in place such arrangements and the MA’s approach to implementation. Section 2 explains the relationship between CFFs, essential services and preferred resolution strategies.
Section 3 describes the models typically adopted by AIs for provision of essential services. Section 4 discusses the matters an AI is expected to consider and address when putting in place OCIR arrangements. Section 5 sets out the MA’s approach to implementing these expectations.
1.5 If an AI does not meet the expectations set out in this chapter, the MA may form the opinion that a significant impediment in relation to OCIR exists to the orderly resolution of the AI. The MA may direct16 the AI to take any measures in relation to its structure (including group structure), operations (including intra-group dependencies), assets, rights or liabilities that are, in the opinion of the MA, reasonably required to remove or mitigate the effect of this impediment.
15 Refer to paragraph 2.4 of the FSB OCIR Guidance.
16 Refer to section 14 of the FIRO.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
6
2. CFFs, essential services and preferred resolution strategies
2.1 As explained in RA-2, the HKMA’s approach to resolution planning involves the setting of a preferred resolution strategy for an AI. In determining the preferred resolution strategy, the HKMA considers factors specific to an AI including information on the financial functions which it undertakes or provides; as well as dependencies (both internal and external) on services, the sudden and disorderly failure of which would present a serious impediment to the performance of CFFs. As set out in CI-1, the core information provided by an AI, which includes information on financial functions and dependencies, helps the MA to develop a preferred resolution strategy. The preferred resolution strategy determined for an AI sets out a presumptive path for the MA to secure an orderly resolution of the AI, thereby achieving the resolution objectives under the FIRO, including maintaining the continued performance of CFFs. Accordingly, the MA expects the OCIR arrangements put in place by an AI to be able to support the essential services necessary for the effective execution, if needed, of the preferred resolution strategy.
2.2 In the case of a large and complex AI, its size and complexity could make it difficult for a swift separation and transfer of CFFs over a resolution weekend. Also, given the systemic importance of such an AI, it is possible that a wider range of its financial functions are considered to be CFFs. Therefore, the preferred resolution strategy for such an AI will likely include application of the statutory bail-in stabilization option or a contractual loss
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
7
transfer17 to stabilise the AI as a whole (including any branches and/or downstream subsidiaries which are covered by its preferred resolution strategy). Such an AI should be able to demonstrate that its OCIR arrangements could support the continued performance of CFFs through the continuity of essential services during all stages of resolution and support any post- stabilization restructuring needs.
2.3 As specified in the FSB OCIR Guidance, options for divestment should be taken into account in planning for OCIR under any resolution strategy. While the actual business reorganization plan may only be confirmed at the time of resolution, for an AI with a preferred resolution strategy involving a whole bank bail-in, it is envisaged that restructuring may involve divesting and/or winding down legal entities and/or business lines (typical divestment options may include sale of business lines, assets, the AI or the resolution group it belongs to as a whole). The OCIR arrangements of such an AI should therefore be able to ensure the continued performance of CFFs through the continuity of essential services in different divestment scenarios.
2.4 For a smaller and simpler AI with a preferred resolution strategy involving application of a transfer stabilization option (either partial property transfer or whole bank transfer)18, the AI should be able to demonstrate that its OCIR arrangements could support the continued performance of CFFs through the continuity of essential services to the relevant businesses that are envisaged to be
17 Refer to paragraphs 2.21 – 2.23 of the Code of Practice chapter LAC-1, “Resolution Planning – LAC requirements” (“LAC-1”): https://www.hkma.gov.hk/media/eng/doc/key-functions/banking- stability/resolutions/LAC-1_Resolution_Planning-LAC_Requirements_ENG.pdf.
18 Refer to paragraph 2.18 of LAC-1.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
8
transferred under the preferred resolution strategy, and support any post-stabilization restructuring needs.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
9
3. Service delivery models
3.1 An AI typically receives essential services under one or some combination of the following four stylised models:
(a) Intra-entity model: essential services are provided within the AI itself, e.g. by a division or branch.
(b) Inter-entity model: essential services are provided by an AI’s group company19 that is not a service company. The term
“service company”, in the context of this chapter, refers to a separate legal entity dedicated to providing services to the other entities within the AI’s group.
19 Refer to section 2(1) of the FIRO.
AI’s group
AI
“In-house”
service provider
AI’s group
AI
Group company A
Group company B
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
10
(c) Intragroup service company model: essential services are provided by a service company within the AI’s group.
(d) Third party service provider model: essential services are provided by a third party service provider outside the AI’s group.
3.2 The appropriate design and implementation of OCIR arrangements should allow the expectations set out in this chapter
AI
Intragroup service company Group company B
AI’s group
Group company A
Third party service provider AI’s group
AI Group company A
Group company B
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
11
to be met regardless of the service delivery model, while some of the arrangements may be specific to, or vary according to, particular service delivery models, as indicated in the next section.
The MA does not intend to prescribe any specific service delivery model for OCIR purposes. It is for an AI to determine the service delivery model or combination of models that is appropriate to maintain essential services for its business and operations, provided the expectations in this chapter are met. References in this chapter to the service delivery model adopted by an AI mean one, or some combination, of the abovementioned four service delivery models.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
12
4. OCIR arrangements and matters to be addressed
4.1 The MA expects an AI to assess the risks to OCIR in the context of its preferred resolution strategy, including any risks posed by its particular service delivery model(s), on an ongoing basis and to be able to demonstrate during the bilateral resolution planning programme that the measures it has taken or is taking sufficiently address any risks identified. The following paragraphs set out the matters20 that the MA expects an AI to consider when assessing OCIR risk and the arrangements an AI is generally expected to put in place to address these.
(1): Contracts and service level agreements
4.2 An AI should ensure that contracts and intragroup service level agreements (“SLAs”) underpinning the provision of essential services cannot be terminated, amended or suspended by the service providers solely as a result of entry into resolution of the AI or any of its group companies and that the terms are clear, comprehensive and in writing. Such contracts and SLAs include (but are not limited to) contracts and SLAs for services or products, software license agreements as well as property and equipment leases.
4.3 To this end, contracts and SLAs underpinning the provision of essential services under the inter-entity, intragroup service company and third party service provider models should include terms (hereinafter referred to as “resolution-proof” terms) which
20 These reflect the FSB OCIR Guidance.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
13
achieve the following outcomes for an AI:
(a) securing the continued provision of essential services in resolution, during both the stabilization and restructuring phases, with no adjustment to the terms and conditions on which the services are provided solely as a result of entry into resolution of the AI or any of its group companies, provided that there is no default in payment obligations under the contracts; and
(b) providing for the transfer, assignment or novation of the contract or SLA to enable essential services to be transferred by the service recipient to a different recipient or to be provided by a different service provider as needed.
Such “resolution-proof” terms do not preclude the termination of a contract or SLA upon the maturity/termination date previously and mutually agreed by all signing parties of the contract or SLA.
4.4 To facilitate the continued performance of CFFs in the restructuring phase in a resolution, it is necessary that “resolution- proof” terms could secure the continued provision of essential services to an AI and other group companies in a resolution on substantively the same terms as in business-as-usual (“BAU”) for a reasonable period of time after the stabilization phase, notwithstanding any disposal, transfer or any other restructuring actions taken in respect of the AI or any of its group companies.
Such terms should also provide for essential services to be transferred to a transferee in the event of the original service recipient entity, or the businesses representing CFFs, being transferred, divested or taken over (e.g. in the cases of transfer to a bridge institution or third party purchaser).
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
14
4.5 The MA expects the contracts and SLAs underpinning the provision of essential services to be in writing and contain the information below, at a minimum:
(a) description and performance standards of services provided;
(b) service providers, service recipients and authorised users as well as the jurisdictions in which they are incorporated respectively (distinguishing between group-wide contracts and single legal entity contracts);
(c) nominal value of the contract, guarantees21 (if any), expiry date;
(d) pricing structure (refer to sub-section (2) on “Pricing structure” for further details);
(e) governing law (including the law governing dispute resolution);
(f) the parties’ rights and obligations, including those relating to termination, assignment and transfer, change of control, events of default, cure periods and material adverse change;
(g) arrangements for onward provision of essential services to other entities or sub-contracting (where applicable);
(h) arrangements to extend services to an acquirer of the entity that originally receives such services (where applicable);
and
(i) outsourcing arrangements, including system/software
21 This refers to any guarantee provided as part of the contract terms. Examples of such guarantee include (but are not limited to) a payment guarantee provided by a group company of the service recipient and a performance guarantee provided on the services delivered under a contract.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
15
support arrangements (where applicable).
4.6 The MA may request an AI to seek a sufficiently independent legal opinion (preferably from an external law firm) on the effectiveness and enforceability of the “resolution-proof” terms, as part of the bilateral resolution planning programme with the AI. For contracts and SLAs entered into under the inter-entity, intragroup service company and third party service provider models, the legal opinion should cover whether the “resolution-proof” terms are enforceable in accordance with the articles of association of the service companies, the governing law of the contract and SLA as well as the law of the respective jurisdictions in which they are located. AIs should monitor contracts and SLAs that underpin essential services to ensure that they contain, and continue to contain throughout their term, effective and enforceable
"resolution-proof" terms.
4.7 For essential services provided under the intra-entity model, in respect of which there is no separate legal entity providing the services and therefore no contracts, an AI should nonetheless document such services with sufficiently granular details (including, but not limited to, the division or branch which provides services and the division or branch which receives services, a description of services provided, performance standards and cost structure) to facilitate the creation of transitional service agreements (“TSA”)22 in a timely manner in the restructuring phase.
22 A TSA refers to a contract between the two parties in a transfer or divestment scenario, that requires the transferor/seller to continue to provide certain services to the purchaser of the business, following the legal separation of that business from the transferor/seller.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
16
4.8 An AI is expected to ensure that the continued provision of essential services is not hindered by any organisational structures and/or agreements. In the case where an intragroup service provider23 provides the same service to more than one recipient within the AI’s group on substantively the same terms, the relevant contracts/SLAs should ensure that the intragroup service provider continues to provide the AI with the essential services in accordance with the terms and conditions of the contracts/SLAs in the lead up to and during resolution.
(2): Pricing structure
4.9 Essential services should be charged on a predictable and transparent basis. Pricing for essential services provided under the inter-entity or the intragroup service company model should be structured on an arm’s length basis. In addition, the pricing structure should not alter solely as a result of entry into resolution of an AI or any of its group companies.
4.10 In the case of an AI receiving essential services from a group company under the inter-entity model, should the service provider be divested in resolution (i.e. such that the service provider is no longer a group company of the AI), a contract or SLA that is priced on the basis set out in the preceding paragraph should have the advantage of facilitating the transition from an inter-entity service provider to a third party service provider by readily forming the basis of an external contract. The MA expects an AI to evidence the robustness of the service pricing methodology adopted, for
23 In the context of this chapter, an intragroup service provider refers to a service provider under either the inter-entity model or intragroup service company model.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
17
example by reference to external guidance (e.g. OECD Transfer Pricing Guidelines24), market research or industry study. The robustness of the methodology should also be monitored on an on-going basis.
(3): Management information systems
4.11 An AI should conduct a comprehensive mapping of all essential services (and any other services necessary to support the preferred resolution strategy) it receives by CFF as well as by entity, core business line and product and service25 (referred to as “service mapping” in this chapter). If an AI’s preferred resolution strategy, as determined with regard to the resolution objectives including maintaining the continued performance of CFFs, covers any of its branches and/or downstream subsidiaries, the mapping should also capture the essential services such branches and/or downstream subsidiaries receive by jurisdiction and branch/subsidiary, as well as by CFF, core business line and product and service as aforementioned.
4.12 Apart from direct dependencies, service mapping should also capture any indirect dependencies on which an AI relies in receiving essential services. For example, if an AI is receiving essential services provided by an intragroup service company and that service company is relying on a number of third party service providers for providing such services, then the service mapping should also capture the dependencies between the intragroup
24 https://www.oecd.org/tax/transfer-pricing/oecd-transfer-pricing-guidelines-for-multinational- enterprises-and-tax-administrations-20769717.htm
25 Refer to paragraph 3.5.2 and Annex 1 of CI-1.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
18
service company and the immediate relevant third party service providers.
4.13 The information underpinning the service mapping should be organised in systems or portals (referred to as “service catalogue”
in this chapter) in an accessible and searchable form, e.g. a central data repository or several linked repositories. The service catalogue should provide an AI with reporting capability to readily produce management information on essential services in a flexible manner (for example, information on operational dependencies may be retrieved by different aspects such as individual service recipient entity, product and service, service provider or operational asset).
4.14 An AI’s service catalogue should include, at a minimum, the information below for each of the essential services received:
(a) description of service provided and performance standards;
(b) service provider(s), recipient(s), authorised user(s) and their respective jurisdictions of incorporation and, in the case of service provider(s), the jurisdiction(s) from which the service is provided;
(c) service delivery model used;
(d) underlying contract/SLA or link to contract/SLA if it is located in another system or portal (if applicable);
(e) internal and external infrastructure used (both directly and indirectly), including financial market infrastructure (“FMI”)26;
26 Continued access to FMI services is not covered by the expectations set out in this chapter save in relation to service mapping. The reason for capturing dependencies on FMIs in service mapping is primarily for completeness in documenting an AI’s operational dependencies.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
19
(f) ownership and location of essential operational assets (refer to sub-section (6) on “Rights of use of and access to operational assets” for further details);
(g) for intragroup service providers, identification of critical operational staff including their locations, employing entities and employment terms including retention clauses (if any) (refer to sub-section (5) “Operational resilience in resolution”
for further details);
(h) pricing structure (refer to sub-section (2) on “Pricing structure” for further details); and
(i) alternative service providers and the estimated timeline required to switch to alternative providers (where available).
4.15 Information in the service catalogue should be kept up-to-date, with a robust governance and control framework in place to ensure data quality, including its accuracy, integrity, completeness and reliability. The service catalogue and the associated governance and control framework should enable the information to be reliably retrieved and accessed by the service recipients in a contingency planning or resolution scenario.
Operational procedures and governance process should be in place to grant access rights to the MA or any third parties appointed by the MA to an AI's management information systems as required in a timely manner.
4.16 In order to facilitate the creation of TSA in a resolution to support continuity of essential services under different divestment options in a timely manner, the service catalogue should have the capability to provide sufficient granularity of information that may be required in a TSA.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
20
(4): Financial resilience
4.17 An AI should consider whether its service providers have sufficient financial resilience to continue providing essential services to the AI in resolution as well as its own capabilities to estimate and pay for such services.
AI’s ability to pay for essential services
4.18 An AI should have adequate capabilities to monitor and estimate its liquidity needs for paying for essential services in resolution, and ensure that there are sufficient financial resources readily available to meet the cost of essential services in both the stabilization and restructuring phases in resolution taking into account the preferred resolution strategy.
4.19 It is expected that the assessment should take into consideration, at a minimum, the following information to which the AI should have ready access:
(a) the costs of receiving essential services, priced on an arm’s length basis;
(b) payment arrangements (pre-payment vs. accrual, payment frequency, etc.); and
(c) any relevant additional costs expected during resolution, for example, the costs of retaining critical operational staff (refer to sub-section (5) “Operational resilience in resolution” for further details).
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
21
Financial resilience of service providers
4.20 In the case of inter-entity, intragroup service company and third party service provider models, in line with the Supervisory Policy Manual module SA-2 “Outsourcing”27, before selecting a service provider, an AI should perform appropriate due diligence on, among other factors, the financial soundness of the provider.
The AI should regularly review the financial condition of such a provider in BAU. For intragroup service providers, an AI is expected to put in place appropriate arrangements for ensuring that such entities have sufficient and readily available resources to enable them to continue to provide the essential services required by the AI during the stabilization and restructuring phases. Such arrangements should address any potential obstacles to the ready availability and deployment of funds from within the AI’s group, including cross-border issues. In addition, an AI should also identify alternative service provider(s) during BAU and estimate the time required for switching to such alternative provider(s) should it become necessary.
(5): Operational resilience in resolution
4.21 Essential services should be operationally resilient in resolution.
The arrangements and operational capabilities and capacities that may be needed to maintain operational resilience in resolution and support OCIR are expected to include, but are not limited to:
(a) Contingency arrangements to support OCIR during the
27 https://www.hkma.gov.hk/media/eng/doc/key-functions/banking-stability/supervisory-policy- manual/SA-2.pdf
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
22
stabilization and restructuring phases: as set out in the FSB OCIR Guidance, any service delivery model used by an AI should support business separability and restructuring, even if its preferred resolution strategy aims to keep the group largely intact. As restructuring may involve a separation of an AI’s group and divestment of certain intragroup entities which may also be an AI’s intragroup service providers, the AI and its intragroup service providers should identify adequate contingency arrangements to support OCIR in such a scenario. These contingency arrangements should also address any interdependencies among the service providers. For instance, an intragroup service company may have operational dependencies on another intragroup entity (e.g. for system infrastructure or operational support such as that provided by HR or the finance function). An AI should consider how to address such dependencies in a scenario where the abovementioned intragroup entity is divested in the restructuring phase. Appropriate contingency arrangements (e.g. identification of substitute providers) should be put in place where possible. The contingency arrangements should also address the necessary supporting capabilities including capabilities to make information available in a timely manner for due diligence, to prepare TSA, to establish information barriers between the entities and/or business lines/assets being divested and the rest of the group as well as capabilities for segregating the data relevant for the divestment (both client data and operational data as necessary) and transferring such data in a required format to a third party purchaser, taking into account interoperability and portability of data.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
23
(b) For intra-entity, inter-entity and intragroup service company models, appropriate arrangements for maintaining sufficient human resources and expertise to provide essential services:
in particular, operational staff members who are critical for the performance of essential services should be identified.
A detailed strategy for retaining critical operational staff in resolution, and on-boarding replacements if necessary, should be developed, including consideration of their notice period, the estimated additional costs for staff retention and alternative arrangements, if required (e.g. through outsourcing). Information should be available in a timely manner on their locations, employing entities, employment terms and retention plan.
(c) Development and maintenance of OCIR playbook(s): AIs should develop and maintain an OCIR playbook (or playbooks, as the case may be) that describes with sufficient granularity the actions and steps that are required in order to facilitate OCIR. Relevant staff members at both management and operational levels should be well informed of the procedures set out in the playbook(s). Such playbook(s) should be tested regularly and updated with lessons learned from the tests. OCIR playbook(s) should address the following at a minimum:
(i) the governance and management oversight in relation to OCIR;
(ii) for essential services provided under intra-entity, inter- entity and intragroup service company models, key actions and operational steps to be taken following the entry into resolution by both the operational staff and
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
24
management of the service providers;
(iii) guidance on the abovementioned contingency arrangements as well as how to manage the transition from BAU to operating in contingency planning, stabilization and restructuring phases; and
(iv) communication arrangements with the relevant internal and external stakeholders. Examples of external communication include alerting the MA to incidents which may threaten OCIR, and communication with third party service providers as regards continued payment to help manage the risk of early termination of essential services provided by them.
4.22 The MA expects an AI to assess and mitigate the risks to operational resilience in resolution that may be posed by the technologies it employs and the service delivery model it adopts.
For example, consideration should be given to how, where and on what terms critical data are held so that data can continue to be managed and retrieved in a timely manner in resolution. As identified in the FSB’s report Third-party dependencies in cloud services – Considerations on financial stability implications28, resolution authorities may have difficulties when exercising step- in rights in resolution if critical bank data systems are held in third- party systems. Poorly designed public cloud solutions or weak management of a supplier’s service level agreements, lacking technical and legal provisions for extreme situations, could also make the resolution process extremely difficult and hinder OCIR.
28 https://www.fsb.org/wp-content/uploads/P091219-2.pdf
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
25
(6): Rights of use of and access to operational assets
4.23 The MA expects an AI to secure and maintain the rights of use of, as well as timely access to, assets that are required for OCIR (“essential operational assets”). Essential operational assets include (but are not limited to) real estate, IT infrastructure and systems, intellectual property, data, licences and leases in relation to the provision of essential services. These operational assets should be identified and clearly documented, including information on their ownership, locations, access rights, as well as the terms and conditions for their use and access.
Arrangements to secure and maintain rights of use and timely access should also include rights to any relevant operational information and documentation which are available to an AI in BAU and may be required to maintain essential services in resolution. An AI should identify potential legal or practical obstacles to maintaining use of, and access to, essential operational assets in resolution which may arise, for example, out of the ownership or location of the assets or the terms of the relevant contract. An AI should take measures to address such obstacles which may include, for example, incorporating
“resolution-proof” terms in relevant contracts or arranging for the AI to own the essential operational assets.
4.24 To support an orderly resolution of an AI, the MA and certain third parties appointed by the MA to assist the MA in discharging his functions, may require the rights of use of and/or access to certain essential operational assets in the lead up to and during resolution.
The AI should have appropriate arrangements in place, including operational procedures and approval processes, to grant the relevant rights to the MA and the above parties as required in a
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
26
timely manner.
4.25 AIs should take into consideration the specific nature of the operational assets and the service delivery model when considering the arrangements required for ensuring rights of use and access. For example, arrangements to ensure access to an in-house on-premises database will be different from those required for a cloud database provided by a third party service provider. Particular attention should also be given to identify and address any uncertainties over the legal obligations of third-party service providers operating on a cross-border basis regarding access to and use of data under contracts governed by foreign law when the financial viability of the AI concerned is under threat.
(7): Governance and management oversight
4.26 OCIR arrangements should be properly managed and governed both in BAU and in resolution. A dedicated governance framework with sufficient management oversight should be in place to ensure the continued provision of essential services to an AI. Furthermore, an AI should ensure that:
(a) For intra-entity, inter-entity and intragroup service company models, the service providers themselves have in place a dedicated governance framework with sufficient management oversight to ensure the continued provision of essential services.
(b) For the intragroup service company model, OCIR arrangements form part of the responsibilities of the board of directors and management of the service company.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
27
(c) Contingency arrangements are in place to ensure that essential services continue to be provided in resolution without relying on senior staff members from certain business lines that may be wound down or that may no longer form part of the same group.
(d) Where a staff member responsible for overseeing the provision of essential services has competing responsibilities within the group, his/her responsibilities in resolution are prioritised in a way that facilitates the provision of essential services.
4.27 Governance and assurance processes are critical to ensuring OCIR. An AI should be able to explain to the HKMA how its governance and assurance processes ensure that it meets the MA’s expectations on OCIR. For the effective implementation of these expectations, an AI is expected to assign an officer of appropriate seniority with accountability for overseeing, as well as ensuring that the board of directors of the AI is kept adequately informed of, the effective implementation of the MA’s expectations on OCIR. The assigned officer should also ensure that the board of directors of the AI is sufficiently informed of the procedures and responsibilities of the board set out in the OCIR playbook(s) as referred to in paragraph 4.21.
4.28 More broadly, an AI is expected to ensure that its governance and assurance processes enable the ongoing effectiveness of its implementation of the MA’s expectations on OCIR and are embedded into its overarching governance and organisational arrangements in place to support the HKMA’s resolution planning process pursuant to RA-2. To this end, the relevant processes
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
28
and arrangements should also support effective, forward-looking decision making and timely action by senior management, the board of directors or relevant authorities in the lead up to and during resolution.
4.29 When putting in place appropriate governance and management oversight for OCIR arrangements, an AI should also be mindful of any potential tension between such arrangements and the governance of its business operations during BAU. An AI should raise any potential issues in that regard with the HKMA for discussion in a timely manner.
4.30 An AI should ensure continuous compliance with applicable laws, regulations and supervisory requirements when implementing OCIR arrangements. If an AI envisages that any OCIR arrangement to be put in place (whether during BAU or when activated in resolution) would result in non-compliance with any provision of the Banking Ordinance or a supervisory requirement, it should raise such matter at the earliest opportunity for discussion with the HKMA’s supervisory and resolution case teams.
4.31 AIs should be aware that, notwithstanding the substantial correlation and parallels between operational continuity in BAU and in resolution, OCIR arrangements aim to address specific risks to operational continuity in a resolution scenario. It cannot be assumed that the measures for meeting the expectations in this chapter and those in supervisory policies on Business Continuity Planning (such as the Supervisory Policy Manual module TM-G-2 “Business Continuity Planning”29) are identical
29 https://www.hkma.gov.hk/media/eng/doc/key-functions/banking-stability/supervisory-policy-
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
29
and a separate analysis should be carried out for resolution purposes.
manual/TM-G-2.pdf
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
30
5. The MA’s approach to implementation
5.1 In line with the MA’s proportionate and risk-based approach to resolution planning which prioritises all Domestic Systemically Important Authorized Institutions and other locally incorporated AIs with total consolidated assets of more than HKD 150 billion30, the MA intends likewise to prioritise implementation of OCIR arrangements by these AIs through resolution planning and resolvability assessment (including the removal of impediments to orderly resolution). The MA would typically expect to engage an AI in the resolution planning process31 (if not already engaged) before requesting the AI to demonstrate the adequacy of its OCIR arrangements.
5.2 Given the relationship between CFFs, essential services and the preferred resolution strategy, the MA expects to first require an AI (if not already required) to submit core information (as specified in CI-1) with a view to enabling the MA to determine a preferred resolution strategy for the AI taking into consideration its CFFs, operational dependencies32 and other relevant matters33.
5.3 The HKMA expects to discuss the detailed implementation timeline for putting OCIR arrangements in place with each individual AI as part of the bilateral resolution planning programme, taking account of all relevant considerations including the nature, scale and complexity of the AI and its CFFs and essential services, the status of its existing OCIR arrangements, and the resolution
30 Refer to LAC-1.
31 Refer to part 8 of RA-2.
32 Refer to section 3.4 of CI-1.
33 Refer to part 4 of RA-2.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
31
objectives.
5.4 The development and putting in place of adequate OCIR arrangements by an AI will be an iterative process between the HKMA and the AI as part of the bilateral resolution planning programme. As a starting point, an AI is expected to identify CFFs and essential services and evaluate the potential risks to OCIR in the context of its preferred resolution strategy and service delivery model as well as to conduct a self-assessment against the expectations set out in this chapter. The AI is then expected to develop a work plan (including a detailed timeline) for putting in place OCIR arrangements, regularly self-assess its progress and keep the HKMA informed of progress as part of the bilateral resolution planning programme. In assessing its progress, an AI may consider conducting internal and/or external audit review on the adequacy of its OCIR arrangements.
5.5 The MA will assess the adequacy of the OCIR arrangements of each individual AI in the context of its preferred resolution strategy and its service delivery model during the bilateral resolution planning programme. The MA may require submission of information, records or documents in relation to an AI’s OCIR arrangements to assess the effectiveness of the AI’s strategy for putting in place OCIR arrangements and overall OCIR capabilities.34
5.6 For AIs that are part of a cross-border group operating in Hong Kong, the MA works closely with relevant authorities on resolution planning through Crisis Management Groups and other cross- border resolution planning forums. Such work includes
34 The MA may impose such a requirement pursuant to section 158 of the FIRO.
Resolution Regime – Code of Practice OCIR-1 Resolution Planning –
Operational Continuity in Resolution
05.11.2021
32
developing preferred resolution strategies that have been devised on a group-wide basis, including their operations in Hong Kong, as well as ensuring appropriate arrangements are put in place to support the effective implementation of preferred resolution strategies if needed. This cooperation includes agreeing actions that an AI is expected to take to ensure OCIR in the context of its group-wide service delivery model. The MA may take this into consideration in assessing the adequacy of the AI’s OCIR arrangements and whether a significant impediment exists to the orderly resolution of the AI in accordance with a non-Hong Kong resolution plan (to the extent that the non-Hong Kong resolution plan has been adopted by the MA). Nevertheless, the expectations in this chapter apply to the AI regardless of whether the group is subject to, and meets, similar OCIR standards in other jurisdictions.
