The Hong Kong Monetary Authority lists CG-1 Version 4, dated 1 August 2025, as the current Supervisory Policy Manual module on corporate governance for locally incorporated authorized institutions. It sets minimum governance standards across board responsibilities, risk governance, senior-management oversight, values and culture, remuneration, structure, audit, transparency, committees, director suitability, evaluation, group governance, and supervisory review.
This guide replaces Zeph Tech's older dated CG-1 briefing as the current implementation reference. Always verify the current HKMA module and related SPM guidance before making a regulatory decision.
HKMA identifies CG-1 as a statutory guideline under section 7(3) of the Banking Ordinance. Its stated purpose is to set out the minimum standards expected of locally incorporated authorized institutions, and it applies to all such institutions.
The module is explicitly principles based. Governance should be commensurate with an institution's nature, scale and complexity; systemically important institutions are expected to maintain structures appropriate to their potential financial-stability impact. Where a specific element is not met, HKMA expects alternative measures with equivalent effect, prompt notification, and supporting justification.
CG-1 also points readers to other SPM modules rather than attempting to contain every governance requirement itself. Relevant cross-references include manager appointment controls, code of conduct, remuneration, competence and ethical behaviour, risk management, internal audit, external-auditor reporting, connected-party exposure, operational resilience, and climate-risk management.
CG-1 organizes the board's core responsibilities into a practical set of governance domains. A useful implementation maps each domain to an owner, governing document, recurring evidence, escalation route, and review cadence.
Set and oversee objectives and strategy, approve business plans and budgets, and review performance with corrective action where needed. Strategic decisions should reflect resources, risk exposures, and the institution's ability to manage those risks.
Maintain an effective risk-management framework and risk-appetite framework. The board should approve the risk-appetite statement, oversee adherence, and ensure risk management, internal audit, and compliance functions are appropriately positioned, resourced, and independent.
Appoint competent senior management, define accountability, and oversee whether management acts consistently with board-approved strategy, risk appetite, policies, and values. Management information must be timely, adequate, and comprehensible.
Set professional standards and corporate values, oversee management's role in sustaining culture, and establish expectations for ethical and responsible behaviour throughout the institution.
Oversee remuneration policy and implementation so incentives remain consistent with risk appetite, culture, long-term interests, performance, and the control environment.
Ensure a suitable and transparent corporate structure, effective internal and external audit arrangements, and an appropriate degree of transparency about governance, operation, risk management, ownership, and material structures.
CG-1 treats risk culture as part of effective risk governance. The board should oversee the risk-appetite framework, ensure risk can be identified, monitored and controlled, and promote a culture in which staff understand their role in operating within established limits.
The module emphasizes independent risk management and internal audit, open communication and challenge about risk taking, and periodic review of whether governance arrangements remain adequate as the operating environment changes. It also contemplates independent assessment of the design and effectiveness of risk-governance arrangements.
For implementation, connect the risk appetite statement to measurable limits, management reporting, exceptions, breaches, remediation, incentives, and committee escalation. If the board cannot see where appetite is being exceeded—or whether limits are producing the intended behaviour—the framework is not yet operational.
CG-1 generally expects locally incorporated authorized institutions to establish nomination, audit, risk, and remuneration committees, subject to the module's proportionality provisions for smaller and simpler institutions.
The module states that the board should either establish a standalone culture committee chaired by an independent non-executive director or assign an existing committee responsibility for regularly reviewing the effectiveness of measures promoting sound corporate culture.
Maintain approved terms of reference, composition requirements, information rights, meeting cadence, escalation rules, and reporting back to the board. A committee should not become a place where ultimate board responsibility disappears.
Risk, audit, remuneration, nomination, and culture oversight intersect. Define how findings and decisions move between committees so incentives, control weaknesses, succession, risk appetite, and conduct issues are considered together when appropriate.
CG-1 covers the role of the chair, board composition, fit-and-proper expectations, director commitment, succession, qualification and training, and board performance evaluation. The module expects collective expertise appropriate to the institution's activities and risk profile and highlights diversity of skills, backgrounds, and viewpoints.
Translate those expectations into a board skills matrix linked to the institution's strategy and risk profile. Record independence considerations, other directorships and commitments, succession risks, required training, evaluation findings, and actions taken to close capability gaps.
| Governance area | Evidence that makes oversight reviewable |
|---|---|
| Board responsibilities | Board charter, reserved matters, annual work plan, strategy/budget approvals, decision records. |
| Risk governance | Risk appetite, limits, breaches, risk reports, independent-control reporting, remediation tracking. |
| Senior management | Role/accountability maps, appointment records, objectives, performance oversight, succession plans. |
| Culture and conduct | Code of conduct, culture measures, whistleblowing/conduct trends, committee review, actions and follow-up. |
| Committees | Terms of reference, composition/independence, attendance, papers, minutes, escalations, board reporting. |
| Board suitability | Skills matrix, fit-and-proper evidence, conflicts, commitments, training, succession, evaluation results. |
| Audit and controls | Internal/external audit plans and findings, control-function independence, issue closure, assurance results. |
| Transparency | Governance disclosures, board/committee information, ownership and related-party disclosures, material-structure information. |
Record that the assessment uses CG-1 V4 dated 1 August 2025 and identify related SPM modules relevant to the institution. Do not rely on an older briefing or archived V3 copy as the current baseline.
For each relevant CG-1 section, map policy, charter, role, committee, evidence source, current control, owner, and identified gap. Distinguish a missing document from a control that exists but is not working.
Prioritize unclear accountability, weak risk-appetite linkage, control-function independence, missing board information, unsuitable committee mandates, unresolved audit findings, and director-suitability gaps.
Where the institution uses a proportional or alternative arrangement, document why it achieves equivalent effect, who approved the rationale, and whether HKMA notification or consultation is required.
Follow real decisions through management preparation, committee review, board challenge, approval, implementation, monitoring, exception handling, and follow-up. This tests whether governance operates beyond the policy layer.
Assign ownership for monitoring HKMA's Banking Regulatory Document Repository and cross-referenced SPM modules. Trigger re-review when the regulator updates the module, the institution changes materially, or governance evidence shows the design is not effective.
This page is an implementation aid, not legal or regulatory advice. Confirm the current module, Banking Ordinance requirements, institution-specific supervisory communications, and related SPM guidance with appropriate qualified functions.
Follow the next implementation topic without returning to search.
Separate board oversight duties from recommended governance practice
Continue readingCreate accountable oversight for technology and operational risk
Continue readingGovern third-party technology dependencies from materiality and selection through concentration, resilience, and exit
Continue readingUse the source-backed research to pressure-test assumptions, then build a reusable evaluation brief before you compare products, scope implementation, or request a fit review.