HKMA SA-2 is the Supervisory Policy Manual module on outsourcing for authorized institutions. It focuses on governance, risk assessment, material outsourcing, customer data, overseas outsourcing, contracts, monitoring, contingency planning, and regulatory access.
Official source
What teams need to do
- Confirm the current SA-2 module version.
- Identify outsourcing arrangements and assess materiality.
- Review service provider capability, customer data, overseas outsourcing, contracts, audit, and
access rights.
- Monitor providers, incidents, issues, and changes.
- Maintain contingency and exit planning.
Evidence to maintain
- Outsourcing policy, register, and materiality assessment.
- Due diligence, contract, customer-data, overseas-outsourcing, and audit evidence.
- Monitoring, incident, remediation, contingency, and exit records.
Common gaps
- Customer data and overseas outsourcing analysis is incomplete.
- The register is not connected to monitoring.
- Contingency plans are not provider-specific.
How Halbarad helps
Halbarad helps maintain outsourcing records, provider evidence, subcontractor discovery, monitoring, issues, remediation, and exit evidence.
Disclaimer
This guide is for general information only and is not legal advice. Review the official regulation, guidance, and supervisory materials, and consult qualified counsel or compliance advisors for your organization's specific obligations.