HKMA's OR-2 operational-resilience guidance asks institutions to identify critical operations and set impact tolerances. Resource and dependency mapping feed severe-scenario testing, incident response and remediation, with assessments and test evidence for HKMA supervisory review.
TL;DR:
- Institutions identify critical operations, set tolerances and map supporting dependencies.
- Severe but plausible tests must inform remediation, incident response and recovery.
- Boards and senior management oversee resilience across the complete delivery chain.
Summary
Critical operations through disruption
OR-2 defines operational resilience around the ability to deliver critical operations through disruptive events. HKMA expects the framework to be proportionate to an authorised institution’s nature, size, complexity and risk profile. The focus is the service outcome that must be sustained, including its importance to customers and the wider financial system, rather than the availability of a single application or data centre in isolation.
Tolerances and dependency mapping
Institutions identify their critical operations and set a tolerance for disruption for each. Tolerances include a time-based metric and may also address transaction volume, value or other impacts. Mapping then identifies resources, interconnections and dependencies supporting delivery. That brings people, processes, technology, information, facilities and external arrangements into the same view, making concentrations or hidden dependencies easier to test.
Scenarios, testing and recovery
OR-2 calls for severe but plausible scenarios relevant to the institution, including disruptions involving third parties. Testing assesses whether critical operations can remain within their tolerances and exposes weaknesses requiring action. Incident-response and recovery arrangements must work with that assessment. A backup component or written continuity plan does not by itself establish resilience if the complete operation cannot be delivered within its tolerance.
Governance and continual improvement
The Board bears ultimate responsibility for approving and overseeing the resilience framework, while senior management implements it and supplies resources and reporting. Parameters, scenarios and the framework are reviewed as operations change and lessons emerge. HKMA applies the module to authorised institutions; it is supervisory guidance used with related risk-management and continuity expectations, rather than a standalone licence category for every payment technology supplier.
Keywords
- HKMA OR-2
- operational resilience
- critical operations
- disruption tolerances
- dependency mapping
- scenario testing
- board oversight
- incident recovery
- third-party services
- remediation