Guideline No. 16.2

Guideline No. 16.2

Year 2000 problem

I am writing to update you on the issue of the Year 2000 problem and the additional measures that the Hong Kong Monetary Authority ("HKMA") plans to take in relation to this matter.

Definition of Year 2000 compliance

In the past few months, we have received a number of enquiries from institutions regarding the definition of Year 2000 compliance. In order to make its position clear to the industry, the HKMA has adopted the following definition:

"A Year 2000 compliant system should perform, function and manage data involving dates without being abnormally affected by dates spanning the period prior to, during and after the year 2000."

This is in line with definitions commonly adopted internationally and by most institutions in their formal plans previously submitted to the HKMA. I would like to emphasize that this definition is system based. A Year 2000 compliant system may or may not interact correctly with other systems within the organisation. Therefore, internal validation work, which includes testing of the interaction between your institution's internal systems, is vital. The HKMA expects that internal validation work will proceed in parallel with the modification of individual systems.

We had previously established 31 December 1998 as the deadline by which all authorized institutions are expected to be Year 2000 compliant. This means that your institution should have in place systems which are Year 2000 compliant in accordance with the above definition. Therefore, your institution is expected by 31 December 1998 to have :

1. completed the modification and testing of individual systems; and
2. tested the interaction of modified systems with other systems with which they interface directly.

Institutions will then be in a position to undertake wider testing that may be required during 1999, including with external parties. The HKMA expects all authorized institutions to meet the 31 December 1998 deadline so as to allow sufficient time for industry-wide testing in 1999. Management should be aware that failure to meet this deadline will attract substantial supervisory attention.

Additional measures to ensure Year 2000 readiness

Over the past year, the HKMA has made extensive supervisory efforts to make sure that authorized institutions understand their obligation to ensure Year 2000 compliance and that they take necessary steps to achieve it. These include:

1. efforts to heighten the level of awareness in the banking sector on the Year 2000 issue;
2. off-site review of institutions' Year 2000 action plans; and
3. regular surveys to keep track of progress made by institutions.

These endeavours have generally helped to enhance the HKMA's understanding of the state of preparedness of individual institutions and the difficulties they encounter in their Year 2000 projects. While most institutions indicate to us that they still expect to be Year 2000 compliant by the end of this year, we are concerned that a number of institutions have already experienced slippage in their Year 2000 projects and that delays at this critical stage might jeopardise their plan to achieve compliance before the end of the year.

The HKMA is therefore planning to take important new steps in the months ahead to address the banking sector's obligation to be Year 2000 compliant. These additional measures are set out below :

(i) Independent verification of Year 2000 compliance progress

This is necessary to ensure that institutions are being realistic in their assessment of their progress in implementation and testing and to identify cases where institutions:

• are failing to maintain sufficient management oversight;
• have not identified all business critical systems that require modification;
• are failing to devote sufficient resources to the project;
• are falling seriously behind schedule;
• have not established contingency plans to deal with systems failure before, on or after 1 January 2000;
• have not evaluated third-party service providers with respect to their Year 2000 compliance;
• have not addressed the implications of non-compliance by business counterparties including borrowers.

There are a number of means by which verification of progress can be achieved:

• on-site examination by HKMA - the HKMA intends to initiate a programme of on-site examination of selected institutions to check their progress towards Year 2000 compliance. Dedicated teams will be set up for this purpose. The round of examinations will begin around the middle of this year;
• review by external auditors - the checking process may also be carried out by external auditors, including in those cases where deficiencies have previously been identified in the HKMA's off-site review of institutions' action plans or on-site examinations;
• review by internal auditors - the HKMA may also be prepared to accept verification of progress by internal auditors, provided that it can be demonstrated that they have the necessary independence and expertise to carry out the task. In general, the HKMA will prefer that verification in respect of branches of foreign banks and of RLB/DTC subsidiaries is carried out by internal auditors from head office/parent bank to ensure that the efforts of the local management are consistent with head office/group policy and guidelines on Year 2000 compliance;
• review by other independent parties - this would include IT consultants who are familiar with Year 2000 issues (but would not include any consultant which the institution has engaged to implement its Year 2000 compliance project).

It is intended that all institutions with work still in progress should be covered by the verification process by one means or another and that it should be completed by the end of 1998.

Where institutions claim to be already Year 2000 compliant, the HKMA will require documentary evidence to support this and may require verification through the process outlined above.

(ii) Formal statement by chief executive of Year 2000 compliance progress

It is becoming increasingly understood that the Year 2000 problem is not simply an IT problem but an issue of business survival. It is crucial that senior management of institutions recognize their responsibility to manage the progress towards compliance. This responsibility cannot be delegated to IT staff or external consultants. Chief executives need to ensure that they are on top of the issue and receive sufficient information to monitor the progress of their project teams.

In order to reinforce the responsibility of chief executives to ensure Year 2000 compliance in their institutions, the HKMA will require the chief executive of each institution to provide the HKMA with a formal statement on a bimonthly basis commencing May 1998. The precise form of the statement will be conveyed to chief executives in due course, but in essence it will ask them to report on:

• the overall progress made by the institution towards Year 2000 compliance;
• whether the chief executive is satisfied with the progress to date and, if not satisfied, the reasons for concern;
• the date by which compliance with the definition adopted by the HKMA is expect to be received;
• significant delays in the project schedule and the reasons for such delays;
• whether the chief executive is satisfied that there are adequate contingency plans in place to deal with systems failure before, on or after 1 January 2000.

(iii) Co-operation with overseas supervisory authorities

Co-operation with overseas supervisory authorities will be essential in helping to evaluate the Year 2000 readiness of foreign banks with branches in Hong Kong. It will also enable the HKMA to understand the steps which other authorities are using to check progress towards Year 2000 compliance and, where appropriate, to apply these lessons in Hong Kong. Where the HKMA comes across Year 2000 deficiencies in a branch of a foreign bank in Hong Kong it will report these to the appropriate home supervisory authority.

(iv) Issue of formal warning letters by HKMA

The HKMA will issue formal warning letters to the chief executives of those institutions which exhibit less than satisfactory or poor performance in their Year 2000 projects. This would include cases where project weaknesses are evident and significant in any of the key phases of the project management processes, progress to date is behind the schedule laid out in the project plan and sufficient resources have not been committed or deployed to address compliance obligations. There are potentially serious consequences associated with receiving such a warning letter from the HKMA. This may serve as a basis for supervisory action e.g. attaching conditions to, or in very serious cases, revocation of, the authorization of institutions. In addition, the institution's future prospect for expansion through acquisitions, or ability to engage in new activities requiring regulatory approval e.g. opening of new branches, may be restricted. The HKMA believes that institutions which cannot demonstrate satisfactory performance in their Year 2000 projects should be directing their resources on correcting their deficiencies and ensuring early compliance rather than diverting their resources by engaging in expansionary activities. In the case of branches of foreign banks, the warning letter would be copied to the head office and home supervisory authority of the bank concerned. In the case of locally incorporated institutions, the letter would be copied to the board of directors.

Industry-wide testing

Achievement of Year 2000 compliance requires not only that individual institutions' systems are compliant but that they interface properly with the systems of other institutions and with shared systems such as those for payments and settlement. This will require a certain amount of industry-wide testing of systems. The HKMA is presently discussing with the Financial Services Bureau, other financial sector regulators and the Hong Kong Association of Banks how such testing should be carried out.

Year 2000 Bulletin

You may recall that we have recently conducted a further survey on Year 2000 progress in the banking sector. The results of this survey have been published in a "Year 2000 Bulletin", a copy of which is now enclosed for your reference.

Euro

Finally, I would also like to take this opportunity to draw your attention to the introduction of the euro, the new single currency of the European Monetary Union ("EMU"), on 1 January 1999. This new currency will, on that date, replace the existing national currencies of countries participating in the EMU. During the three year transitional period between 1999 and 2001, the existing national currencies will continue to exist as "national currency units", that is, sub-denominations of the euro. After 31 December 2001, the national currency units will cease to be used and all amounts will be expressed in the euro. Financial institutions therefore need to prepare themselves for the changeover to the euro, in particular to ensure that their information and accounting systems will be able to cope with the two different currency units that will be in use within the EMU countries during the transitional period. They should also examined the potential implications of the replacement of the ECU by the euro on 1 January 1999 at a rate of 1:1. The HKMA will continue to follow the developments in this area closely and will provide more detailed advice in due course. Meanwhile we hope that institutions will take early action if they have not already done so to assess the likely effects of the introduction of the euro on their operations and take appropriate steps to prepare for the changeover in a timely manner.