HKMA OR-2 and the May 2026 operational resilience milestone

The Hong Kong Monetary Authority issued Supervisory Policy Manual module OR-2 Operational Resilience in May 2022. The module set a clear transition path. Authorised institutions were expected to develop an operational resilience framework within one year of issuance and to become operationally resilient within three years. That endpoint falls in May 2026, and the supervisory dialogue this year has already moved from framework design to evidence of capability.

OR-2 builds on the Basel Committee's Principles for Operational Resilience and aligns broadly with the approaches taken in the United Kingdom, Australia and Singapore. Institutions identify critical operations, set tolerances for disruption, map the people, processes, technology, information and third-party dependencies that support each critical operation, and test the ability to remain within tolerance under severe but plausible scenarios. The framework integrates with the existing modules on outsourcing under OR-1 and technology risk under TM-G-1 and TM-G-2 rather than replacing them.

The supervisory focus this year sits on three points. The first is whether tolerances are calibrated to customer and financial stability outcomes rather than to internal recovery convenience. A tolerance that simply mirrors the existing recovery time objective is unlikely to satisfy a thematic review. The second is whether mappings reach beyond first-tier service providers to the concentrations that matter, including shared cloud regions, common payment infrastructure and the small number of providers that support large parts of the Hong Kong market. The third is whether scenario testing is exercising those tolerances rather than confirming them.

Severe but plausible scenarios continue to evolve. Earlier rounds focused on traditional technology outages and natural hazards. Recent supervisory discussion has added scenarios that combine a cyber event with a regional infrastructure event, scenarios that compromise a major service provider used by multiple institutions and scenarios in which the institution must operate at reduced capacity for an extended period rather than recover to full service within hours. The harder scenarios are the ones that exposed weaknesses in the early phases of the transition, and they remain the most useful test of resilience now.

Third-party concentration is a particular sensitivity. Hong Kong's market structure means that a small number of providers underpin large parts of payments, settlement, market data and core banking infrastructure. OR-2 expects institutions to understand the concentrations that affect them, to consider the resilience of the providers as well as the contractual protections, and to take account of intra-group dependencies on global parent platforms where these support critical operations in Hong Kong.

Governance has been steadily tightened across the transition. Boards are expected to have approved the framework, the list of critical operations and the tolerances. They are also expected to have seen credible evidence from testing and to have considered what the results say about investment priorities. The supervisory question is not whether the board signed the paper but whether the board understands the institution's current resilience posture and is acting on it.

Institutions that are well placed for the May 2026 milestone share a few characteristics. They have a single, current view of critical operations and dependencies rather than separate views maintained by continuity, technology and third-party teams. They have tolerances that the chief executive can defend in plain language. And they have a test programme that has actually broken something and produced corrective action. The institutions still working towards those positions should expect the next supervisory cycle to focus on the gap.