HSBC Holdings Regulatory News (HSBA)

Our risk appetite

We have maintained a consistent risk profile throughout our history. This is central to our business and strategy. We recognise the importance of a strong culture, which refers to our shared attitudes, values and standards that shape behaviours related to risk awareness, risk taking and risk management. All our people are responsible for the management of risk, with the ultimate accountability residing with the Board.

We seek to build our business for the long term by balancing social, environmental and economic considerations in the decisions we make. Our strategic priorities are underpinned by our endeavour to operate in a sustainable way. This helps us to carry out our social responsibility and manage the risk profile of the business. We are committed to managing and mitigating climate-related risks, both physical and transition, and continue to incorporate consideration of these into how we manage and oversee risks internally and with our customers.

The following principles guide the Group's overarching appetite for risk and determine how our businesses and risks are managed.

Financial position

• We aim to maintain a strong capital position, defined by regulatory and internal capital ratios.

• We carry out liquidity and funding management for each operating entity, on a stand-alone basis.

Operating model

• We seek to generate returns in line with a conservative risk appetite and strong risk management capability.

• We aim to deliver sustainable earnings and consistent returns for shareholders.

Business practice

• We have zero tolerance for any of our people knowingly engaging in any business, activity or association where foreseeable reputational risk or damage has not been considered and/or mitigated.

• We have no appetite for deliberately or knowingly causing detriment to consumers, or incurring a breach of the letter or spirit of regulatory requirements.

• We have no appetite for inappropriate market conduct by any member of staff or by any Group business.

Enterprise-wide application

Our risk appetite encapsulates the consideration of financial and non-financial risks. We define financial risk as the risk of a financial loss as a result of business activities. We actively take these types of risks to maximise shareholder value and profits. Non-financial risk is defined as the risk to achieving our strategy or objectives as a result of inadequate or failed internal processes, people and systems, or from external events.

Our risk appetite is expressed in both quantitative and qualitative terms and applied at the global business level, at the regional level and to material operating entities. Every three years, the Global Risk function commissions an external independent firm to review the Group's approach to risk appetite and to help ensure that it remains in line with market best practice and regulatory expectations. The exercise carried out in 2019 confirmed the Group's risk appetite statement ('RAS') remains aligned to best practices, regulatory expectations and strategic goals. The review highlighted strengths across our governance and risk appetite reporting, and noted that our risk appetite continues to evolve and expand its scope as part of our regular review process.

The Board reviews and approves the Group's risk appetite twice a year to make sure it remains fit for purpose. The Group's risk appetite is considered, developed and enhanced through:

• an alignment with our strategy, purpose, values and customer needs;

• trends highlighted in other Group risk reports, such as the 'Risk map' and 'Top and emerging risks';

• communication with risk stewards on the developing risk landscape;

• strength of our capital, liquidity and balance sheet;

• compliance with applicable laws and regulations;

• effectiveness of the applicable control environment to mitigate risk, informed by risk ratings from risk control assessments;

• functionality, capacity and resilience of available systems to manage risk; and

• the level of available staff with the required competencies to manage risks.

We formally articulate our risk appetite through our RAS, which is approved by the Board on the recommendation of the Group Risk Committee ('GRC'). Setting out our risk appetite ensures that planned business activities provide an appropriate balance of return for the risk we are taking, and that we agree a suitable level of risk for our strategy. In this way, risk appetite informs our financial planning process and helps senior management to allocate capital to business activities, services and products.

The RAS consists of qualitative statements and quantitative metrics, covering financial and non-financial risks. It is fundamental to the development of business line strategies, strategic and business planning and senior management balanced scorecards. At a Group level, performance against the RAS is reported to the Risk Management Meeting of the Group Management Board ('RMM') on a monthly basis so that any actual performance that falls outside the approved risk appetite is discussed and appropriate mitigating actions are determined. This reporting allows risks to be promptly identified and mitigated, and informs risk-adjusted remuneration to drive a strong risk culture.

Each global business, region and strategically important country and territory is required to have its own RAS, which is monitored to help ensure it remains aligned with the Group's. Each RAS and business activity is guided and underpinned by qualitative principles and/or quantitative metrics.

Risk management

We recognise that the primary role of risk management is to protect our customers, business, colleagues, shareholders and the communities that we serve, while ensuring we are able to support our strategy and provide sustainable growth. This is supported through our three lines of defence model described on page 75. As we move into a revised business focus and carry out a major change programme, it will be critical for us to ensure we use active risk management to manage the execution risks.

We will also perform periodic risk assessments, including against strategies, to help ensure retention of key personnel for our continued safe operation.

We use a comprehensive risk management framework across the organisation and across all risk types, underpinned by the Group's culture and values. This outlines the key principles, policies and practices that we employ in managing material risks, both financial and non-financial.

The framework fosters continual monitoring, promotes risk awareness and encourages sound operational and strategic decision making. It also ensures a consistent approach to identifying, assessing, managing and reporting the risks we accept and incur in our activities.

Our risk management framework

The following diagram and descriptions summarise key aspects of the risk management framework, including governance and structure, our risk management tools and our culture, which together help align employee behaviour with our risk appetite.

Risk governance

The Board has ultimate responsibility for the effective management of risk and approves our risk appetite. In 2019, it was advised on risk-related matters by the GRC and the Financial System Vulnerabilities Committee ('FSVC'). The final meeting of the FSVC was held on 15 January 2020, with responsibility for oversight of financial crime risk transferred to the GRC, which will continue to advise the Board on risk-related matters.

The Group Chief Risk Officer, supported by the RMM, holds executive accountability for the ongoing monitoring, assessment and management of the risk environment and the effectiveness of the risk management framework.

The Group Chief Risk Officer is also responsible for oversight of reputational risk, with the support of the Group Reputational Risk Committee. The Group Reputational Risk Committee considers matters arising from customers, transactions and third parties that either present a serious potential reputational risk to the Group or merit a Group-led decision to ensure a consistent risk management approach across the regions, global businesses and global functions. Our reputational risk policy sets out our risk appetite and the principles for managing reputational risk. Further details can be found under the 'Reputational risk' section of www.hsbc.com/our-approach/risk-and-responsibility.

The management of financial crime risk resides with the Group Chief Compliance Officer. He is supported by the Financial Crime Risk Management Meeting, as described under 'Financial crime risk management' on page 145.

Day-to-day responsibility for risk management is delegated to senior managers with individual accountability for decision making. All our people have a role to play in risk management. These roles are defined using the three lines of defence model, which takes into account our business and functional structures as described in the following commentary, 'Our responsibilities'.

We use a defined executive risk governance structure to help ensure there is appropriate oversight and accountability of risk, which facilitates reporting and escalation to the RMM. This structure is summarised in the following table.

The Board committees with responsibility for oversight of risk-related matters are set out on page 171.

Our responsibilities

All our people are responsible for identifying and managing risk within the scope of their roles as part of the three lines of defence model.

Three lines of defence

To create a robust control environment to manage risks, we use an activity-based three lines of defence model. This model delineates management accountabilities and responsibilities for risk management and the control environment.

The model underpins our approach to risk management by clarifying responsibility and encouraging collaboration, as well as enabling efficient coordination of risk and control activities. The three lines of defence are summarised below:

• The first line of defence owns the risks and is responsible for identifying, recording, reporting and managing them in line with risk appetite, and ensuring that the right controls and assessments are in place to mitigate them.

• The second line of defence challenges the first line of defence on effective risk management, and provides advice and guidance in relation to the risk.

• The third line of defence is our Global Internal Audit function, which provides independent assurance that our risk management approach and processes are designed and operating effectively.

Global Risk function

Our Global Risk function, headed by the Group Chief Risk Officer, is responsible for the Group's risk management framework. This responsibility includes establishing global policy, monitoring risk profiles, and forward-looking risk identification and management. Global Risk is made up of sub-functions covering all risks to our business. Global Risk forms part of the second line of defence. It is independent from the global businesses, including sales and trading functions, to provide challenge, appropriate oversight and balance in risk/return decisions.

Responsibility for minimising both financial and non-financial risk lies with our people. They are required to manage the risks of the business and operational activities for which they are responsible. We maintain adequate oversight of our risks through our various specialist risk stewards and the collective accountability held by our chief risk officers.

Non-financial risk includes some of the most material risks we face, such as cyber-attacks, the loss of data and poor conduct outcomes. Actively managing non-financial risk is crucial to serving our customers effectively and having a positive impact on society. During 2019, we continued to strengthen the control environment and our approach to the management of non-financial risk, as set out in our operational risk management framework. The approach outlines non-financial risk governance and risk appetite, and provides a single view of the non-financial risks that matter the most, and associated controls. It incorporates a risk management system designed to enable the active management of non-financial risk. Our ongoing focus is on simplifying our approach to non-financial risk management, while driving more effective oversight and better end-to-end identification and management of non-financial risks. This is overseen by the Operational Risk function, headed by the Group Head of Operational Risk.

Stress testing and recovery planning

We operate a wide-ranging stress testing programme that is a key part of our risk management and capital planning. Stress testing provides management with key insights into the impact of severely adverse events on the Group, and provides confidence to regulators on the Group's financial stability.

Our stress testing programme assesses our capital strength through a rigorous examination of our resilience to external shocks. As well as undertaking regulatory-driven stress tests, we conduct our own internal stress tests in order to understand the nature and level of all material risks, quantify the impact of such risks and develop plausible business-as-usual mitigating actions.

Many of our regulators - including the Bank of England ('BoE'), the US Federal Reserve Board ('FRB') and the Hong Kong Monetary Authority ('HKMA') - use stress testing as a prudential regulatory tool, and the Group has focused significant governance and resources to meet their requirements.

Regulatory stress test: 2019 Bank of England stress test results

In 2019, the Group participated in the concurrent annual cyclical scenario and the biennial exploratory scenario stress tests, run by the BoE.

The annual cyclical scenario, as published by the BoE, featured a synchronised economic downturn that impacted a number of key regions including Hong Kong. The Group's stress results showed that our capital ratios, after taking account of CRD IV restrictions and strategic management actions, exceeded the BoE's requirements on both an IFRS 9 transitional and non-transitional basis. This outcome reflected our strong capital position, conservative risk appetite and diversified geographical and business mix.

From a common equity tier 1 ('CET1') position of 14.0% at 31 December 2018, the Group stress CET1 ratio reached a low point of 8.9% (after management actions), which was above the hurdle rates of 7.7%. The tier 1 leverage ratio remained above the minimum requirement throughout the stress testing period.

The 2019 biennial exploratory stress scenario is underway and explores the implications of a severe and broad-based liquidity shock affecting major UK banks simultaneously over a 12-month horizon.

Internal stress tests

Our internal capital assessment uses a range of stress scenarios that explore risks identified by management. They include potential adverse macroeconomic, geopolitical and operational risk events, as well as other potential events that are specific to HSBC.

The selection of stress scenarios is based upon the output of our identified top and emerging risks and our risk appetite. Stress testing analysis helps management understand the nature and extent of vulnerabilities to which the Group is exposed. Using this information, management decides whether risks can or should be mitigated through management actions or, if they were to crystallise, be absorbed through capital. This in turn informs decisions about preferred capital levels and allocations.

In addition to the Group-wide stress testing scenarios, each major subsidiary conducts regular macroeconomic and event-driven scenario analyses specific to its region. They also participate, as required, in the regulatory stress testing programmes of the jurisdictions in which they operate, such as the Comprehensive Capital Analysis and Review and Dodd-Frank Act Stress Testing programmes in the US, and the stress tests of the HKMA. Global functions and businesses also perform bespoke stress testing to inform their assessment of risks to potential scenarios.

The Group stress testing programme is overseen by the GRC and results are reported, where appropriate, to the RMM and GRC.

We also conduct reverse stress tests each year at Group level and, where required, at subsidiary entity level to understand potential extreme conditions that would make our business model non-viable. Reverse stress testing identifies potential stresses and vulnerabilities we might face, and helps inform early warning triggers, management actions and contingency plans designed to mitigate risks.

Recovery and resolution plans

Recovery and resolution plans form part of the integral framework safeguarding the Group's financial stability. The Group recovery plan together with stress testing help us understand the likely outcomes of adverse business or economic conditions and in the identification of appropriate risk mitigating actions. The Group is committed to further developing its recovery and resolution capabilities in line with the BoE resolvability assessment framework requirements.

Key developments in 2019

In 2019, it was announced that Marc Moses was stepping down from his role of Group Chief Risk Officer on 31 December 2019. Pam Kaur, who was Head of Wholesale Market and Credit Risk, was appointed as Group Chief Risk Officer with effect from 1 January 2020. Marc assisted with a handover of his executive responsibilities as Group Chief Risk Officer and will continue to provide support in advising the Group Chief Executive in a non-executive capacity until he formally retires from the Group on 9 December 2020.

During the year, we also undertook a number of initiatives to enhance our approach to the management of risk. We continued efforts to simplify and enhance how we manage risk. We simplified the Group risk taxonomy by consolidating certain existing risks into broader categories. These changes streamlined risk reporting and promoted common language in our risk management approach. These changes included:

• We formed a Resilience Risk sub-function to reflect the growing regulatory importance of being able to ensure our operations continue to function when an operational disturbance occurs. Resilience Risk was formed to simplify the way we interact with our stakeholders and to deliver clear, consistent and credible responses globally. The leadership of the Resilience Risk function is the responsibility of the Global Head of Resilience Risk. For further details on resilience risk, see page 143.

• We created a combined Reputational and Sustainability Risk team to further improve the way we manage these risks. For further information on sustainability risk, see 'Our approach to sustainability risk management' on page 40 of our ESG Update.

• The approach to capital risk management is evolving with the creation of a dedicated second line of defence function, which will provide independent oversight of capital management activities. This will operate across the Group focusing on both adequacy of capital and sufficiency of returns.

• We have placed greater focus on our model risk activities. To reflect this, we created the role of Chief Model Risk Officer. This has been filled on an interim basis while we seek a permanent role holder.

Further simplification is expected to continue during 2020, including the combining of our two key risk management frameworks.

We use a top and emerging risks process to provide a forward-looking view of issues with the potential to threaten the execution of our strategy or operations over the medium to long term.

We proactively assess the internal and external risk environment, as well as review the themes identified across our regions and global businesses, for any risks that may require global escalation, updating our top and emerging risks as necessary.

We define a 'top risk' as a thematic issue that may form and crystallise within one year, and which has the potential to materially affect the Group's financial results, reputation or business model. It may arise across any combination of risk types, regions or global businesses. The impact may be well understood by senior management and some mitigating actions may already be in place. Stress tests of varying granularity may also have been carried out to assess the impact.

An 'emerging risk' is a thematic issue with large unknown components that may form and crystallise beyond a one-year time horizon. If it were to materialise, it could have a material effect on our long-term strategy, profitability and/or reputation. Existing mitigation plans are likely to be minimal, reflecting the uncertain nature of these risks at this stage. Some high-level analysis and/or stress testing may have been carried out to assess the potential impact.

Our current top and emerging risks are as follows.

Externally driven

Economic outlook and capital flows

Global manufacturing was in recession in 2019 as the Chinese economy slowed, trade and geopolitical tensions continued, and key sectors like automotive and information technology suffered from idiosyncratic issues. This had an impact on trade-reliant regions including the European Union ('EU'), while the US benefited from a resilient consumer. Early in 2019, global central banks abandoned their previous intentions to tighten monetary policy gradually in order to underpin economic activity.

These and other factors contributed to an increase in market optimism towards the end of 2019 that global economic activity may be bottoming out.

However, a significant degree of caution is warranted. US-China relations are likely to remain tense as negotiations move to a second phase, covering aspects like intellectual property. Changing global consumption patterns and the introduction of stricter environmental standards may continue to hamper the automotive and other traditional industries. The net impact on trade flows could be negative, and may damage HSBC's traditional lines of business.

The coronavirus outbreak is a new emerging risk. In a baseline scenario, the outbreak should be contained but may lead to a slowdown in China's economic activity during the first quarter of 2020, followed by a rebound in the remainder of the year, helped by an increased policy stimulus in response to the outbreak. However, there is a risk that containment proves more challenging, and the resulting socio-economic disruption is more extensive and prolonged, extending beyond China. Since the beginning of January, the coronavirus outbreak has caused disruption to our staff, suppliers and customers, particularly in mainland China and Hong Kong. Should the coronavirus continue to cause disruption to economic activity in Hong Kong and mainland China through 2020, there could be adverse impacts on income due to lower lending and transaction volumes, and insurance manufacturing revenue, which may impact our RWAs and capital position. We have invoked our business continuity plans to help ensure the safety and well-being of our staff, as well as our capability to support our customers and maintain our business operations.

Elsewhere, there could also be other downside idiosyncratic risks in emerging markets, which could include a disorderly sovereign debt restructuring in Argentina.

It is anticipated that oil prices are likely to remain range-bound in 2020, with occasional spikes in volatility.

The run-up to the US Presidential Election in November may be a key factor in causing market volatility. Persistent social tensions in Hong Kong may disrupt local economy and business sentiment further. In Europe, political uncertainty around the ultimate shape of UK-EU relations may lead to occasional periods of market volatility and economic uncertainty. We believe our businesses are well placed to weather risks, but would nevertheless be affected by severe shocks.

Mitigating actions

• We actively assess the impact of economic developments in key markets on specific customer segments and portfolios and take appropriate mitigating actions. These actions include revising risk appetite and/or limits, as circumstances evolve.

• We use internal stress testing and scenario analysis, as well as regulatory stress test programmes, to evaluate the potential impact of macroeconomic shocks on our businesses and portfolios. Our approach to stress testing is described on page 75.

• We have carried out detailed reviews and stress tests of our wholesale credit, retail credit and trading portfolios to determine those sectors and customers most vulnerable to the UK's exit from the EU, in order to manage and mitigate this risk proactively.

• In Hong Kong we are actively monitoring our credit and trading portfolios. We have also performed internal stress tests and scenario analysis. We continue to support our customers and manage risk and exposures as appropriate.

Geopolitical risk

Our operations and portfolios are exposed to risks associated with political instability, civil unrest and military conflict, which could lead to disruption of our operations, physical risk to our staff and/or physical damage to our assets.

Global tensions over trade, technology and ideology can manifest themselves in divergent regulatory, standards and compliance regimes, presenting long-term strategic challenges for multinational businesses.

In 2019, societies in nearly all the markets in which we operate were affected by a series of common issues, which are likely to continue in 2020. Migration, income inequality, corruption, climate change and terrorism are examples of those issues, which have led to discontent in the markets in which we operate. This discontent is reflected in increased protest activity and challenging traditional political structures. This level of geopolitical risk is expected to remain heightened throughout 2020.

The UK formally left the EU on 31 January 2020 and entered a transition period until 31 December 2020. The top risk is that the UK fails to agree a trade deal with the EU and commits to its pledge to not extend the 11-month transition period. This scenario would likely renew economic and financial uncertainty.

In 2019, Hong Kong experienced heightened levels of domestic social unrest and, if prolonged, there could be broader economic ramifications, affecting several of the Group's portfolios.

In the US, there will be political uncertainty and increased partisanship, as the US Presidential election campaign was preceded by a presidential impeachment trial.

More broadly, intensified US-China competition and occasional confrontation are expected to feature prominently in 2020, despite the 'phase one' trade deal, as negotiations move to phase two, which covers aspects such as intellectual property.

The impact of US-China competition may also be felt in our other markets, particularly in Europe. New regulations from both the US and China will likely increase scrutiny of companies involved in cross-border data transfers and limit the use of foreign technology in private and national infrastructure. Combined, these regulations could drive the bifurcation of US and Chinese technology sectors, standards and supply chain ecosystems, which may limit innovation and drive up production and compliance costs for firms operating in both markets.

In the Middle East, Iran is expected to remain central to regional security in 2020. The risk of escalation remains high, and any mismanaged incidents would have significant regional security and global market repercussions. Continued geopolitical risks have negative implications for economic growth. Central banks in key markets are likely to see little need to raise their policy interest rates above current levels and may even resort to lowering rates to accommodate the risks to growth.

Mitigating actions

• We continually monitor the geopolitical outlook, in particular in countries where we have material exposures and/or a physical presence. We have also established dedicated forums to monitor geopolitical developments.

• We use internal stress tests and scenario analysis as well as regulatory stress test programmes to adjust limits and exposures to reflect our risk appetite and mitigate risks as appropriate. Our internal credit risk ratings of sovereign counterparties take into account geopolitical developments that could potentially disrupt our portfolios and businesses.

• We continue to carry out contingency planning following the UK's exit from the EU and we are assessing the potential impact on our portfolios, operations and staff. This includes the increased possibility of an exit without a comprehensive trade agreement.

• We have taken steps to enhance physical security in those geographical areas deemed to be at high risk from terrorism and military conflicts.

• In Hong Kong, we are actively monitoring our credit portfolio. We have performed internal stress tests and scenario analysis. We continue to support our customers and manage risk and exposures as appropriate.

The credit cycle

Dovish global monetary policies remained accommodative through much of 2019, and share indices hit record highs. The US FRB, European Central Bank ('ECB') and the Bank of Japan ('BoJ') are expected to keep global liquidity abundant in 2020. However, there are signs of stress in parts of the credit market, as shown by the FRB's interventions in the repo market. There has been a surge in borrowing by entities in the lowest investment grade segment, which now makes up 55% of the total universe of rated corporate bonds. Profit margins at US non-financial corporations are falling, as are job openings, both of which could foreshadow a turn in the credit cycle. Corporate credit quality in Europe is also deteriorating, leading to some analysts to predict a credit bear market largely centred on industrial sectors. However, sterling borrowers may suffer less than their euro counterparts, given UK policymakers' somewhat greater room for policy stimulus, and also the UK economy's lesser concentration in manufacturing, as opposed to services.

Chinese authorities are more concerned than in the past about increasing debt, but they are still expected to step up stimulus measures, particularly as a result of the coronavirus outbreak. Chinese economic stimulus could act to limit broader macroeconomic downside risks to a degree. Debt is high in some emerging markets, with specific events like an Argentine debt restructuring possibly having wider implications.

Mitigating actions

• We closely monitor economic developments in key markets and sectors and undertake scenario analysis. This helps enable us to take portfolio actions where necessary, including enhanced monitoring, amending our risk appetite and/or reducing limits and exposures.

• We stress test portfolios of particular concern to identify sensitivity to loss under a range of scenarios, with management actions being taken to rebalance exposures and manage risk appetite where necessary.

• We undertake regular reviews of key portfolios to help ensure that individual customer or portfolio risks are understood and our ability to manage the level of facilities offered through any downturn is appropriate.

Cyber threat and unauthorised access to systems

We and other organisations continue to operate in a challenging cyber threat environment, which requires ongoing investment in business and technical controls to defend against these threats.

Key threats include unauthorised access to online customer accounts, advanced malware attacks and distributed denial of service attacks.

Mitigating actions

• We continually evaluate threat levels for the most prevalent attack types and their potential outcomes. To further protect our business and our customers, we strengthened our controls to reduce the likelihood and impact of advanced malware, data leakage, infiltration of payment systems and denial of service attacks. We continued to enhance our cybersecurity capabilities, including threat detection and access control as well as back-up and recovery. An important part of our defence strategy is ensuring our people remain aware of cybersecurity issues and know how to report incidents.

• Cyber risk is a priority area for the Board. We report and review cyber risk and control effectiveness quarterly at executive and non-executive Board level. We also report it across the global businesses, functions and regions to help ensure appropriate visibility and governance of the risk and mitigating actions.

• We participate globally in several industry bodies and working groups to share information about tactics employed by cyber-crime groups and to collaborate in fighting, detecting and preventing cyber-attacks on financial organisations.

Regulatory developments including conduct, with adverse impact on business model and profitability

Financial service providers continue to face demanding regulatory and supervisory requirements, particularly in the areas of capital and liquidity management, conduct of business, financial crime, internal control frameworks, the use of models, digital, cyber, sustainability and the integrity of financial services delivery. HSBC is particularly affected by regulatory change, given the geographic scope of the Group's operations.

The competitive landscape in which the Group operates may be significantly altered by future regulatory changes and government intervention. Regulatory changes, including any resulting from the UK's exit from the EU, may affect the activities of the Group as a whole, or of some or all of its principal subsidiaries. This could include the loss of passporting rights and free movement of services, depending on the final terms of the future relationship between the UK and the EU. Changes to business models and structures will be necessary to accommodate any such restrictions.

As described in Note 34 on the financial statements, we continue to be subject to a number of material legal proceedings, regulatory actions and investigations, including our January 2018 deferred prosecution agreement with the US Department of Justice ('DoJ') arising from its investigation into HSBC's historical foreign exchange activities (the 'FX DPA').

Mitigating actions

• We continue to enhance our horizon scanning capabilities to identify new developments and regulatory publications. We are investing in - and rolling out - a new system that collects regulatory change information from multiple sources, to drive clear accountability and responsibility for the implementation and oversight of regulatory development.

• Relevant governance forums within the Group oversee change programmes. Significant regulatory programmes are overseen by the Group Change Committee.

• We are fully engaged, wherever appropriate, with governments and regulators in the countries in which we operate, to help ensure that new proposals achieve their policy objectives and can be implemented effectively. We hold regular meetings with all relevant authorities to discuss strategic contingency plans across the range of regulatory priorities.

• We have invested in significant resources and have taken, and will continue to take, a number of steps to improve our compliance systems and controls relating to our activities in global markets. These include enhancements to pricing and disclosure, order management and trade execution; trade, voice and audio surveillance; front office supervision; and improvements to our enforcement and discipline framework for employee misconduct. For further details, see 'Regulatory compliance risk management' on page 144.

Financial crime risk environment

Financial institutions remain under considerable regulatory scrutiny regarding their ability to prevent and detect financial crime. There is an increased regulatory focus on fraud and anti-bribery and corruption controls, with expectations that banks should do more to protect customers from fraud and identify and manage bribery and corruption risks within our businesses. Financial crime threats continue to evolve, often in tandem with geopolitical developments. The highly speculative, volatile and opaque nature of virtual currencies, including the pace of development in this area, create challenges in effectively managing financial crime risks. The evolving regulatory environment continues to present execution challenges. We continue to see increasing challenges presented by national data privacy requirements in a global organisation, which may affect our ability to effectively manage financial crime risks.

In December 2012, among other agreements, HSBC Holdings plc ('HSBC Holdings') agreed to an undertaking with the UK Financial Services Authority, which was replaced by a Direction issued by the UK Financial Conduct Authority ('FCA') in 2013, and consented to a cease-and-desist order with the US Federal Reserve Board ('FRB'), both of which contained certain forward-looking anti-money laundering ('AML') and sanctions-related obligations. HSBC also agreed to retain an independent compliance monitor (who is, for FCA purposes, a 'Skilled Person' under section 166 of the Financial Services and Markets Act and, for FRB purposes, an 'Independent Consultant') to produce periodic assessments of the Group's AML and sanctions compliance programme (the 'Skilled Person/Independent Consultant'). In December 2012, HSBC Holdings also entered into an agreement with the Office of Foreign Assets Control ('OFAC') regarding historical transactions involving parties subject to OFAC sanctions.

Reflective of HSBC's significant progress in strengthening its financial crime risk management capabilities, HSBC's engagement with the current Skilled Person will be terminated and a new Skilled Person with a narrower mandate will be appointed to assess the remaining areas that require further work in order for HSBC to transition fully to business-as-usual financial crime risk management. The Independent Consultant will continue to carry out an annual OFAC compliance review at the FRB's discretion. The role of the Skilled Person/Independent Consultant is discussed on page 145.

Mitigating actions

• We continue to enhance our financial crime risk management capabilities. We are investing in next generation capabilities to fight financial crime through the application of advanced analytics and artificial intelligence.

• We are strengthening and investing in our fraud controls, to introduce next generation anti-fraud capabilities to protect both customers and the Group.

• We continue to embed our improved anti-bribery and corruption policies and controls, focusing on conduct.

• We continue to educate our staff on emerging digital landscapes and associated risks.

• We have developed procedures and controls to help manage the risks associated with direct and indirect exposure to virtual currencies, and we continue to monitor external developments.

• We continue to work with jurisdictions and relevant international bodies to address data privacy challenges through international standards, guidance, and legislation to help enable effective management of financial crime risk.

• We continue to take steps designed to ensure that the reforms we have put in place are both effective and sustainable over the long term.

Ibor transition

Interbank offered rates ('Ibors') are used to set interest rates on hundreds of trillions of US dollars of different types of financial transactions and are used extensively for valuation purposes, risk measurement and performance benchmarking.

Following the announcement by the UK's FCA in July 2017 that it will no longer persuade or require banks to submit rates for the London interbank offered rate ('Libor') after 2021, the national working groups for the affected currencies were tasked with facilitating an orderly transition of the relevant Libors to their chosen replacement rates. The euro national working group is also responsible for facilitating an orderly transition of the Euro Overnight Index Average ('Eonia') to the euro short-term rate ('€STER') as a result of Eonia not being made compliant with the EU Benchmark Regulation.

The process of developing products that reference the replacement rates and transitioning legacy Ibor contracts exposes HSBC to material execution, conduct, contractual and financial risks.

Mitigating actions

• We have a global programme to facilitate an orderly transition from Libor and Eonia for our business and our clients. The execution of this programme is overseen by the Group Chief Risk Officer.

• Our programme is focused on developing alternative rate products that reference the proposed replacement rates and making them available to customers. It is also focused on the supporting processes and systems to developing these products. At the same time, we are developing the capability to transition, through repapering, outstanding Libor and Eonia contracts.

• We have identified a number of execution, conduct, litigation and financial risks and are in the process of addressing these. We continue to analyse these risks and their evolution over the course of the transition.

• We will continue to engage with industry participants and the official sector to support an orderly transition.

Climate-related risks

Climate change can have an impact across HSBC's risk taxonomy through both transition and physical channels. Transition risk can arise from the move to a low-carbon economy, such as through policy, regulatory and technological changes. Physical risk can arise through increasing severity and/or frequency of severe weather or other climatic events, such as rising sea levels and flooding.

These have the potential to cause both idiosyncratic and systemic risks, resulting in potential financial impacts for HSBC. Impacts could materialise through higher risk-weighted assets over the longer term, greater transactional losses and/or increased capital requirements.

The awareness of climate risk, regulatory expectations and reputational risk have all heightened through 2019. The exposure we have to the risk and materialisation of the risk have not materially heightened.

Mitigating actions

• We have an established governance framework to help ensure that risks associated with climate change are escalated to and discussed at the Board, as appropriate, in a timely manner. At each meeting, the Board is presented with a risk profile report, which includes key issues and common themes identified across the enterprise risk reports. In 2019, the Group Chief Risk Officer raised concerns directly by providing verbal or written updates on a regular basis to the Board and Group Management Board.

• We are in the process of incorporating climate-related risk, both physical and transition, into how we manage and oversee risks. We have a Board-approved risk appetite statement that contains a qualitative statement on our approach to climate risk, which we intend to further enhance in 2020.

• We continue to enhance our approach to climate-related risks, and develop and embed how we measure, monitor and manage it. An internal climate risk working group provides oversight by seeking to develop policy and limit frameworks to achieve desired portfolios over time, and protect the Group from climate-related risks that are outside of risk appetite.

• We have assigned responsibility to relevant senior management function holders, in line with the Prudential Regulation Authority ('PRA') and regulatory requirements. Climate risk has been brought under Reputational and Sustainability Risk to promote alignment. Risk stewards are expected to consider physical and transition risks from climate change relevant to their specific risk function.

• We are considering transition risk from three perspectives: understanding our exposure to transition risk; understanding how our clients are managing transition risk; and measuring our client's progress in reducing carbon emissions. We are carrying out sector-specific scenario analysis and continue to source data. For wholesale credit portfolios, we are using questionnaires to assess transition risk across six sectors and 11 countries (for further information, see our TCFD disclosure on page 22). For our retail credit portfolio, we review mortgage exposures on a geographical basis in respect of natural hazard risk and mitigants. For operational risk, we are working with our property insurers to understand geographical exposure of the property portfolio and assess effectiveness of controls for design resilience, operations and business continuity.

• We have public and internal policies for certain sectors that pose sustainability risk to our business. These include policies on energy, agricultural commodities, chemicals, forestry, mining and metals, and UNESCO World Heritage Sites and Ramsar-designated wetlands. We are working with the PRA, FCA and the wider industry through the Climate Financial Risk Forum to help ensure we remain aware of and drive emerging best practice.

• We continue to proactively engage our customers, investors and regulators in compiling and disclosing the data and information needed to manage the risks in transition to a low-carbon economy. This will be a key area of focus during 2020.

Internally driven

IT systems infrastructure and resilience

We are committed to investing in the reliability and resilience of our IT systems and critical services. We do so to protect our customers and ensure they do not receive disruption to services, which could result in reputational and regulatory damage.

Mitigating actions

• We continue to invest in transforming how software solutions are developed, delivered and maintained, with a particular focus on providing high-quality, stable and secure services. We are materially improving system resilience and service continuity testing. We have enhanced the security features of our software development life cycle and improved our testing processes and tools.

• We have upgraded many of our IT systems, simplified our service provision and replaced older IT infrastructure and applications. These enhancements led to continued global improvements in service availability during 2019 for both our customers and employees.

Risks associated with workforce capability, capacity and environmental factors with potential impact on growth

Our success in delivering our strategic priorities and proactively managing the regulatory environment depends on the development and retention of our leadership and high-performing employees. The ability to continue to attract, develop and retain competent individuals in alignment with our strategy in an employment market where expertise is often mobile and in short supply is critical, particularly as our business lines execute their strategic business outlooks. This may be affected by external, internal and environmental factors, such as the UK's exit from the EU, changes to immigration policies and regulations, organisational restructuring and tax reforms in key markets that require active responses.

Mitigating actions

• HSBC University is focused on developing opportunities and tools for current and future skills, personal skills and leaders to create an environment for success.

• We continue to develop succession plans for key management roles, with actions agreed and reviewed on a regular basis by the Group Management Board.

• We actively respond to immigration changes through the global immigration programme. Other political and regulatory challenges are closely monitored to minimise the impact on the attraction and retention of talent and key performers.

• We promote a diverse and inclusive workforce and provide active support across a wide range of health and well-being activities.

• We have robust plans in place, driven by senior management, to mitigate the effect of external factors that may impact our employment practices. We will also be monitoring the impact on people linked to organisational changes announced in 2020.

Risks arising from the receipt of services from third parties

We use third parties for the provision of a range of services, in common with other financial service providers. Risks arising from the use of third-party service providers may be less transparent and therefore more challenging to manage or influence. It is critical that we ensure we have appropriate risk management policies, processes and practices. These should include adequate control over the selection, governance and oversight of third parties, particularly for key processes and controls that could affect operational resilience. Any deficiency in our management of risks arising from the use of third parties could affect our ability to meet strategic, regulatory or customer expectations.

Mitigating actions

• We continued to embed our delivery model in the first line of defence through a dedicated team. We have deployed processes, controls and technology to assess third-party service providers against key criteria and associated control monitoring, testing and assurance.

• A dedicated oversight forum in the second line of defence monitors the embedding of policy requirements and performance against risk appetite. 

Enhanced model risk management expectations

Model risk arises whenever business decision making includes reliance on models. We use models in both financial and non-financial contexts and in a range of business applications such as customer selection, product pricing, financial crime transaction monitoring, creditworthiness evaluation and financial reporting.

Mitigating actions

We strengthened the Model Risk Management sub-function, including:

• We created a new Chief Model Risk Officer role, reporting directly to the Group Chief Risk Officer, which was filled on an interim basis.

• We appointed regional heads of Model Risk Management in all of our key geographies, and a Global Head of Model Risk Governance.

• We refined the model risk policy to enable a more risk-based approach to model risk management.

• We conducted a full review and enhancement of model governance arrangements overseeing model risk across the Group, resulting in a range of enhancements to the underlying structure to improve effectiveness and increase business engagement.

• We designed a new target operating model for Model Risk Management, informed by internal and industry best practice.

• We are refreshing the existing model risk controls to enable a better understanding of control objectives and to provide the modelling areas with implementation guidance to enhance effectiveness.

Data management

We use a large number of systems and applications to support key business processes and operations. As a result, we often need to reconcile multiple data sources, including customer data sources, to reduce the risk of error. Along with other organisations, we also need to meet external/regulatory obligations such as the General Data Protection Regulation ('GDPR'), the Basel Committee for Banking Supervision (BCBS 239) principles and Basel III.

Mitigating actions

• We are improving data quality across a large number of systems globally. Our data management, aggregation and oversight continue to strengthen and enhance the effectiveness of internal systems and processes. We are implementing data controls for critical processes in the front office systems to improve our data capture at the point of entry. We achieved a 'largely compliant' rating in support of the Basel Committee for Banking Supervision (BCBS 239) principles and have embedded them across the key markets and regions.

• We are expanding and enhancing our data governance processes to monitor proactively the quality of critical customer, product, reference and transaction data and resolving associated data issues in a timely manner. We have implemented data controls to improve the reliability of data used by our customers and staff.

• We are modernising our data and analytics infrastructure through investments in advanced capabilities in Cloud, visualisation, machine learning and artificial intelligence platforms.

• We have implemented a global data privacy framework that establishes data privacy practices, design principles and guidelines that demonstrate compliance with data privacy laws and regulations in the jurisdictions in which we operate, such as the GDPR in the UK and the EU, and the California Consumer Protection Act in the US state of California.

• We continue to hold annual data symposiums and data privacy awareness training to help our employees keep abreast of data management and data privacy laws and regulations. These highlight our commitment to protect personal data for our customers, employees and stakeholders.

During 2019, a number of areas were identified and considered as part of our top and emerging risks because of the effect they may have on the Group. While considered under the themes captured under top and emerging risks, in this section we have placed a particular focus on the UK withdrawal from the EU, Ibor transition and the risks to our operations and portfolios in Asia-Pacific.

UK withdrawal from the European Union

The UK left the EU on 31 January 2020 and entered a transition period until 31 December 2020, during which negotiations will take place on the future relationship between the UK and the EU. At this stage it remains unclear what that relationship will look like, potentially leaving firms with little time to adapt to changes, which may enter into force on 1 January 2021. Our programme to manage the impact of the UK leaving the EU has now been largely completed. It is based on the assumption of a scenario whereby the UK exits the transition period without the existing passporting or regulatory equivalence framework that supports cross-border business. Our focus has been on four main components: legal entity restructuring; product offering; customer migrations; and employees.

Legal entity restructuring

Our branches in seven European Economic Area ('EEA') countries (Belgium, the Netherlands, Luxembourg, Spain, Italy, Ireland and Czech Republic) relied on passporting out of the UK. We had worked on the assumption that passporting will no longer be possible following the UK's departure from the EU and therefore transferred our branch business to newly established branches of HSBC France, our primary banking entity authorised in the EU. This was completed in the first quarter of 2019.

Product offering

To accommodate for customer migrations and new business after the UK's departure from the EU, we expanded and enhanced our existing product offering in France, the Netherlands and Ireland. We also opened a new branch in Stockholm to service our customers in the Nordic region.

Customer migrations

The UK's departure from the EU is likely to have an impact on our clients' operating models, including their working capital requirements, investment decisions and financial markets infrastructure access. Our priority is to provide continuity of service, and while our intention is to minimise the level of change for our customers, we are required to migrate some EEA-incorporated clients from the UK to HSBC France, or another EEA entity. We have now migrated most clients who we expect can no longer be serviced out of the UK. We are working in close collaboration with any remaining clients to make the transition as smooth as possible.

Employees

The migration of EEA-incorporated clients will require us to strengthen our local teams in the EU, and France in particular.

Given the scale and capabilities of our existing business in France, we are well prepared to take on additional roles and activities. Looking beyond the transfer of roles to the EU, we are also providing support to our employees who are UK citizens resident in EEA countries, and employees who are citizens of an EU member state resident in the UK (e.g. on settlement applications).

At December 2019, HSBC employed approximately 40,000 people in the UK.

Across the programme, we have made good progress in terms of ensuring we are prepared for the UK leaving the EU under the terms described above. However, there remain execution risks, many of them linked to the uncertain outcome of negotiations.

We have carried out detailed reviews of our credit portfolios to determine those sectors and customers most vulnerable to the UK's exit from the EU. For further details, see 'Impact of alternative/additional scenarios' on page 95.

Ibor transition

The Financial Stability Board has observed that the decline in interbank short-term unsecured funding poses structural risks for interest rate benchmarks that reference these markets. In response, regulators and central banks in various jurisdictions have convened national working groups to identify replacement rates (risk-free rates or RFRs) for these Ibors and, where appropriate, to facilitate an orderly transition to these rates.

Following the announcement by the UK's FCA in July 2017 that it will no longer persuade or require banks to submit rates for Libor after 2021, the national working groups for the affected currencies were tasked with facilitating an orderly transition of the relevant Libors to their chosen replacement rates. The euro working group is also responsible for facilitating an orderly transition of the Euro Overnight Index Average ('Eonia') to the euro short-term rate ('€STER') as a result of Eonia not being made compliant with the EU Benchmark Regulation.

Although national working groups in other jurisdictions have identified replacements for their respective Ibors, there is no intention for these benchmark rates to be discontinued.

Given the current lack of alternatives, HSBC has an increasing portfolio of contracts referencing Libor and Eonia with maturities beyond 2021. HSBC established the Ibor transition programme with the objective of facilitating an orderly transition from Libor and Eonia for HSBC and its clients. This global programme oversees the transition effected by each of the global businesses and is led by the Group Chief Risk Officer.

The programme's strategic objectives can be broadly grouped into two streams of work: develop RFR product capabilities; and transition legacy contracts.

Develop RFR product capabilities

Our global businesses are currently developing their capabilities to offer RFR-based products and the supporting processes and systems. We already have several capabilities live - including SOFR bonds and Sonia bonds, SOFR futures and Sonia swaps - and we are planning further launches in 2020, with the initial focus being on the UK, the US, Hong Kong and France.

The sale of Libor and Eonia contracts with maturities beyond 2021 is likely to continue until RFR-based products become widely available and accepted by customers.

Transition legacy contracts

In addition to enabling the offering of new RFR-based products, the new RFR product capabilities will also help enable the transition of outstanding Libor and Eonia products onto the RFR equivalents. To help enable the repapering of a significant number of Libor and Eonia contracts, the programme is also developing the capability to transition outstanding Libor and Eonia contracts at scale. Critical to the successful transition of Libor-linked contracts is the active engagement of other market participants and HSBC's clients.

Although we have notional amounts of around $5tn of Libor and Eonia derivative contracts outstanding that mature beyond 2021, we expect that ISDA's efforts in guiding the transition of derivative contracts to reduce the risk of a non-orderly transition of the derivative market with an estimated notional size in excess of $200tn. The process of implementing ISDA's proposed protocol and transitioning outstanding contracts is nonetheless a material undertaking for the industry as a whole and may expose HSBC to the risk of financial losses.

The Group intends to engage actively in the process to achieve an orderly transition of HSBC's Libor and Eonia bond issuance, HSBC's holdings of Libor and Eonia bonds, and of those bonds where HSBC is the payment agent. We continue to formulate detailed plans to enable us to transition these exposures, although the execution of these transition plans will, to a certain extent, also depend on the participation and engagement of third-party market participants in the transition process.

Although we have plans to transition approximately $100bn drawn amounts of post-2021 contractually Ibor-referenced commercial loans onto replacement rates, our ability to transition this portfolio by the end of 2021 is materially dependent on the availability of products that reference the replacement rates and on our customers being ready and able to adapt their own processes and systems to accommodate the replacement products. This gives rise to an elevated level of conduct-related risk. HSBC is engaging with impacted clients to help ensure that customers are aware of the risks associated with the ongoing purchase of Libor- and Eonia-referencing contracts as well as the need to transition legacy contracts prior to the end of 2021.

In addition to the conduct and execution risk previously highlighted, the process of adopting new reference rates may expose the Group to an increased level of operational and financial risks, such as potential earnings volatility resulting from contract modifications and a large volume of product and associated process changes. Furthermore, the transition to alternative reference rates could have a range of adverse impacts on our business, including legal proceedings or other actions regarding the interpretation and enforceability of provisions in Ibor-based contracts and regulatory investigations or reviews in respect of our preparation and readiness for the replacement of Ibor with alternative reference rates. We continue to engage with industry participants, the official sector and our clients to support an orderly transition and the mitigation of the risks resulting from the transition. The FCA's and PRA's recent letter to senior managers of institutions, including HSBC, that fall within their remit, should increase the level and depth of engagement as well as accelerating transition in the sterling Libor markets.

Risks to our operations and portfolios in Asia-Pacific

In 2019, the Chinese economy grew at the slowest pace in nearly three decades in the context of rising domestic leverage. The authorities are expected to enact modest stimulus measures to boost growth. Along with the 'phase one' US-China trade deal and plentiful global liquidity, these measures should help emerging-market growth to make a partial recovery. Nevertheless, downside idiosyncratic risks will abound.

Intensified US-China competition and occasional confrontation continued to feature prominently in 2019. The two countries now compete across multiple dimensions: economic power; diplomatic influence; innovation and advanced technology leadership; and military dominance in Asia. In 2019, we saw heightened levels of risk in Hong Kong.

The downside risk is further increased given the coronavirus outbreak, which could further impact the local economy and dampen investor and business sentiment in many sectors where the Group has a material presence. The increasing headwinds will be challenging and we will continue to monitor our portfolios to thoughtfully manage our risk exposures. We have reviewed and enhanced our business continuity plans to help ensure minimal disruption to our clients and continued safe operation of our branches and employees. The new coronavirus outbreak is being actively monitored. It will have an immediate impact on the economic scenarios used for ECL, as key inputs for calculating ECL such as GDP for Hong Kong and mainland China are weakening, and the probability of a particularly adverse economic scenario for the short term is higher. The economic scenarios for Hong Kong used for ECL at 31 December 2019 are set out on pages 95 to 97. In addition, should the virus continue to cause disruption to economic activity in Hong Kong and mainland China through 2020, there could be adverse impacts on income due to lower lending and transaction volumes, and insurance manufacturing revenue. Further expected credit losses could arise from other parts of our business impacted by the disruption to supply chains. In Hong Kong, we have initiated a number of measures to support customers during the coronavirus outbreak. The uptake of these measures to date was immaterial.

We have invoked our business continuity plans to help ensure the safety and well-being of our staff while enhancing our ability to support our customers and maintain our business operations.

We regularly conduct stress tests to assess the resilience of our balance sheet and our capital adequacy. We conduct this across the Group and in key sites such as Hong Kong. The stress tests are used to consider our risk appetite and to provide insights into our financial stability. In the case of Hong Kong, our balance sheet and capital adequacy remain resilient based on regulatory and internal stress test outcomes.

Our central scenario for Hong Kong, used as a key input for calculating expected credit losses in Hong Kong, has kept pace with expectations of economic growth. The economy entered a technical recession in the second half of 2019 and is expected to record negative annual GDP growth for the first time since 2009. This is a result of both tensions over trade and tariffs between the US and China and domestic social unrest. The economy is expected to gradually recover in 2020. We have also developed a number of additional scenarios to capture more extreme downside risks, and have used these in impairment testing and measuring and to assess our capital resilience. While our economic scenarios used to calculate credit loss capture a range of outcomes, the potential economic impact of the coronavirus was not explicitly considered at the year end due to the limited information and emergent nature of the outbreak in December 2019.

For further details of all scenarios used in impairment measurements, see 'Measurement uncertainty and sensitivity analysis of ECL estimates' on page 92.

The material risk types associated with our banking and insurance manufacturing operations are described in the following tables:

Our insurance manufacturing subsidiaries are regulated separately from our banking operations. Risks in our insurance entities are managed using methodologies and processes that are subject to

Group oversight. Our insurance operations are also subject to some of the same risks as our banking operations, which are covered by the Group's risk management processes.

Overview

Credit risk is the risk of financial loss if a customer or counterparty fails to meet an obligation under a contract. Credit risk arises principally from direct lending, trade finance and leasing business, but also from other products such as guarantees and credit derivatives.

Credit risk management

Key developments in 2019

There were no material changes to the policies and practices for the management of credit risk in 2019. We continued to apply the requirements of IFRS 9 'Financial Instruments' within Credit Risk.

Governance and structure

We have established Group-wide credit risk management and related IFRS 9 processes. We continue to assess actively the impact of economic developments in key markets on specific customers, customer segments or portfolios. As credit conditions change, we take mitigating action, including the revision of risk appetites or limits and tenors, as appropriate. In addition, we continue to evaluate the terms under which we provide credit facilities within the context of individual customer requirements, the quality of the relationship, local regulatory requirements, market practices and our local market position.

Credit risk sub-function

(Audited)

Credit approval authorities are delegated by the Board to the Group Chief Executive together with the authority to sub-delegate them. The Credit Risk sub-function in Global Risk is responsible for the key policies and processes for managing credit risk, which include formulating Group credit policies and risk rating frameworks, guiding the Group's appetite for credit risk exposures, undertaking independent reviews and objective assessment of credit risk, and monitoring performance and management of portfolios.

The principal objectives of our credit risk management are:

• to maintain across HSBC a strong culture of responsible lending, and robust risk policies and control frameworks;

• to both partner and challenge our businesses in defining, implementing and continually re-evaluating our risk appetite under actual and scenario conditions; and

• to ensure there is independent, expert scrutiny of credit risks, their costs and their mitigation.

Key risk management processes

IFRS 9 'Financial Instruments' process

The IFRS 9 process comprises three main areas: modelling and data; implementation; and governance.

Modelling and data

We have established IFRS 9 modelling and data processes in various geographies, which are subject to internal model risk governance including independent review of significant model developments.

Implementation

A centralised impairment engine performs the expected credit loss ('ECL') calculation using data, which is subject to a number of validation checks and enhancements, from a variety of client, finance and risk systems. Where possible, these checks and processes are performed in a globally consistent and centralised manner.

Governance

Regional management review forums are established in key sites and regions in order to review and approve the impairment results. Regional management review forums have representatives from Credit Risk and Finance. The key site and regional approvals are reported up to the global business impairment committee for final approval of the Group's ECL for the period. Required members of the committee are the global heads of Wholesale Credit, Market Risk, and Retail Banking and Wealth Management Risk, as well as the global business chief financial officers and the Group Chief Accounting Officer.

Concentration of exposure

(Audited)

Concentrations of credit risk arise when a number of counterparties or exposures have comparable economic characteristics, or such counterparties are engaged in similar activities or operate in the same geographical areas or industry sectors so that their collective ability to meet contractual obligations is uniformly affected by changes in economic, political or other conditions. We use a number of controls and measures to minimise undue concentration of exposure in our portfolios across industries, countries and global businesses. These include portfolio and counterparty limits, approval and review controls, and stress testing.

Credit quality of financial instruments

(Audited)

Our risk rating system facilitates the internal ratings-based approach under the Basel framework adopted by the Group to support the calculation of our minimum credit regulatory capital requirement. The five credit quality classifications each encompass a range of granular internal credit rating grades assigned to wholesale and retail lending businesses, and the external ratings attributed by external agencies to debt securities.

For debt securities and certain other financial instruments, external ratings have been aligned to the five quality classifications based upon the mapping of related customer risk rating ('CRR') to external credit rating.

Wholesale lending

The CRR 10-grade scale summarises a more granular underlying 23-grade scale of obligor probability of default ('PD'). All corporate customers are rated using the 10- or 23-grade scale, depending on the degree of sophistication of the Basel approach adopted for the exposure.

Each CRR band is associated with an external rating grade by reference to long-run default rates for that grade, represented by the average of issuer-weighted historical default rates. This mapping between internal and external ratings is indicative and may vary over time.

Retail lending

Retail lending credit quality is based on a 12-month point-in-time probability-weighted PD.

1 Customer risk rating ('CRR').

2 12-month point-in-time probability-weighted probability of default ('PD').

Renegotiated loans and forbearance

(Audited)

'Forbearance' describes concessions made on the contractual terms of a loan in response to an obligor's financial difficulties.

A loan is classed as 'renegotiated' when we modify the contractual payment terms on concessionary terms because we have significant concerns about the borrowers' ability to meet contractual payments when due. Non-payment-related concessions (e.g. covenant waivers), while potential indicators of impairment, do not trigger identification as renegotiated loans.

Loans that have been identified as renegotiated retain this designation until maturity or derecognition.

For details of our policy on derecognised renegotiated loans, see Note 1.2(i) on the financial statements.

Credit quality of renegotiated loans

On execution of a renegotiation, the loan will also be classified as credit impaired if it is not already so classified. In wholesale lending, all facilities with a customer, including loans that have not been modified, are considered credit impaired following the identification of a renegotiated loan.

Wholesale renegotiated loans are classified as credit impaired until there is sufficient evidence to demonstrate a significant reduction in the risk of non-payment of future cash flows, observed over a minimum one-year period, and there are no other indicators of impairment. Personal renegotiated loans generally remain credit impaired until repayment, write-off or derecognition.

Renegotiated loans and recognition of expected credit losses

(Audited)

For retail lending, unsecured renegotiated loans are generally segmented from other parts of the loan portfolio. Renegotiated expected credit loss assessments reflect the higher rates of losses typically encountered with renegotiated loans. For wholesale lending, renegotiated loans are typically assessed individually. Credit risk ratings are intrinsic to the impairment assessments. The individual impairment assessment takes into account the higher risk of the future non-payment inherent in renegotiated loans.

Impairment assessment

(Audited)

For details of our impairment policies on loans and advances and financial investments, see Note 1.2(i) on the financial statements.

Write-off of loans and advances

(Audited)

For details of our policy on the write-off of loans and advances, see Note 1.2(i) on the financial statements.

Unsecured personal facilities, including credit cards, are generally written off at between 150 and 210 days past due. The standard period runs until the end of the month in which the account becomes 180 days contractually delinquent. Write-off periods may be extended, generally to no more than 360 days past due. However, in exceptional circumstances, they may be extended further.

For secured facilities, write-off should occur upon repossession of collateral, receipt of proceeds via settlement, or determination that recovery of the collateral will not be pursued.

Any secured assets maintained on the balance sheet beyond60 months of consecutive delinquency-driven default require additional monitoring and review to assess the prospect of recovery.

There are exceptions in a few countries and territories where local regulation or legislation constrains earlier write-off, or where the realisation of collateral for secured real estate lending takes more time. In the event of bankruptcy or analogous proceedings, write-off may occur earlier than the maximum periods stated above. Collection procedures may continue after write-off.

Credit risk in 2019

Gross loans and advances to customers of $1,045bn at 31 December 2019 increased from $990bn at 31 December 2018. This increase included favourable foreign exchange movements of $13bn. Loans and advances to banks of $69bn at 31 December 2019 decreased from $72bn at 31 December 2018. This included adverse foreign exchange movements of $0.1bn. Wholesale and personal lending movements are disclosed on pages 104 to 124. The change in expected credit losses and other credit impairment charges, as it appears in the income statement, for the period was $2.8bn compared with $1.8bn in 2018.

Income statement movements are analysed further on page 49.

Our maximum exposure to credit risk is presented on page 91 and credit quality on page 100. While credit risk arises across most of our balance sheet, ECL have typically been recognised on loans and advances to customers and banks and securitisation exposures and other structured products. As a result, our disclosures focus primarily on these two areas.

Re-presentation of UK gross carrying/nominal amounts staging

The wholesale lending gross carrying/nominal amounts in stages 1 and 2, which were disclosed at 31 December 2018, have been re-presented to reflect the UK economic uncertainty adjustment, which was not previously reflected in the stage allocation. The 31 December 2018 amounts reflected the probability-weighted view of stage allocation for the consensus scenarios only. In comparison, the allowance for ECL did reflect the UK economic uncertainty adjustment. As a result of the re-presentation, there has been an increase in stage 2 amounts, with a corresponding decrease in stage 1. The financial instruments and disclosures impacted are as follows:

• Loans and advances to customers: A change of $6,795m comprised $6,562m for corporate and commercial and $233m for non-bank financial institutions, which can be seen on pages 89, 99, 103, 106, 108, 110 and 128.

• Loans and other credit-related commitments: A change of $2,018m was attributable to $1,891m for corporate and commercial and $127m for non-bank financial institutions, which can be seen on pages 89, 99, 103, 106, 108, 110 and 128.

• Financial guarantees: A change of $50m comprised $48m for corporate and commercial and $2m for non-bank financial institutions, which can be seen on pages 89, 99, 103, 106, 108, 110 and 128.

• Commercial real estate lending: There was a change of $819m, which can be seen on page 111.

• Wholesale lending - commercial real estate loans and advances including loan commitments by level of collateral: There was a change of $1,236m, which can be seen on page 114.

• Wholesale lending - other corporate, commercial and financial (non-bank) loans and advances including loan commitments by level of collateral: There was a change of $7,641m, which can be seen on page 118.

The 'Reconciliation of changes in gross carrying/nominal amount and allowances for loans and advances to banks and customers, including loan commitments and financial guarantees' disclosure for 31 December 2018 reflects this re-presentation in other movements of $8,935m, and for foreign exchange there was a$72m adverse movement. There is no impact upon total gross carrying values/nominal amounts, personal lending amounts or allowance for ECL.

Summary of credit risk

The following disclosure presents the gross carrying/nominal amount of financial instruments to which the impairment requirements in IFRS 9 are applied and the associated allowance for ECL.

The allowance for ECL increased from $9.2bn at 31 December 2018 to $9.4bn at 31 December 2019. This increase included adverse foreign exchange movements of $0.1bn.

The allowance for ECL at 31 December 2019 comprised $8.9bn in respect of assets held at amortised cost, $0.4bn in respect of loan commitments and financial guarantees, and $0.2bn in respect of debt instruments measured at fair value through other comprehensive income ('FVOCI').

1 The total ECL is recognised in the loss allowance for the financial asset unless the total ECL exceeds the gross carrying amount of the financial asset, in which case the ECL is recognised as a provision.

2 Includes only those financial instruments that are subject to the impairment requirements of IFRS 9. 'Prepayments, accrued income and other assets', as presented within the consolidated balance sheet on page 231, includes both financial and non-financial assets.

3 Represents the maximum amount at risk should the contracts be fully drawn upon and clients default.

4 Debt instruments measured at FVOCI continue to be measured at fair value with the allowance for ECL as a memorandum item. Change in ECL is recognised in 'Change in expected credit losses and other credit impairment charges' in the income statement.

The following table provides an overview of the Group's credit risk by stage and industry, and the associated ECL coverage. The financial assets recorded in each stage have the following characteristics:

• Stage 1: These financial assets are unimpaired and without significant increase in credit risk on which a 12-month allowance for ECL is recognised.

• Stage 2: A significant increase in credit risk has been experienced on these financial assets since initial recognition for which a lifetime ECL is recognised.

• Stage 3: There is objective evidence of impairment and the financial assets are therefore considered to be in default or otherwise credit impaired on which a lifetime ECL is recognised.

• POCI: Financial assets that are purchased or originated at a deep discount are seen to reflect the incurred credit losses on which a lifetime ECL is recognised.

1 Represents the maximum amount at risk should the contracts be fully drawn upon and clients default.

2 Purchased or originated credit-impaired ('POCI').

Unless identified at an earlier stage, all financial assets are deemed to have suffered a significant increase in credit risk when they are 30 days past due ('DPD') and are transferred from stage 1 to stage 2. The following disclosure presents the ageing of stage 2 financial assets by those less than 30 days and greater than 30 DPD and therefore presents those financial assets classified as stage 2 due to ageing (30 DPD) and those identified at an earlier stage (less than 30 DPD).

1 Days past due ('DPD'). Up to date accounts in stage 2 are not shown in amounts.

1 Represents the maximum amount at risk should the contracts be fully drawn upon and clients default.

2 Purchased or originated credit-impaired ('POCI').

3 During the period, the Group has re-presented the UK wholesale lending stage 1 and stage 2 amount. For further details, see page 86.

1 Days past due ('DPD'). Up to date accounts in stage 2 are not shown in amounts.

2 During the period, the Group has re-presented the UK wholesale lending stage 1 and stage 2 amount. For further details, see page 86.

Credit exposure

Maximum exposure to credit risk

(Audited)

This section provides information on balance sheet items and their offsets as well as loan and other credit-related commitments. Commentary on consolidated balance sheet movements in 2019 is provided on page 53.

Other credit risk mitigants

While not disclosed as an offset in the following 'Maximum exposure to credit risk' table, other arrangements are in place that reduce our maximum exposure to credit risk. These include a charge over collateral on borrowers' specific assets, such as residential properties, collateral held in the form of financial instruments that are not held on the balance sheet and short positions in securities. In addition, for financial assets held as part of linked insurance/investment contracts the risk is predominantly borne by the policyholder. See page 245 and Note 30 on the financial statements for further details of collateral in respect of certain loans and advances and derivatives.

Collateral available to mitigate credit risk is disclosed in the 'Collateral' section on page 112.

Concentration of exposure

We have a number of global businesses with a broad range of products. We operate in a number of geographical markets with the majority of our exposures in Asia and Europe.

For an analysis of:

• financial investments, see Note 16 on the financial statements;

• trading assets, see Note 11 on the financial statements;

• derivatives, see page 119 and Note 15 on the financial statements; and

• loans and advances by industry sector and by the location of the principal operations of the lending subsidiary (or, in the case of the operations of The Hongkong and Shanghai Banking Corporation, HSBC Bank plc, HSBC Bank Middle East Limited and HSBC Bank USA, by the location of the lending branch), see page 104 for wholesale lending and page 119 for personal lending.

Credit deterioration of financial instruments

(Audited)

A summary of our current policies and practices regarding the identification, treatment and measurement of stage 1, stage 2, stage 3 (credit impaired) and POCI financial instruments can be found in Note 1.2 on the financial statements.

Measurement uncertainty and sensitivity analysis of ECL estimates

(Audited)

The recognition and measurement of ECL involves the use of significant judgement and estimation. We form multiple economic scenarios based on economic forecasts, apply these assumptions to credit risk models to estimate future credit losses, and probability-weight the results to determine an unbiased ECL estimate.

Methodology

We use multiple economic scenarios to reflect assumptions about future economic conditions, starting with three economic scenarios based on consensus forecast distributions, supplemented by alternative or additional economic scenarios and/or management adjustments where, in management's judgement, the consensus forecast distribution does not adequately capture the relevant risks.

The three economic scenarios represent the 'most likely' outcome and two less likely outcomes referred to as the Upside and Downside scenarios. Each outer scenario is consistent with a probability of 10%, while the Central scenario is assigned the remaining 80%, according to the decision of HSBC's senior management. This weighting scheme is deemed appropriate for the unbiased estimation of ECL in most circumstances.

Economic assumptions in the Central consensus economic scenario are set using the average of forecasts of external economists. Reliance on external forecasts helps ensure that the Central scenario is unbiased and maximises the use of independent information. The Upside and Downside scenarios are selected with reference to externally available forecast distributions and are designed to be cyclical, in that GDP growth, inflation and unemployment usually revert back to the Central scenario after the first three years for major economies. We determine the maximum divergence of GDP growth from the Central scenario using the 10th and the 90th percentile of the entire distribution of forecast outcomes for major economies. While key economic variables are set with reference to external distributional forecasts, we also align the overall narrative of the scenarios to the macroeconomic risks described in HSBC's 'Top and emerging risks' on page 76. This ensures that scenarios remain consistent with the more qualitative assessment of these risks. We project additional variable paths using an external provider's global macro model.

The Upside and Downside scenarios are generated once a year, reviewed at each reporting date to ensure that they are an appropriate reflection of management's view and updated if economic conditions change significantly. The Central scenario is generated every quarter. For quarters without updates to outer scenarios, we use the updated Central scenario to approximate the impact of the most recent outer scenarios on wholesale and retail credit risk exposures.

Additional scenarios are created, as required, to address those forward-looking risks that management considers are not adequately captured by the consensus. At the reporting date, we deployed additional scenarios to address economic uncertainty in the UK, the impact of deteriorating trade relations between China and the US on key Asian economies and to address the possibility of a further weakening in economic growth in Hong Kong.

Description of consensus economic scenarios

The economic assumptions presented in this section have been formed by HSBC with reference to external forecasts specifically for the purpose of calculating ECL.

The consensus Central scenario

Our Central scenario is one of moderate growth over the forecast 2020-2024 period, which reflects an overall trend of deterioration

observed over the course of 2019. Global GDP growth is expected to be 2.8% on average over the period, which is marginally lower than the average growth rate over the 2014-2018 period. Across the key markets, we note:

• Expected average rates of GDP growth over the 2020-2024 period are lower than average growth rates achieved over the 2014-2018 period in all of our key markets. For the UK, this reflects expectations that the long-term impact of current economic uncertainty will be moderately adverse, while for China, it is consistent with the theme of ongoing rebalancing from an export-oriented economy to deeper domestic consumption. Short-term expectations of economic growth in Hong Kong weakened in the second half of 2019.

• The unemployment rate is expected to rise over the forecast horizon in most of our major markets.

• Inflation is expected to be stable and will remain close to central bank targets in our core markets over the forecast period.

• Major central banks lowered their main policy interest rates in 2019 and are expected to continue to maintain a low interest rate environment over the projection horizon. The FRB has resumed asset purchases to provide liquidity and the ECB has restarted its asset purchase programmes.

• The West Texas Intermediate oil price is forecast to average$59 per barrel over the projection period.

The following table describes key macroeconomic variables and the probabilities assigned in the consensus Central scenario.