Leading Independent Hong Kong Law Firm

Guideline on Authorization of Digital Banks

Oct 25, 2024
Latest News HKMA Guideline on Authorization of Digital Banks

On 25 Oct 2024, the HKMA issued revised guidelines replacing its 2018 Virtual Banks Guideline, establishing a regulatory framework for digital banks. The framework mandates local incorporation, strict ownership controls via HK holding companies for non-financial applicants, and requires pre-launch IT security assessments, mandatory exit plans, and prohibitions on minimum balance fees. It adapts conventional bank supervision to digital business models while emphasizing customer protection and financial stability.

This article was generated using SAMS, an AI technology by Timothy Loh LLP.

Introduction

On 25 Oct 2024, the Hong Kong Monetary Authority (HKMA) issued revised Guideline on Authorization of Digital Banks, superseding the previous 'Guideline on Authorization of Virtual Banks' (2000, 2012, 2018). The Guideline establishes the regulatory framework for authorizing digital banks defined as institutions delivering banking services exclusively or primarily through electronic channels.

Core Authorization Requirements

The Guideline mandates that digital bank applicants must satisfy the minimum criteria under the Seventh Schedule to the Banking Ordinance. Applicants must demonstrate tangible substance through a credible business plan, avoid being a mere 'concept', and ensure ongoing compliance with authorization criteria. Digital banks must actively promote financial inclusion, refrain from imposing minimum account balances or low-balance fees, and manage credit, liquidity, and interest rate risks equally with technology risks.

Ownership and Structure

Digital banks must operate as locally-incorporated entities. The HKMA requires that entities holding >50% share capital be supervised financial institutions or hold digital banks via a locally-incorporated intermediate holding company with strict supervisory conditions. These conditions cover capital adequacy, liquidity, risk management, and group structure. This allows both financial and non-financial firms (e.g., technology companies) to apply, provided they meet the holding company requirements.

Operational and Risk Management

Digital banks will face the same supervisory requirements as conventional banks but adapted for their technology-driven models. They must maintain a physical presence in Hong Kong as their principal place of business. Technology risk management requires pre-launch independent IT security assessments by qualified experts, with reports submitted to the HKMA. Risk management must cover all eight categories in the HKMA's framework, with particular emphasis on operational, liquidity, and reputation risks amplified by digital operations.

Customer Protection and Exit Planning

Digital banks must adhere to the Treat Customers Fairly Charter and Code of Banking Practice, with clear terms and conditions outlining rights and obligations. Customers will not bear liability for losses from security breaches unless fraudulent or grossly negligent. The Guideline mandates a detailed exit plan covering triggers, authority, depositor repayment channels, and funding sources to ensure orderly business unwinding without disrupting customers or the financial system.

Additional Regulatory Provisions

Outsourcing to third parties is permitted but requires prior HKMA discussion and compliance with the SPM module on Outsourcing (SA-2). The HKMA must retain inspection rights over service providers and ensure outsourcing does not hinder its supervisory powers. Digital banks must maintain capital commensurate with operational risks and adhere to all applicable data privacy and confidentiality requirements.

View the full article:Source

We use cookies to enhance your experience of our websites and to enable you to register when necessary. By continuing to use this website, you agree to the use of these cookies. For more information and to learn how you can change your cookie settings, please see our Cookie Policy and our Privacy Notice.