HKMA requires multi-CRA resilience and Hong Kong data localisation for consumer credit data

On 12 June 2026 the HKMA issued IC-6 V.7, a statutory guideline under the Banking Ordinance, requiring all Hong Kong retail and digital banks to engage more than one credit reference agency with the ability to switch between them within 24 hours and to run annual switch-over drills, and requiring all authorized institutions to keep consumer credit data collected, stored and processed within Hong Kong.

IC-6 V.7 supersedes the 2022 version and adds binding operational-resilience and data-governance requirements. All retail banks, including digital banks, must engage multiple CRAs, complete a switch-over within 24 hours of a CRA disruption, run drills at least every 12 months, and obtain written confirmation from non-primary CRAs after each drill, supported by documented policies and management review. All AIs must ensure consumer credit data is collected, stored and processed within Hong Kong by the CRA and Credit Reference Platform operator, with cross-border transfer prohibited except for consumer-authorised genuine cross-border credit applications and never for technical or operational convenience. The module also references the HKMA's 21 November 2025 Interbank Debt Relief Plan circular. Failure to meet the module's standards may call into question whether an AI continues to satisfy the authorization criterion under the Banking Ordinance.