HKMA Supervisory Powers: On-Site Examinations and Off-Site Monitoring of Authorised Institutions

In February 2025, the Hong Kong Monetary Authority (HKMA) issued a supervisory circular reminding all authorised institutions (AIs) that its on-site examination programme for 2025-2026 would place a heightened focus on technology risk management, third-party outsourcing, and anti-money laundering (AML) controls. This follows the HKMA’s publication of its Annual Report 2024, which recorded 47 on-site examinations conducted in the previous year, a 12% increase from 42 in 2023. The shift reflects the regulator’s response to a surge in cyber incidents and cross-border financial crime, as well as the rapid adoption of generative AI tools by banks. For compliance officers and senior management at AIs, understanding the difference between on-site examinations and off-site monitoring is no longer optional — it is a licence-critical obligation. The HKMA’s statutory powers under the Banking Ordinance (Cap. 155) allow it to enter premises, demand documents, and interview staff without prior notice. Failure to comply can result in enforcement actions, including licence revocation. This article sets out the legal framework, procedural steps, and practical implications for AIs subject to HKMA supervision.

The Statutory Basis for HKMA Supervisory Powers

The HKMA derives its supervisory authority primarily from the Banking Ordinance (Cap. 155). Section 59(1) empowers the HKMA to appoint an examiner to investigate the affairs of any AI. Section 60(1) grants the power to require an AI to produce books, accounts, and other documents. Section 63 provides the power to enter premises without a warrant where there is reasonable cause to believe that an offence under the Ordinance has been committed.

On-Site Examinations: Scope and Procedure

An on-site examination is a physical or virtual visit by HKMA examiners to an AI’s premises. The scope is broad. Under Section 59(2) of Cap. 155, the HKMA may examine the “affairs, business, and property” of an AI. In practice, this covers risk management frameworks, internal controls, capital adequacy, liquidity, and compliance with the HKMA’s Supervisory Policy Manual (SPM) modules.

Step 1: Notification. The HKMA typically provides written notice 7 to 14 days before an on-site examination. The notice specifies the scope, duration, and required documents. However, Section 63 allows unannounced visits where the HKMA suspects wrongdoing. In 2024, the HKMA conducted 3 unannounced examinations, according to its Annual Report 2024.

Step 2: Document Production. The AI must produce all requested documents within the timeframe stated in the notice. Under Section 60(2), failure to comply without reasonable excuse is an offence punishable by a fine at Level 5 (HK$50,000) and imprisonment for 2 years. Common requests include board meeting minutes, credit files, transaction monitoring reports, and outsourcing agreements.

Step 3: Interviews. Examiners may interview directors, managers, and employees. The HKMA’s SPM Module IC-1 (Internal Controls) states that interviews are used to test the effectiveness of policies and procedures. Interviewees are entitled to legal representation, but the HKMA may proceed without it if the interview is urgent.

Step 4: Exit Meeting. At the conclusion of the examination, the HKMA holds an exit meeting with senior management to discuss preliminary findings. The AI has 14 days to respond in writing. The final examination report may include recommendations, directions, or enforcement referrals.

Off-Site Monitoring: Data Collection and Analysis

Off-site monitoring is the continuous, remote review of an AI’s financial condition and risk profile. The HKMA relies on statutory returns filed under Section 63A of Cap. 155, which requires AIs to submit monthly, quarterly, and annual returns. The Banking (Disclosure) Rules (Cap. 155L) prescribe the format and content of these returns.

Key data points monitored: Capital adequacy ratio (CAR), liquidity coverage ratio (LCR), net stable funding ratio (NSFR), non-performing loan (NPL) ratios, and large exposure concentrations. The HKMA uses an automated system, the Supervisory Data System (SDS), to flag anomalies. In 2024, the HKMA issued 38 off-site-based supervisory letters to AIs, as stated in its Annual Report 2024.

Triggers for intensified monitoring: A CAR falling below 12%, an LCR below 100%, or a sudden spike in NPLs above 3% will trigger a supervisory dialogue. The HKMA may also require a remedial plan under Section 67(1) of Cap. 155, which empowers the HKMA to impose conditions on an AI’s licence.

Practical Steps for Compliance Officers

Compliance officers at AIs must prepare for both on-site and off-site supervision. The HKMA’s SPM Module SA-1 (Supervisory Approach) states that the regulator adopts a risk-based approach. Higher-risk AIs face more frequent and intensive supervision.

Document Management and Record-Keeping

Maintain a centralised repository of all documents that the HKMA has requested in past examinations. The Banking Ordinance does not prescribe a specific retention period for supervisory documents, but the HKMA’s SPM Module CR-1 (Credit Risk Management) recommends a minimum of 7 years for credit files. For AML-related documents, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) requires retention for at least 5 years after the business relationship ends.

Staff Training and Preparedness

Train all relevant staff on the HKMA’s examination protocol. Designate a single point of contact (SPOC) for the HKMA. The SPOC should be a senior manager with authority to make decisions. Under Section 60(4) of Cap. 155, any person who obstructs an examiner commits an offence. Staff must know that they cannot destroy or alter documents once an examination is announced.

Responding to Off-Site Inquiries

When the HKMA issues a supervisory letter based on off-site data, respond within the specified deadline — typically 14 days. The response must address each finding with supporting evidence. If the HKMA requests a remedial plan, include specific milestones, responsible persons, and target dates. The HKMA’s Enforcement Policy (2023) states that failure to implement a remedial plan on time may result in a public reprimand or a financial penalty.

Enforcement Consequences and Recent Cases

The HKMA has a range of enforcement tools. Under Section 67(1) of Cap. 155, the HKMA may revoke or suspend a licence. Under Section 67(2), it may impose a financial penalty of up to HK$10 million per contravention. Under Section 67(3), it may issue a reprimand.

Case Example: Failure to Cooperate

In 2023, the HKMA publicly reprimanded an AI for failing to provide documents during an on-site examination within the required timeframe. The AI had argued that the documents were stored off-site and required 30 days to retrieve. The HKMA rejected this excuse, citing Section 60(2). The AI was fined HK$5 million. The case is recorded in the HKMA’s Enforcement Bulletin 2023.

Case Example: Inadequate Off-Site Reporting

In 2024, the HKMA issued a direction under Section 67(1) to an AI that had submitted inaccurate LCR data for three consecutive quarters. The direction required the AI to appoint an external auditor to verify its data systems. The AI’s compliance officer was also required to attend a HKMA training session. The direction was published on the HKMA’s website.

Key Takeaways for AIs

1. Prepare for unannounced on-site examinations. Maintain a “ready state” for document production and staff interviews at all times, as the HKMA conducted 3 unannounced visits in 2024 alone.
2. Ensure off-site data accuracy. The HKMA’s automated system flags anomalies in statutory returns; errors in CAR, LCR, or NPL data may trigger a supervisory letter within 48 hours.
3. Designate a senior manager as the HKMA point of contact. This person must have authority to make decisions and the ability to mobilise resources within 24 hours of a request.
4. Retain documents for at least 7 years. The HKMA may request documents from examinations conducted years earlier, particularly in cases involving AML or fraud.
5. Respond to supervisory letters within 14 days. A late or incomplete response may escalate to a formal direction or financial penalty, as demonstrated in the 2023 reprimand case.

This does not constitute legal advice. Consult a solicitor for your specific case.