HKMA requires multi-CRA resilience and Hong Kong data localisation for consumer credit data
Hong Kong retail and digital banks must engage multiple CRAs with 24-hour switch-over and annual drills, and keep all consumer credit data within Hong Kong
Change
On 12 June 2026 the HKMA issued IC-6 V.7, a statutory guideline under the Banking Ordinance, requiring all Hong Kong retail and digital banks to engage more than one credit reference agency with the ability to switch between them within 24 hours and to run annual switch-over drills, and requiring all authorized institutions to keep consumer credit data collected, stored and processed within Hong Kong.
Why it matters
IC-6 V.7 supersedes the 2022 version and adds binding operational-resilience and data-governance requirements. All retail banks, including digital banks, must engage multiple CRAs, complete a switch-over within 24 hours of a CRA disruption, run drills at least every 12 months, and obtain written confirmation from non-primary CRAs after each drill, supported by documented policies and management review. All AIs must ensure consumer credit data is collected, stored and processed within Hong Kong by the CRA and Credit Reference Platform operator, with cross-border transfer prohibited except for consumer-authorised genuine cross-border credit applications and never for technical or operational convenience. The module also references the HKMA's 21 November 2025 Interbank Debt Relief Plan circular. Failure to meet the module's standards may call into question whether an AI continues to satisfy the authorization criterion under the Banking Ordinance.
Implications
- — Hong Kong retail and digital banks must engage more than one CRA and build the capability to switch between them within 24 hours of a CRA service disruption without degrading consumer credit or risk-management services — a single-CRA arrangement no longer meets the IC-6 standard.
- — These banks must run switch-over drills at least every 12 months covering technical, operational and risk-management aspects, and obtain written confirmation from each non-primary CRA verifying successful completion, with documented policies and management review of the switch-over capability.
- — All AIs providing consumer credit must ensure consumer credit data is collected, stored and processed within Hong Kong and must block any cross-border transfer made solely for technical or operational convenience — such transfers are prohibited even with customer consent, and compliance must be enforced through contractual obligations, audit rights and CRA reporting.
- — AIs must treat adherence to IC-6 as an authorization matter, since the HKMA states that failure to meet the module's standards may call into question whether the AI continues to satisfy the authorization criterion under the Banking Ordinance.
Who is affected
- — Operational-resilience and compliance teams at Hong Kong retail and digital banks engaging credit reference agencies
- — Data-governance and compliance teams at authorized institutions providing consumer credit
- — Vendor-management teams responsible for CRA contracts and oversight