Opening Remarks at the Whole Industry Simulation Exercise (WISE) 2025 Kick-Off Workshop

1. Good afternoon, everyone. Welcome to the kick-off workshop for the Whole Industry Simulation Exercise, or WISE 2025. 
2. The Hong Kong Monetary Authority (HKMA) is delighted to support the re-run of WISE by the Hong Kong Financial Services Business Continuity Management Forum (HKFSBCM) again. It is actually our fourth time working together.  This speaks to the importance that the HKMA attaches to industry initiatives like WISE, which bring the financial sector together to drill and put into practice our ability to respond to disruptive scenarios.  
3. Indeed, as the events of the last few years have shown – be it acute weather events, or global IT incidents like CrowdStrike – the possibility of significant disruptions is no longer hypothetical. And the financial sector must get ready to respond and recover when incidents hit.  That is, financial institutions must stay operationally resilient.  
4. Operational resilience is indeed a top supervisory priority for the HKMA, and we are working with the industry on a multi-year journey to uplift banks’ capabilities in this regard. We appreciate the great efforts and progress made by all involved.  Our regular surveys and industry outreach show that banks in Hong Kong are generally on track to meet the target of becoming operationally resilient by May 2026.  Specifically, all banks have already developed operational resilience frameworks, and most have also progressed from the mapping phase to scenario testing phase.  
5. However, as the saying goes, the “last mile” is always the most challenging. And we are fast approaching that juncture.  While what the “tail end” of this journey involves for each bank may vary based on individual circumstances, I would expect some commonalities:

• For one, banks have now identified which critical operations they can deliver during a severe but plausible scenario, and obtained a holistic understanding of the upstream and downstream factors that may affect their ability to recover these operations within tolerance levels.  The “last mile” is to mitigate and overcome these known vulnerabilities.
• Secondly, we should start planning for “post-May 2026”.  Up until now, most banks have been running their operational resilience programme on a project basis.  However, a defining characteristic of operational resilience is that it is very much a “living” concept which evolves and changes over time.  This means our operational resilience journey never truly ends, and should in the longer term, become a “business as usual” concept that is embedded in all financial activities. 
• Thirdly, the process is continuous and iterative, and calls for constant refinements to ensure that a bank’s operational resilience arrangements stay up-to-date and relevant. 

6. As always, the HKMA is a trusted partner working with the industry to deliver immediate, as well as longer term transitions. In addition to our supervisory policy manual and on-going engagement with individual banks, we also plan to issue further industry guidance in the coming months to set out good practices for vulnerabilities remediation and management.
7. In particular, we have heard strong industry interests in obtaining more guidance around third-party and cyber risk management, and will seek to incorporate insights from our parallel tracks of supervisory work therein. As you are aware, our supervisory agenda on this front is similarly rich.  Some key highlights include:

• A Cyber Mapping Exercise to understand network interconnections, interdependencies, as well as potential systemic concentration risk in the financial sector;
• Cyber Resilience Assessment Framework (C-RAF) – now on its third cycle – to enhance the banking industry’s cyber defence maturity; 
• A new Cyber Resilience Testing Framework to further step-up banks’ response and recovery capabilities, building on the strong foundation already developed for defence and protection; and
• Prime the industry to get prepared for the Basel Committee on Banking Supervision (BCBS)’s upcoming new “Principles for the Sound Management of Third Party Risk”.   

8. But we are all aware that guidance can only get us so far. Ultimately, banks must take the reins and show that we can translate concepts into action.  Initiatives like WISE provide important opportunities to verify this capability before a real-life incident, with actual stakes, emerge. 
9. And indeed, the dividends of WISE may extend beyond this, potentially helping banks to fine-tune their operational resilience blueprints, similar to what “post-May 2026” work may entail. For instance, WISE 2023 provided participants with actionable insights, including more granularity of mapping and optimal design of roles and responsibilities for incident management. 
10. The theme for WISE 2025 is “extreme weather”. It is no doubt a timely and highly relevant scenario to operational resilience, and there are significant benefits of drilling this aspect. And if I could just leave you with one message today:  Participate, Share and Collaborate in moving operational resilience from a concept to reality!

Our gratitude to HKFSBCM once again for organising this initiative.  Looking forward to fostering closer collaboration among all stakeholders.  Thank you.