Try the OS

Free interactive tool · Hong Kong CDS readiness

Credit Data Smart readiness assessment: find your operational gaps before 2027

In about five minutes, assess scope, data inventory, reconciliation, the 30-day operating cycle, privacy and security. Get an immediate score, weakest area and five prioritized actions—without providing an email address.

Start the free assessmentSee what it covers

Prepared by the Covenant Desk product team · Based on official material available on 19 August 2026

Assessment framework

It does not ask whether you own software; it tests whether the process can be repeated and evidenced

The assessment separates CDS preparation into five executable areas. Three questions per area reveal whether accountability, data or control design needs attention.

01

Scope and accountability

Identify the businesses, entities and products potentially affected by the phase-two arrangements, then assign accountable owners.

02

Data inventory and definitions

Before producing an output, know where each field comes from, what it means and who maintains it.

03

Data quality and reconciliation

Exportable is not the same as submission-ready: outputs need validation, ledger reconciliation and reliable correction handling.

04

30-day operating cycle

Turn a one-off project into a repeatable, reviewed, evidenced and recoverable operating process.

05

Privacy, security and correction

Consumer credit data is sensitive; the process must restrict access, protect transfer and support accuracy and correction.

01

Scope and accountability

Identify the businesses, entities and products potentially affected by the phase-two arrangements, then assign accountable owners.

01Have you mapped every unsecured personal-loan business by entity, product and security type?

Cover new applications, approved loans, settled and delinquent accounts, and identify the system or ledger holding each record.

02Do you measure the HK$50 million portfolio threshold and identify lending involving borrowers below HK$12,000 monthly income?

The consultation conclusions describe these as triggers to join and use CDS, separate from the broader data-submission arrangement.

03Has management assigned business, data, technology and compliance owners with milestones through 2027?

Ownership should cover scope decisions, data production, review, submission, correction and escalation.

02

Data inventory and definitions

Before producing an output, know where each field comes from, what it means and who maintains it.

04Have you inventoried application, approval, credit-limit, outstanding-amount and repayment data?

The official conclusions use these as examples; final fields must follow the platform specification and final licence conditions.

05Does every candidate field have a definition, format, source system, update time and data owner?

For example, outstanding amount needs a consistent cut-off, component, currency and rounding rule.

06Do borrower and loan records use consistent identity matching, duplicate detection and cross-system identifiers?

Address HKID, name variants, loan numbers, joint borrowers, duplicate applications and cross-entity records.

03

Data quality and reconciliation

Exportable is not the same as submission-ready: outputs need validation, ledger reconciliation and reliable correction handling.

07Before output, do automated checks detect missing fields, invalid dates, duplicates, implausible balances and status conflicts?

Validation results should identify the reason, affected record, owner and correction status.

08Can every output reconcile to the authoritative loan ledger and explain limit, disbursement, balance and repayment differences?

Counts and amounts should trace to source; differences need an approved correction, explanation or hold decision.

09Do refunds, reversals, backdated entries and corrections flow into later outputs with before-and-after versions retained?

Manually changing only the export can permanently separate the official ledger from the submission record.

04

30-day operating cycle

Turn a one-off project into a repeatable, reviewed, evidenced and recoverable operating process.

10Is there a 30-day operating calendar covering cut-off, production, validation, review, approval and submission?

Allow time for corrections, holidays, staff absence and platform unavailability.

11Do separate roles review and approve the data before submission, with reproducible audit evidence retained?

Evidence should include output version, validation, reconciliation, exceptions, approver, time and submission confirmation.

12Has the team completed an end-to-end rehearsal with procedures for rejection, partial failure, resubmission and missed deadlines?

A rehearsal should start with source data and end with submission confirmation and management reporting—not merely produce a file.

05

Privacy, security and correction

Consumer credit data is sensitive; the process must restrict access, protect transfer and support accuracy and correction.

13Are complete consumer-credit records and export files restricted to authorised roles with periodic access reviews?

Cover joiners, movers, leavers, temporary access, service accounts and administrator privileges.

14Do file production, staging, transmission and deletion use approved channels, encryption, access logs and incident handling?

Avoid personal email, unmanaged shared drives and desktop copies for batch files.

15Are there procedures for data accuracy, retention, access and correction requests, including downstream correction notification?

PCPD principles and the consumer-credit code address accuracy, retention, security, access and correction.

After all 15 questions, the page generates your score, section results and five prioritized actions.

How to interpret the score

The score prioritizes work; it is not a compliance certificate

The same total can come from different gaps, so results also show five section scores. Start with the lowest area that could prevent accurate data or a repeatable 30-day cycle.

0–10 points

Foundation not yet established

Confirm scope, accountable owners and authoritative data sources before designing outputs.

11–20 points

Building the operating model

Some data and processes exist, but definitions, reconciliation and ownership need consistency.

21–26 points

Ready for a controlled rehearsal

Core foundations exist; convert remaining gaps into end-to-end testing, exception handling and evidence.

27–30 points

Higher operational preparation

Focus on final-specification validation, stress testing, access review and continuous monitoring.

This tool supports operational planning and internal discussion. It does not determine whether a licence condition applies and does not establish compliance with CDS, money lender licensing conditions or the PDPO. Confirm against final licence conditions, platform specifications and professional advice.

Frequently asked questions

Four things to know before assessing

Does this score establish CDS compliance?

No. It reflects a self-assessment against 15 operational controls and is not legal advice, a regulatory determination, an audit or a compliance certification.

Must I enter borrower, portfolio or company information?

No. Each question asks only whether a control is in place, partly in place or not yet in place. Do not enter personal data or real loan information.

Must every licensed money lender join and enquire through CDS?

The conclusions distinguish data submission from joining and using CDS. The latter is tied to an HK$50 million total or lending involving borrowers below HK$12,000 monthly income; confirm individual application against final conditions.

What should we do first after completing it?

Start with the lowest-scoring section, assign an owner and date, then run a source-to-confirmation rehearsal using realistic but controlled test data.

Primary sources

Official sources and update boundary

Phase-two content is based on the 2026 consultation conclusions and is described as proposed. The Companies Registry has published phase-one licence conditions effective 1 August 2026; this tool does not misstate the phase-two proposal as an already-effective final condition.

Next step

Find the gaps, then rehearse the entire cycle using controlled data.

See how Customer 360, access controls, the repayment ledger, data validation, audit evidence and CDS-ready exports connect in Covenant Desk.

Try the lending operating systemRead the complete CDS guide
Covenant Desk is lending operations software. It does not provide loans, issue credit reports or replace the lender's final credit or regulatory decision.