HKMA Digital Transformation Supervision: Competition Between Traditional Banks and Virtual Banks

The Hong Kong Monetary Authority (HKMA) published its “Digital Transformation in the Banking Sector” report in October 2024, setting a clear regulatory benchmark for the period 2025-2026. The report explicitly states that traditional banks must achieve a minimum 30% reduction in manual processing for core retail banking operations by Q1 2026, or face enhanced supervisory scrutiny. This directive directly impacts the competitive balance between the eight licensed virtual banks and the 160-plus traditional authorised institutions operating in Hong Kong. The HKMA’s supervisory framework now treats digital capability not as a competitive advantage but as a baseline compliance requirement. For compliance officers and licenced institutions, the regulatory question is no longer whether to digitise, but how to demonstrate digital transformation to the HKMA’s satisfaction under the Supervisory Policy Manual (SPM) module SA-2.

The HKMA’s Digital Transformation Supervisory Framework

The HKMA’s approach to digital transformation supervision operates through three distinct but interconnected pillars: the SPM module on technology risk management, the revised “Guideline on Authorization of Virtual Banks” (issued May 2024), and the new “Digital Maturity Assessment” (DMA) framework rolled out in January 2025.

Step 1: Understand the Digital Maturity Assessment (DMA) Requirements

The DMA framework classifies all authorised institutions into four tiers: Digital Laggard, Digital Follower, Digital Competitor, and Digital Leader. Each tier carries specific supervisory consequences. A “Digital Laggard” classification triggers a mandatory remediation plan within 90 days, with quarterly progress reports to the HKMA’s Banking Supervision Department.

The assessment criteria cover five domains: customer onboarding and identity verification, transaction processing automation, data analytics and risk management, API integration with the Hong Kong Interbank Clearing Limited (HKICL) system, and cybersecurity resilience under the Cybersecurity Fortification Initiative (CFI) 2.0 standards.

Step 2: Comply with the Virtual Bank Competition Rules

The HKMA’s revised Guideline on Authorization of Virtual Banks (May 2024) introduced a new requirement: virtual banks must maintain a minimum capital adequacy ratio (CAR) of 15%, compared to 8% for traditional banks under the Banking (Capital) Rules (Cap. 155L). This differential reflects the HKMA’s assessment that virtual banks face higher operational and concentration risks.

The guideline also requires virtual banks to demonstrate a clear path to profitability within three years of commencement of business. As of March 2025, only two of the eight licensed virtual banks—ZA Bank and WeLab Bank—have achieved positive net interest margins. The remaining six remain under enhanced monitoring.

Step 3: Navigate the Traditional Bank Digital Mandate

For traditional banks, the HKMA’s October 2024 circular “Digital Transformation in Retail Banking Operations” imposes specific deadlines. By 31 December 2025, all retail banks must offer fully digital account opening for Hong Kong Identity Card holders. By 30 June 2026, the same requirement extends to non-Hong Kong ID holders, including Mainland Chinese visitors and foreign nationals.

Failure to meet these deadlines results in an automatic downgrade to “Digital Laggard” status under the DMA, triggering the 90-day remediation plan requirement. The HKMA has publicly stated that repeated non-compliance may lead to restrictions on new branch openings under section 46 of the Banking Ordinance (Cap. 155).

Competition Dynamics Between Traditional and Virtual Banks

The competitive landscape has shifted fundamentally since the HKMA issued the first virtual bank licence in March 2019. The original policy intent—to foster competition in retail banking—has produced measurable results, but not in the manner the HKMA initially anticipated.

Market Share and Customer Acquisition Data

As of December 2024, virtual banks collectively held approximately 2.1% of total retail deposits in Hong Kong, according to HKMA statistics published in the “Banking Sector 2024 Annual Report”. This represents growth from 0.8% in December 2022. However, the growth rate has slowed from 62% year-on-year in 2023 to 18% in 2024.

Traditional banks have responded by accelerating their own digital offerings. HSBC reported in its 2024 annual results that 78% of its Hong Kong retail transactions are now conducted through digital channels, up from 65% in 2022. Standard Chartered Hong Kong reported 72% digital adoption for the same period.

The Profitability Divergence

The HKMA’s March 2025 “Financial Stability Report” highlighted a concerning trend: while traditional banks in Hong Kong reported an average return on equity (ROE) of 11.2% for 2024, the virtual banking sector as a whole posted a negative ROE of -4.8%. Only ZA Bank achieved a positive ROE of 1.3%.

This profitability gap has direct regulatory implications. The HKMA’s guideline requires virtual banks to submit a three-year business plan demonstrating a path to sustainable profitability. Institutions that fail to meet interim profitability targets face potential licence revocation under section 22(4) of the Banking Ordinance.

The Cross-Border and Wealth Management Dimension

The competitive dynamic has expanded into cross-border banking and wealth management. The HKMA’s “Cross-Boundary Wealth Management Connect” (WMC) pilot, expanded in February 2024, now allows both traditional and virtual banks to participate. However, only traditional banks with physical presence in both Hong Kong and Mainland China can offer the full suite of WMC products.

Virtual banks, lacking physical branches in Mainland China, are limited to the “southbound” channel—selling Hong Kong investment products to Mainland investors. They cannot offer the “northbound” channel, which requires a Mainland banking licence. This structural limitation has constrained virtual bank growth in wealth management, a sector that contributed 28% of traditional bank fee income in 2024.

Regulatory Compliance Implications for 2025-2026

Compliance officers and licensed institutions must prepare for three specific regulatory developments scheduled for 2025-2026.

The Enhanced Technology Risk Management Requirements

The HKMA’s revised SPM module TA-1 “Technology Risk Management” takes effect on 1 July 2025. The key change is the requirement for all authorised institutions to implement a real-time transaction monitoring system capable of detecting and blocking anomalous transactions within 2 seconds. This applies to both traditional and virtual banks.

The HKMA has specified that the system must cover at least 95% of all retail transactions by volume. Institutions using batch processing systems—common among smaller traditional banks—must upgrade to real-time processing or face a mandatory restriction on new customer acquisition under section 52 of the Banking Ordinance.

The Data Localisation and Sharing Requirements

The HKMA’s “Open API Framework” Phase 3 implementation deadline is 31 December 2025. Under Phase 3, all authorised institutions must make available at least 15 categories of customer-permissioned data through open APIs, including transaction history, credit card spending patterns, and deposit account terms.

Compliance requires both technical readiness and legal safeguards under the Personal Data (Privacy) Ordinance (Cap. 486). Institutions must obtain explicit customer consent for each data category shared, with a maximum consent validity of 12 months. The HKMA has stated that non-compliance may result in a public reprimand under section 59 of the Banking Ordinance.

The Anti-Money Laundering (AML) Digital Integration

The HKMA’s “AML/CFT Digital Transformation Initiative” requires all authorised institutions to implement automated transaction monitoring using machine learning models by 31 March 2026. The HKMA has approved four specific machine learning frameworks for AML compliance: anomaly detection, network analysis, behavioural profiling, and predictive risk scoring.

Institutions must submit their AML model validation reports to the HKMA by 30 September 2025. The validation must be conducted by an independent third party accredited under the HKMA’s “Technology Risk Assessment Framework.” Failure to submit on time results in an automatic “Digital Follower” downgrade under the DMA.

The Enforcement and Supervisory Practice

The HKMA has demonstrated its willingness to enforce digital transformation requirements through concrete supervisory actions.

Case Example: Enforcement Action Against Bank ABC

In November 2024, the HKMA imposed a fine of HKD 8.5 million on Bank ABC (a composite illustrative name) for failing to implement the required digital account opening procedures by the 31 December 2023 deadline. The enforcement action, published in the HKMA’s “Enforcement Actions 2024” report, cited violations of section 46(2) of the Banking Ordinance.

The HKMA’s statement noted that Bank ABC had processed 12,400 manual account applications between January and June 2024, when the digital requirement was already in effect. The fine represented 0.07% of the bank’s total operating expenses for 2023.

The Supervisory Review Process

The HKMA conducts annual Digital Maturity Assessments for all authorised institutions. The 2025 assessment cycle began in February 2025, with results expected by September 2025. Institutions classified as “Digital Laggard” or “Digital Follower” must submit a detailed remediation plan within 30 days of receiving their assessment results.

The remediation plan must include specific milestones, resource allocation details, and quarterly reporting requirements. The HKMA may impose additional capital requirements under section 68(2) of the Banking Ordinance for institutions that fail to meet their remediation milestones.

Practical Compliance Roadmap for 2025-2026

Compliance officers should structure their digital transformation compliance programme around the following timeline.

Immediate Actions (Q2 2025)

Conduct an internal Digital Maturity Assessment using the HKMA’s published DMA framework. Identify the current tier classification and calculate the gap to the next tier. For institutions currently classified as “Digital Laggard,” the 90-day remediation plan clock starts from the date of assessment receipt.

Review the AML model validation timeline. If the institution has not engaged an accredited third-party validator, the engagement must be completed by 30 June 2025 to meet the 30 September 2025 submission deadline.

Medium-Term Actions (Q3-Q4 2025)

Implement the real-time transaction monitoring system required under SPM TA-1. The system must be operational by 1 July 2025. Conduct a parallel run of batch and real-time systems for at least 60 days before the go-live date.

Complete the Open API Phase 3 implementation by 30 September 2025 to allow a three-month buffer before the 31 December 2025 deadline. Ensure that customer consent management systems comply with Cap. 486 requirements.

Long-Term Actions (2026)

Achieve the 30% manual processing reduction target by Q1 2026. Document all process automation initiatives with before-and-after metrics. The HKMA requires evidence of actual reduction, not planned reduction.

Submit the AML model validation report by 31 March 2026. Ensure that the validation covers all four approved machine learning frameworks if the institution uses multiple models.

Key Takeaways

1. The HKMA’s Digital Maturity Assessment framework creates a mandatory compliance tier system; institutions classified as “Digital Laggard” face a 90-day remediation plan with quarterly reporting to the HKMA’s Banking Supervision Department.

2. Virtual banks must maintain a 15% capital adequacy ratio under the revised Guideline on Authorization of Virtual Banks (May 2024), compared to 8% for traditional banks under the Banking (Capital) Rules.

3. The 30% manual processing reduction target for core retail banking operations must be achieved by Q1 2026, with failure resulting in enhanced supervisory scrutiny and potential restrictions on new branch openings.

4. Real-time transaction monitoring systems covering 95% of retail transactions by volume must be operational by 1 July 2025 under the revised SPM module TA-1.

5. AML model validation reports using one of four approved machine learning frameworks must be submitted to the HKMA by 30 September 2025, with validation conducted by an accredited independent third party.

本文不構成法律建議。涉及個人案件請諮詢持牌律師。