24 November 2005

Dear Sir / Madam,

Preparedness for Influenza Pandemic in Hong Kong

I am writing to draw your attention to a number of recommended measures that individual authorized institutions (AIs) should consider adopting in the light of the possible outbreak of an influenza pandemic in Hong Kong.

The Government of the Hong Kong Special Administrative Region (HKSARG) has developed the Framework of Government’s Preparedness Plan for Influenza Pandemic¹, which includes a three-level response system (Alert Response Level, Serious Response Level and Emergency Response Level) based on different risk-graded epidemiological scenarios. AIs should refer to the HKSARG's preparedness plan and guidance specified in our Supervisory Policy Manual "Business Continuity Planning" and other relevant guidelines² when developing their emergency response and contingency measures for influenza pandemic. Specific recommended measures are summarised below.

Alert Response Level

The HKSARG has already declared Hong Kong to be at the Alert Response Level. AIs should step up their preparedness and develop as soon as possible suitable emergency responses and contingency measures and the corresponding activation criteria. In particular:

1. A multi-disciplinary pandemic contingency planning team (including representatives from the business continuity planning function, key business functions, information technology, human resources and office administration) should be established. The team should be responsible for monitoring developments relating to the possible pandemic (e.g. by reviewing the information released from the Department of Health of the HKSARG) and formulating the emergency response and contingency plans.
   
   

2. AIs should ascertain immediately, if they have not yet done so, whether the existing business continuity plan (BCP) is able to cope with an outbreak of influenza pandemic, and whether the core business activities can be sustained over a prolonged period of disruption. Functions that might not be critical immediately but would become so over time should be included in the review process. Improvements, where necessary, to the existing BCP should be made as quickly as possible.
   
   

3. AIs are reminded of the need to ensure uninterrupted clearing and settlement services and the readiness of the related back-up facilities. Drawing from the SARS experience, Hong Kong Interbank Clearing Limited (HKICL) might operate from its back-up data centre in Kowloon or adopt a split-operation mode for the clearing and settlement operations during contingency situations. AIs should review their related back-up equipment and facilities and ensure that the telecommunication links from their alternate sites to HKICL's primary and back-up data centres are in place and have adequate capacity.
   
   

4. The lessons learned from the outbreak of SARS indicate that when the "work from home" and "split operations" strategies were extended to more business functions for a period over a couple of months, some institutions began to experience problems of insufficient network bandwidth and mobile computing equipment. AIs should therefore review the readiness of policies and mobile computing equipment and their computer networks to support these strategies for a prolonged period. Where possible, AIs should also consider making arrangements with their overseas offices to cover certain activities of the Hong Kong operations in case of need.
   
   

5. AIs should review the capacity readiness of electronic channels to cater for the possibility of a sudden surge of transaction volume and their ability to expand online and self-service options for customers and business partners.
   
   

6. AIs should build in the training redundancy necessary to ensure that essential functions can be continued in the event of a high absentee rate (e.g. in the range of 25-30%). Succession plans for key staff are also important.
   
   

7. AIs should ensure that all critical suppliers and major outside service providers have implemented appropriate contingency measures for the possible outbreak of an influenza pandemic.

8. AIs should maintain a healthy work environment and establish infection control procedures including the acquisition of adequate personal protective equipment (e.g. masks, liquid soap, disinfectants) for use by staff in case of need.

9. AIs should increase staff awareness of influenza pandemic and communicate to staff the steps taken by the institutions in preparation for the possible outbreak. Relevant health advice and guidelines on the importance of good personal hygiene should be provided to staff through internal communications and training. AIs should also review, and where necessary, strengthen their policies on medical provision, sick leave and other leave.

Serious Response Level and Emergency Response Level

When the Serious Response Level or Emergency Response Level is declared, AIs should invoke the relevant emergency response measures according to the pre-defined activation criteria taking into account the extent of the outbreak. For instance, the "work from home" and/or "split operations" strategies might need to be activated at this stage. It is essential for AIs to establish a clear command, control and communication structure for crisis management so that they can effectively monitor the latest developments of the pandemic and manage any possible incidents. To reduce the chance of staff being infected, AIs should consider reducing non-essential overseas trips and meetings and using video or telephone conferencing facilities where possible. In addition, AIs should implement a monitoring mechanism to track any abnormal sickness and suspected infection of employees.

It is important for AIs to determine in advance what are the bare minimum services (e.g. Internet banking, phone banking, ATM services, payment-related services, access to safe-deposit boxes under special requests) that they have to continue to provide to their customers in a worst-case scenario and plan accordingly for the provision of such services when such a scenario materialises. Any special service arrangements should also be communicated clearly to AIs' customers.

The experience from SARS shows that AIs may need to consider closing certain branches, possibly at short notice, due to healthcare concerns (e.g. where there are suspected infection by staff working at a branch). AIs should therefore build into their detailed contingency plans for branch closure in case of need, including how to communicate with customers and to address the possible impact on customers.

The HKMA will follow up with individual AIs on the steps they have taken to review and, where necessary, improve their BCP. AIs are urged to treat this as a vital issue critical to their business. The HKMA will continue to review the situation and consider whether further guidance needs to be provided to AIs as more information about the disease and outbreak control is available.

Should you have any questions on the content of this letter, please feel free to contact Mr Shu-Pui Li at 2878 1826 or Mr James Tam at 2878 8043.

Yours faithfully,

Arthur Yuen
Executive Director
(Banking Supervision)