HSBC Holdings Regulatory News (HSBA)

Identifying suspicious activities through our award-winning AI tool

We are using the latest artificial intelligence technology to help identify suspicious activities to help prevent financial crime.

Our dynamic risk assessment solution brings data together on the Cloud, and uses machine learning to analyse and identify criminal activity by making use of relevant data, with the ability to identify patterns that humans are unlikely to spot.

The tool, which we first developed in November 2021 and is active in several markets including the UK, enables suspicious activity to be identified twice as fast than the previous process and reduces case volumes by 60%.

The solution was recognised at the 2022 Banking Tech Awards, winning 'Best Use of Cloud' and 'Best Use of AI'. We plan to roll it out to other markets throughout 2023.

Our risk appetite

We recognise the importance of a strong culture, which refers to our shared attitudes, beliefs, values and standards that shape behaviours including those related to risk awareness, risk taking and risk management. All our people are responsible for the management of risk, with the ultimate accountability residing with the Board.

We seek to build our business for the long term by balancing social, environmental and economic considerations in the decisions we make. Our strategic priorities are underpinned by our endeavour to operate in a sustainable way. This helps us to carry out our social responsibility and manage the risk profile of the business. We are committed to managing and mitigating climate-related risks, both physical and transition risks, and continue to incorporate consideration of these into how we manage and oversee risks internally and with our customers.

The following principles guide the Group's overarching appetite for risk and determine how our businesses and risks are managed.

Financial position

• We aim to maintain a strong capital position, defined by regulatory and internal capital ratios.

• We carry out liquidity and funding management for each operating entity, on a stand-alone basis.

Operating model

• We seek to generate returns in line with our risk appetite and strong risk management capability.

• We aim to deliver sustainable and diversified earnings and consistent returns for shareholders.

Business practice

• We have no appetite for deliberately or knowingly causing detriment to consumers, or incurring a breach of the letter or spirit of regulatory requirements.

• We have no appetite for inappropriate market conduct by any member of staff or by any Group business.

• We are committed to managing the climate risks that have an impact on our financial position, and delivering on our net zero ambition.

• We consider and, where appropriate, mitigate reputational risk that may arise from our business activities and decisions.

• We monitor non-financial risk exposure against risk appetite, including exposure related to inadequate or failed internal processes, people and systems, or events that impact our customers or can lead to sub-optimal returns to shareholders, censure, or reputational damage.

Enterprise-wide application

Our risk appetite encapsulates the consideration of financial and non-financial risks. We define financial risk as the risk of a financial loss as a result of business activities. We actively take these types of risks to maximise shareholder value and profits. Non-financial risk is the risk to achieving our strategy or objectives as the result of failed internal processes, people and systems, or from external events.

Our risk appetite is expressed in both quantitative and qualitative terms and applied at the global business level, at the regional level and to material operating entities. Every three years, the Group Risk and Compliance function commissions an external independent firm to review the Group's approach to risk appetite and to help ensure that it remains in line with market best practice and regulatory expectations. This review was last carried out in 2021 and confirmed the Group's risk appetite statement ('RAS') remains aligned to best practices, regulatory expectations and strategic goals. Our risk appetite continues to evolve and expand its scope as part of our regular review process.

The Board reviews and approves the Group's risk appetite regularly to make sure it remains fit for purpose. The Group's risk appetite is considered, developed and enhanced through:

• an alignment with our strategy, purpose, values and customer needs;

• trends highlighted in other Group risk reports;

• communication with risk stewards on the developing risk landscape;

• strength of our capital, liquidity and balance sheet;

• compliance with applicable laws and regulations;

• effectiveness of the applicable control environment to mitigate risk, informed by risk ratings from risk control assessments;

• functionality, capacity and resilience of available systems to manage risk; and

• the level of available staff with the required competencies to manage risks.

We formally articulate our risk appetite through our RAS. Setting out our risk appetite ensures that we agree a suitable level of risk for our strategy. In this way, risk appetite informs our financial planning process and helps senior management to allocate capital to business activities, services and products.

The RAS is applied to the development of business line strategies, strategic and business planning and remuneration. At a Group level, performance against the RAS is reported to the Group Risk Management Meeting alongside key risk indicators to support targeted insight and discussion on breaches of risk appetite and any associated mitigating actions. This reporting allows risks to be promptly identified and mitigated, and informs risk-adjusted remuneration to drive a strong risk culture.

Each global business, region and material operating entity is required to have its own RAS, which is monitored to help ensure it remains aligned with the Group's RAS. Each RAS and business activity is guided and underpinned by qualitative principles and/or quantitative metrics.

Risk management

We recognise that the primary role of risk management is to protect our customers, business, colleagues, shareholders and the communities that we serve, while ensuring we are able to support our strategy and provide sustainable growth. This is supported through our three lines of defence model described on page 134.

The implementation of our business strategy remains a key focus. As we implement change initiatives, we actively manage the execution risks. We also perform periodic risk assessments, including against strategies, to help ensure retention of key personnel for our continued safe operation.

We aim to use a comprehensive risk management approach across the organisation and across all risk types, underpinned by our culture and values. This is outlined in our risk management framework, including the key principles and practices that we employ in managing material risks, both financial and non-financial. The framework fosters continual monitoring, promotes risk awareness and encourages a sound operational and strategic decision-making and escalation process. It also supports a consistent approach to identifying, assessing, managing and reporting the risks we accept and incur in our activities, with clear accountabilities. We actively review and enhance our risk management framework and our approach to managing risk, through our activities with regard to: people and capabilities; governance; reporting and management information; credit risk management models; and data.

Group Risk and Compliance is independent from the global businesses, including our sales and trading functions, to provide challenge, oversight and appropriate balance in risk/return decisions.

Our risk management framework

The following diagram and descriptions summarise key aspects of the risk management framework, including governance, structure, risk management tools and our culture, which together help align employee behaviour with risk appetite.

Risk governance

The Board has ultimate responsibility for the effective management of risk and approves our risk appetite.

The Group Chief Risk and Compliance Officer, supported by the Group Risk Management Meeting, holds executive accountability for the ongoing monitoring, assessment and management of the risk environment and the effectiveness of the risk management framework.

The Group Chief Risk and Compliance Officer is also responsible for the oversight of reputational risk, with the support of the Group Reputational Risk Committee. The Group Reputational Risk Committee considers matters arising from customers, transactions and third parties that either present a serious potential reputational

risk to the Group or merit a Group-led decision to ensure a consistent risk management approach across the regions, global businesses and global functions. Further details can be found under the 'Reputational risk' section of www.hsbc.com/our-approach/risk-and-responsibility.

Day-to-day responsibility for risk management is delegated to senior managers with individual accountability for decision making. All our people have a role to play in risk management. These roles are defined using the three lines of defence model, which takes into account our business and functional structures as described in the following commentary, 'Our responsibilities'.

We use a defined executive risk governance structure to help ensure there is appropriate oversight and accountability of risk, which facilitates reporting and escalation to the Group Risk Management Meeting. This structure is summarised in the following table.

The Board committees with responsibility for oversight of risk-related matters are set out on page 258.

Treasury risks are the responsibility of the Group Executive Committee and the Group Risk Committee. Global Treasury actively manages these risks, supported by the Holdings Asset and Liability Management Committee ('ALCO') and local ALCOs, overseen by Treasury Risk Management and the Group Risk Management Meeting. Further details on treasury risk management are set out on page 202.

Our responsibilities

All our people are responsible for identifying and managing risk within the scope of their roles. Roles are defined using the three lines of defence model, which takes into account our business and functional structures as described below.

Three lines of defence

To create a robust control environment to manage risks, we use an activity-based three lines of defence model. This model delineates management accountabilities and responsibilities for risk management and the control environment.

The model underpins our approach to risk management by clarifying responsibility and encouraging collaboration, as well as enabling efficient coordination of risk and control activities. The three lines of defence are summarised below:

• The first line of defence owns the risks and is responsible for identifying, recording, reporting and managing them in line with risk appetite, and ensuring that the right controls and assessments are in place to mitigate them.

• The second line of defence challenges the first line of defence on effective risk management, and provides advice and guidance in relation to the risk.

• The third line of defence is our Global Internal Audit function, which provides independent assurance as to whether our risk management approach and processes are designed and operating effectively.

Group Risk and Compliance function

Our Group Risk and Compliance function is responsible for the Group's risk management framework. This responsibility includes establishing global policy, monitoring risk profiles, and identifying and managing forward-looking risk. Group Risk and Compliance is made up of sub-functions covering all risks to our business. Forming part of the second line of defence, the Group Risk and Compliance function is independent from the global businesses, including sales and trading functions, to provide challenge, appropriate oversight and balance in risk/return decisions.

Responsibility for minimising both financial and non-financial risk lies with our people. They are required to manage the risks of the business and operational activities for which they are responsible. We maintain adequate oversight of our risks through our various specialist risk stewards and the collective accountability held by our chief risk officers.

We have continued to strengthen the control environment and our approach to the management of non-financial risk, as set out in our risk management framework. The management of non-financial risk focuses on governance and risk appetite, and provides a single view of the non-financial risks that matter the most as well as the associated controls. It incorporates a risk management system designed to enable the active management of non-financial risk. Our ongoing focus is on simplifying our approach to non-financial risk management, while driving more effective oversight and better end-to-end identification and management of non-financial risks. This is overseen by the Operational and Resilience Risk function, headed by the Group Head of Operational and Resilience Risk.

Stress testing and recovery planning

We operate a wide-ranging stress testing programme that is a key part of our risk management and capital and liquidity planning. Stress testing provides management with key insights into the impact of severely adverse events on the Group, and provides confidence to regulators on the Group's financial stability. 

Our stress testing programme assesses our capital and liquidity strength through a rigorous examination of our resilience to external shocks. As well as undertaking regulatory-driven stress tests, we conduct our own internal stress tests in order to understand the nature and level of all material risks, quantify the impact of such risks and develop plausible business-as-usual mitigating actions.

Internal stress tests

Our internal capital assessment uses a range of stress scenarios that explore risks identified by management. They include potential adverse macroeconomic, geopolitical and operational risk events, as well as other potential events that are specific to HSBC.

The selection of stress scenarios is based upon the output of our identified top and emerging risks and our risk appetite. Stress testing analysis helps management understand the nature and extent of vulnerabilities to which the Group is exposed. Using this information, management decides whether risks can or should be mitigated through management actions or, if they were to crystallise, be absorbed through capital and liquidity. This in turn informs decisions about preferred capital and liquidity levels and allocations.

In addition to the Group-wide stress testing scenarios, each major subsidiary conducts regular macroeconomic and event-driven scenario analysis specific to its region. They also participate, as required, in the regulatory stress testing programmes of the jurisdictions in which they operate, such as stress tests required by the Bank of England ('BoE') in the UK, the Federal Reserve Board ('FRB') in the US, and the Hong Kong Monetary Authority ('HKMA') in Hong Kong. Global functions and businesses also perform bespoke stress testing to inform their assessment of risks to potential scenarios.

We also conduct reverse stress tests each year at Group level and, where required, at subsidiary entity level to understand potential extreme conditions that would make our business model non-viable. Reverse stress testing identifies potential stresses and vulnerabilities we might face, and helps inform early warning triggers, management actions and contingency plans designed to mitigate risks.

Recovery and resolution plans

Recovery and resolution plans form part of the integral framework safeguarding the Group's financial stability. The Group recovery plan, together with stress testing, help us understand the likely outcomes of adverse business or economic conditions and in the identification of appropriate risk mitigating actions. The Group is committed to further developing its recovery and resolution capabilities in line with the BoE's Resolvability Assessment Framework requirements.

Key developments in 2022

We actively managed the risks related to macroeconomic uncertainties including inflation, fiscal and monetary policy, the Russia-Ukraine war, broader geopolitical uncertainties and continued risks resulting from the Covid-19 pandemic, as well as other key risks described in this section. In addition, we sought to enhance our risk management in the following areas:

• We continued to improve our risk governance decision making, particularly with regard to the governance of treasury risk, to help ensure senior executives have appropriate oversight and visibility of macroeconomic trends around inflation and interest rates.

• We adapted our interest rate risk management strategy as market and official interest rates increased in reaction to inflationary pressures. This included the Board approving in September a new interest rate risk in the banking book strategy, a managed reduction in the duration risk of our hold-to-collect-and-sell asset portfolio and an increase in net interest income stabilisation.

• We began a process of enhancement of our country credit risk management framework to strengthen our control of risk tolerance and appetite at a country level.

• We continued to develop our approach to emerging risk identification and management, including the use of forward-looking indicators to support our analysis.

• We enhanced our enterprise risk reporting processes to place a greater focus on our emerging risks, including by capturing the materiality, oversight and individual monitoring of these risks.

• We sought to further strengthen our third-party risk policy and processes to improve control and oversight of our material third parties to maintain our operational resilience, and to meet new and evolving regulatory requirements.

• We made progress with our comprehensive regulatory reporting programme to strengthen our global processes, improve consistency and enhance controls.

• We continued to embed the governance and oversight around model adjustments and related processes for IFRS 9 models and Sarbanes-Oxley controls.

• We commenced a programme to enhance our framework for managing the risks associated with machine learning and artificial intelligence ('AI').

• Through our climate risk programme, we continued to embed climate considerations throughout the organisation, including updating the scope of our programme to cover all risk types, expanding the scope of climate-related training, developing new climate risk metrics to monitor and manage exposures, and developing our internal climate scenario exercise.

• We sought to improve the effectiveness of our financial crime controls, deploying advanced analytics capabilities into new markets. We refreshed our financial crime policies to help ensure they remain up to date and address changing and emerging risks. We continue to monitor regulatory changes.

We use a top and emerging risks process to provide a forward-looking view of issues with the potential to threaten the execution of our strategy or operations over the medium to long term.

We proactively assess the internal and external risk environment, as well as review the themes identified across our regions and global businesses, for any risks that may require global escalation. We update our top and emerging risks as necessary.

Our current top and emerging risks are as follows.

Externally driven

Geopolitical and macroeconomic risks

The Russia-Ukraine war has had far-reaching geopolitical and economic implications. HSBC is monitoring the impacts of the war and continues to respond to the further economic sanctions and trade restrictions that have been imposed on Russia in response. In particular, significant sanctions and trade restrictions imposed against Russia have been put in place by the UK, the US and the EU, as well as other countries. Such sanctions and restrictions have specifically targeted certain Russian government officials, politically exposed persons, business people, Russian oil imports, energy products, financial institutions and other major Russian companies. In addition, there have been put in place more generally applicable investment, export, and import bans and restrictions. In response to such sanctions and trade restrictions, as well as asset flight, Russia has implemented certain countermeasures.

Further sanctions, trade restrictions and Russian countermeasures may adversely impact the Group, its customers and the markets in which the Group operates by creating regulatory, reputational and market risks. Our business in Russia principally serves multinational corporate clients headquartered in other countries, is not accepting new business or customers and is consequently on a declining trend. Following a strategic review, HSBC Europe BV (a wholly-owned subsidiary of HSBC Bank plc) has entered into an agreement to sell its wholly-owned subsidiary HSBC Bank (RR) (Limited Liability Company), subject to regulatory and governmental approvals.

Global commodity markets have been significantly impacted by the Russia-Ukraine war and localised Covid-19 outbreaks, leading to continued supply chain disruptions. This has resulted in product shortages appearing across several regions, and increased prices for both energy and non-energy commodities, such as food. We do not expect these to ease significantly in the near term. In turn, this has had a significant impact on global inflation. Relatively mild weather, until recently, and diversification of fuel sources have nevertheless helped regions most dependent on Russian supply to substantially reduce risks of rationing over the winter months.

China's policy measures issued at the end of 2022 have increased liquidity and the supply of credit to the mainland China commercial real estate sector. Recovery in the underlying domestic residential demand and improved customer sentiment will be necessary to support the ongoing health of the sector. We will continue to monitor the sector closely, notably the risk of further idiosyncratic real estate defaults and the potential associated impact on wider market, investor and consumer sentiment. Given that parts of the global economy are in, or close to, recession, the demand for Chinese exports may also diminish.

Rising global inflation has prompted central banks to tighten monetary policy. Since the beginning of 2022, the US Federal Reserve Board ('FRB') has delivered a cumulative 450 basis point ('bps') increase in the Federal Funds rate. The European Central Bank lagged the FRB initially, but its benchmark rate has subsequently been increased by 300bps since July 2022. As of mid-February 2023, interest-rate futures suggested market uncertainty as to whether the FRB would begin to ease monetary policy over the 12-month horizon. Should monetary policy rates move materially higher than current expectations, a realignment of market expectations could cause turbulence in financial asset prices.

Financial markets have also shown reduced appetite for expansionary fiscal policies in the context of high debt ratios. Following the fiscal statement of 23 September 2022 by the UK government, there was a fall in the value of sterling and a sharp rise in the yields of UK government securities, known as gilts. Following this, the Bank of England reversed its plan to begin selling its gilt holdings from September 2022, and the UK government reversed most of the previously announced fiscal measures. We continue to monitor our risk profile closely in the context of uncertainty over global macroeconomic policies.

Higher inflation and interest rate expectations around the world - and the resulting economic uncertainty - have had an impact on expected credit losses and other credit impairment charges ('ECL'). The combined pressure of higher inflation and interest rates may impact the ability of our customers to repay debt. Our Central scenario, which has the highest probability weighting in our IFRS 9 'Financial Instruments' calculations of ECL, assumes low growth and a higher inflation environment across many of our key markets. However, due to the rapidly changing economic conditions, the potential for forecast dispersion and volatility remain high, impacting the degree of accuracy and certainty of our Central scenario forecast. The level of volatility varies by market, depending on exposure to commodity price increases, supply chain constraints, the monetary policy response to inflation and the public health policy response to the Covid-19 pandemic. As a result, our Central scenario for impairment has not been assigned the same likelihood of occurrence across our key markets. There is also uncertainty with respect to the relationship between the economic drivers and the historical loss experience, which has required adjustments to modelled ECL in cases where we determined that the model was unable to capture the material underlying risks.

For further details of our Central and other scenarios, see 'Measurement uncertainty and sensitivity analysis of ECL estimates' on page 153.

Global tensions over trade, technology and ideology are manifesting themselves in divergent regulatory standards and compliance regimes, presenting long-term strategic challenges for multinational businesses.

The US-China relationship remains complex. To date, the UK, the US, the EU and other countries have imposed various sanctions and trade restrictions on Chinese persons and companies. Although sanctions and trade restrictions are difficult to predict, increases in diplomatic tensions between China and the US and other countries could result in sanctions that could negatively impact the Group, its customers and the markets in which the Group operates. There is a continued risk of additional sanctions and trade restrictions being imposed by the US and other governments in relation to human rights, technology, and other issues with China, and this could create a more complex operating environment for the Group and its customers.

China has in turn announced a number of its own sanctions and trade restrictions that target, or provide authority to target, foreign individuals and companies.

These and any future measures and countermeasures that may be taken by the US, China and other countries may affect the Group, its customers and the markets in which the Group operates.

Negotiations between the UK and the EU over the operation of the Northern Ireland Protocol are continuing. While there are signs that differences may be diminishing, failure to reach agreement could have implications for the future operation of the EU-UK Trade and Cooperation Agreement.

In June 2022, the UK government published proposed legislation that seeks to amend the Protocol in a number of respects. In response, the EU launched infringement procedures against the UK, and is evaluating the UK response, received in September 2022. If the proposed legislation were to pass, and infringement procedures progressed, it could further complicate the terms of trade between the UK and the EU and potentially prevent progress in other areas such as financial services. Over the medium to long term, the UK's withdrawal from the EU may impact markets and increase economic risk, particularly in the UK, which could adversely impact our profitability and prospects for growth in this market. We are monitoring the situation closely, including the potential impacts on our customers. 

In August 2022, the US Inflation Reduction Act introduced a minimum tax of 15% with effect from 1 January 2023. It is possible that the minimum tax could result in an additional US tax liability over our regular US federal corporate tax liability in a given year, based on the differences between US book and taxable income (including as a result of temporary differences). Given its recent pronouncement, it is unclear at this time what, if any, impact the US Inflation Reduction Act will have on HSBC's US tax rate and US financial results. HSBC will continue to evaluate its impact as further information becomes available. In addition, potential changes to tax legislation and tax rates in the countries and territories in which we operate could increase our effective tax rate in the future.

As the geopolitical landscape evolves, compliance by multinational corporations with their legal or regulatory obligations in one jurisdiction may be seen as supporting the law or policy objectives of that jurisdiction over another, creating additional compliance, reputational and political risks for the Group. We maintain dialogue with our regulators in various jurisdictions on the impact of legal and regulatory obligations on our business and customers.

The financial impact on the Group of geopolitical risks in Asia is heightened due to the region's relatively high contribution to the Group's profitability, particularly in Hong Kong.

While it is the Group's policy to comply with all applicable laws and regulations of all jurisdictions in which it operates, geopolitical risks and tensions, and potential ambiguities in the Group's compliance obligations, will continue to present challenges and risks for the Group and could have a material adverse impact on the Group's business, financial condition, results of operations, prospects and strategy, as well as on the Group's customers.

Expanding data privacy, national security and cybersecurity laws in a number of markets could pose potential challenges to intra-group data sharing. These developments could increase financial institutions' compliance obligations in respect of cross-border transfers of personal information, which may affect our ability to manage financial crime risks across markets.

Mitigating actions

• We closely monitor geopolitical and economic developments in key markets and sectors and undertake scenario analysis where appropriate. This helps us to take portfolio actions where necessary, including through enhanced monitoring, amending our risk appetite and/or reducing limits and exposures.

• We stress test portfolios of particular concern to identify sensitivity to loss under a range of scenarios, with management actions being taken to rebalance exposures and manage risk appetite where necessary.

• We regularly review key portfolios to help ensure that individual customer or portfolio risks are understood and that our ability to manage the level of facilities offered through any downturn is appropriate.

• We continue to manage sanctions and trade restrictions through the use of, and enhancements to, our existing controls.

• We continue to monitor the UK's relationship with the EU, and assess the potential impact on our people, operations and portfolios.

• We have taken steps, where necessary, to enhance physical security in geographical areas deemed to be at high risk from terrorism and military conflicts.

Technology and cybersecurity risk

Together with other organisations, we operate in an extensive and complex technology landscape, which needs to remain resilient in order to support customers, our organisation and financial markets globally. Risks arise where technology is not understood, maintained, or developed appropriately. We also continue to operate in an increasingly hostile cyber threat environment globally. These threats include potential unauthorised access to customer accounts, attacks on our systems or those of our third-party suppliers, and require ongoing investment in business and technical controls to defend against.

Mitigating actions

• We continue to invest in transforming how software solutions are developed, delivered and maintained to improve system resilience. We continue to build security into our software development lifecycle and improve our testing processes and tools.

• We continue to upgrade many of our IT systems, simplify our service provision and replace older IT infrastructure and applications. These enhancements supported global improvements in service availability during 2022 for both our customers and colleagues.

• We continually evaluate threat levels for the most prevalent cyber-attack types and their potential outcomes. To further protect HSBC and our customers and help ensure the safe expansion of our global businesses, we continue to strengthen our controls to reduce the likelihood and impact of advanced malware, data leakage, exposure through third parties and security vulnerabilities.

• We continue to enhance our cybersecurity capabilities, including Cloud security, identity and access management, metrics and data analytics, and third-party security reviews. An important part of our defence strategy is ensuring our colleagues remain aware of cybersecurity issues and know how to report incidents.

• We report and review cyber risk and control effectiveness at executive and non-executive Board level. We also report it across our global businesses, functions and regions to help ensure there is appropriate visibility and governance of the risk and its mitigating actions.

• We participate globally in industry bodies and working groups to collaborate on tactics employed by cyber-crime groups and to work together preventing, detecting and defending against cyber-attacks on financial organisations globally.

Evolving regulatory environment risk

We aim to keep abreast of the emerging regulatory compliance and conduct agenda, which currently includes, but is not limited to: ESG matters; ensuring good customer outcomes; addressing customer vulnerabilities due to cost of living pressures; regulatory compliance; regulatory reporting; employee compliance, including the use of e-communication channels; and the proposed reforms to the UK financial services sector, known as the Edinburgh Reforms. We monitor regulatory developments closely and engage with regulators, as appropriate, to help ensure new regulatory requirements are implemented effectively and in a timely way. The competitive landscape in which the Group operates may be impacted by future regulatory changes and government intervention.

Mitigating actions

• We monitor for regulatory developments to understand the evolving regulatory landscape and seek to respond with changes in a timely manner.

• We engage with governments and regulators, responding to consultations with a view to help shaping regulations that can be implemented effectively. We hold regular meetings with relevant authorities to discuss strategic contingency plans, including those arising from geopolitical issues. 

• Our simplified conduct approach aligns to our purpose and values, in particular the value 'we take responsibility'.

Financial crime risk

Financial institutions remain under considerable regulatory scrutiny regarding their ability to detect and prevent financial crime. These evolving challenges include managing conflicting laws and approaches to legal and regulatory regimes, and implementing an unprecedented volume and diverse set of sanctions, notably as a result of the Russia-Ukraine war.

Amid rising inflation and increasing cost of living pressures, we face increasing regulatory expectations with respect to managing internal and external fraud, and protecting vulnerable customers.

The digitisation of financial services continues to have an impact on the payments ecosystem, with an increasing number of new market entrants and payment mechanisms, not all of which are subject to the same level of regulatory scrutiny or regulations as banks. Developments around digital assets and currencies have continued at pace, with an increasing regulatory and enforcement focus on the financial crimes linked to these types of assets.

Expectations with respect to the intersection of ESG issues and financial crime, as our organisation, customers and suppliers transition to net zero, continue to increase. These are particularly focused on potential 'greenwashing', human rights issues and environmental crimes. In addition, climate change itself could heighten risks linked to vulnerable migrant populations in countries where financial crime is already more prevalent.

We also continue to face increasing challenges presented by national data privacy requirements, which may affect our ability to manage financial crime risks across markets.

Mitigating actions 

• We continue to manage sanctions and trade restrictions through the use of, and enhancements to, our existing controls.

• We continue to develop our fraud controls and invest in capabilities to fight financial crime through the application of advanced analytics and artificial intelligence.

• We are looking at the impact of a rapidly changing payments ecosystem, as well as risks associated with direct and indirect exposure to digital assets and currencies, in an effort to maintain appropriate financial crime controls.

• We are assessing our existing policies and control framework so that developments relating to ESG are considered and the risks mitigated.

• We engage with regulators, policymakers and relevant international bodies, seeking to address data privacy challenges through international standards, guidance and legislation.

Ibor transition risk

Interbank offered rates ('Ibors') have previously been used extensively to set interest rates on different types of financial transactions and for valuation purposes, risk measurement and performance benchmarking.

Following the UK's Financial Conduct Authority ('FCA') announcement in July 2017 that it would no longer continue to persuade or require panel banks to submit rates for the London interbank offered rate ('Libor') after 2021, we have been actively working to transition legacy contracts from Ibors to products linked to near risk-free replacement rates ('RFRs') or alternative reference rates.

The publication of sterling, Swiss franc, euro and Japanese yen Libor interest rate benchmarks, as well as Euro Overnight Index Average ('Eonia'), ceased from the end of 2021. Our Ibor transition programme - which is tasked with the development of RFR products and the transition of legacy Ibor products - has continued to support the transition of a limited number of remaining contracts in sterling and Japanese yen Libor, which were published using a 'synthetic' interest rate methodology during 2022. The remaining 'tough legacy' sterling contracts have required protracted client discussions where contracts are complex or restructuring of facilities is required. The publication of 'synthetic' Japanese yen Libor ceased after 31 December 2022. In addition the FCA announced, in September and November 2022, that one month and six-month 'synthetic' sterling Libor rates will cease to be published from 31 March 2023, and three-month 'synthetic' sterling Libor will cease to be published after 31 March 2024. We have or are prepared to transition or remediate the remaining few contracts relying on 'synthetic' sterling settings, outstanding as at 31 December 2022, in advance of those cessation dates.

For the cessation of the publication of US dollar Libor from 30 June 2023, we have implemented the majority of required processes, technology and RFR product capabilities throughout the Group in preparation for upcoming market events. We will continue to transition outstanding legacy contracts through the first half of 2023. We have completed the transition of the majority of our uncommitted lending facilities, and continue to make steady progress with the transition of the outstanding legacy committed lending facilities. Transition of our derivatives portfolio is progressing well with most clients reliant on industry mechanisms to transition to RFRs. For the limited number of bilateral derivatives trades where an alternative transition path is required, client engagement is continuing. For certain products and contracts, including bonds and syndicated loans, we remain reliant on the continued support of agents and third parties, but we continue to progress those contracts requiring transition. We continue to monitor contracts that may be potentially more challenging to transition, and may need to rely upon legislative solutions. Additionally, following the FCA's consultation in November 2022 proposing that US dollar Libor is to be published using a 'synthetic' methodology for a defined period, we will continue to work with our clients to support them through the transition of their products if transition is not completed by 30 June 2023.

For the Group's own debt securities issuances, we continue to have instruments in US dollars, sterling, Japanese yen and Singapore dollars where the terms provide for an Ibor benchmark to be used to reset the coupon rate if HSBC chooses not to redeem them on their call dates. We remain mindful of the various factors that have an impact on the Ibor remediation strategy for our regulatory capital and MREL instruments, including - but not limited to - timescales for cessation of relevant Ibor rates, constraints relating to the governing law of outstanding instruments, the potential relevance of legislative solutions and industry best practice guidance. We remain committed to seeking to remediate or mitigate relevant risks relating to Ibor-demise, as appropriate, on our outstanding regulatory capital and MREL instruments before the relevant calculation dates, which may occur post-cessation of the relevant Ibor rate or rates.

For US dollar Libor and other demising Ibors, we continue to be exposed to, and actively monitor, risks including:

• regulatory compliance and conduct risks, as the transition of legacy contracts to RFRs or alternative rates, or sales of products referencing RFRs, may not deliver fair client outcomes;

• resilience and operational risks, as changes to manual and automated processes, made in support of new RFR methodologies, and the transition of large volumes of Ibor contracts may lead to operational issues;

• legal risk, as issues arising from the use of legislative solutions and from legacy contracts that the Group is unable to transition may result in unintended or unfavourable outcomes for clients and market participants, which could potentially increase the risk of disputes;

• model risk, as there is a risk that changes to our models to replace Ibor-related data adversely affect the accuracy of model outputs; and

• market risk, because as a result of differences in Libor and RFR interest rates, we are exposed to basis risk resulting from the asymmetric adoption of rates across assets, liabilities and products. Additionally the current stage of the Term Secured Overnight Financing Rate ('SOFR') market presents challenges for certain hedge accounting strategies.

While the level of risk is diminishing in line with our process implementation and continued transition of contracts, we will monitor these risks through the remainder of the transition of legacy contracts. Throughout 2023, we plan to continue to engage with our clients and investors to complete an orderly transition of contracts that reference the remaining demising Ibors.

Mitigating actions

• Our global Ibor transition programme, which is overseen by the Group Chief Risk and Compliance Officer, will continue to deliver IT and operational processes to meet its objectives.

• We carry out extensive training, communication and client engagement to facilitate appropriate selection of new rates and products.

• We have dedicated teams in place to support the transition.

• We have actively transitioned legacy contracts and ceased entering into new contracts based on demised or demising Ibors, other than those allowed under regulatory exemptions, and implemented associated monitoring and controls.

• We assess, monitor and dynamically manage risks arising from Ibor transition, and implement specific mitigating controls when required.

• We continue to actively engage with regulatory and industry bodies to mitigate risks relating to 'tough legacy' contracts.

Financial instruments impacted by Ibor reform

(Audited)

Interest Rate Benchmark Reform Phase 2, the amendments to IFRSs issued in August 2020, represents the second phase of the IASB's project on the effects of interest rate benchmark reform. The amendments address issues affecting financial statements when changes are made to contractual cash flows and hedging relationships.

Under these amendments, changes made to a financial instrument measured at other than fair value through profit or loss that are economically equivalent and required by interest rate benchmark reform, do not result in the derecognition or a change in the carrying amount of the financial instrument. Instead they require the effective interest rate to be updated to reflect the change in the interest rate benchmark. In addition, hedge accounting will not be discontinued solely because of the replacement of the interest rate benchmark if the hedge meets other hedge accounting criteria.

1 Comprises financial instruments referencing other significant benchmark rates yet to transition to alternative benchmarks (euro Libor, Swiss franc Libor, Eonia, SOR, THBFIX, MIFOR and Sibor). Announcements were made by regulators during 2022 on the cessation of the Canadian dollar offered rate ('CDOR') and Mexican Interbank equilibrium interest rate ('TIIE'), which will eventually transition to the Canadian overnight repo rate average ('CORRA') and a new Mexican overnight fall-back rate, respectively. Therefore, CDOR and TIIE are also included in Others during the current period.

2 Gross carrying amount excluding allowances for expected credit losses.

The amounts in the above table relate to HSBC's main operating entities where HSBC has material exposures impacted by Ibor reform, including in the UK, Hong Kong, France, the US, Mexico, Canada, Singapore, the UAE, Bermuda, Australia, Qatar, Germany, Thailand, India and Japan. The amounts provide an indication of the extent of the Group's exposure to the Ibor benchmarks that are due to be replaced. Amounts are in respect of financial instruments that:

• contractually reference an interest rate benchmark that is planned to transition to an alternative benchmark;

• have a contractual maturity date beyond the date by which the reference interest rate benchmark is expected to cease; and

• are recognised on HSBC's consolidated balance sheet.

Environmental, social and governance ('ESG') risk

We are subject to financial and non-financial risks associated with ESG-related matters. Our current areas of focus include climate risk, nature-related risks and human rights risks. These can impact us both directly and indirectly through our business activities and relationships. For details of how we govern ESG, see page 86.

Our assessment of climate risks covers three distinct time periods, comprising: short term, which is up to 2025; medium term, which is between 2026 and 2035; and long term, which is between 2036 and 2050. Focus on climate-related risk continued to increase over 2022, owing to the pace and volume of policy and regulatory changes globally, particularly on climate risk management, stress testing and scenario analysis and disclosures. If we fail to meet evolving regulatory expectations or requirements on climate risk management, this could have regulatory compliance and reputational impacts.

We could face direct impacts, owing to the increase in frequency and severity of weather events and chronic shifts in weather patterns, which could affect our ability to conduct our day-to-day operations.

Our customers may find that their business models fail to align to a net zero economy or face disruption to their operations or deterioration to their assets as a result of extreme weather.

We face increased reputational, legal and regulatory risk as we make progress towards our net zero ambition, with stakeholders likely to place greater focus on our actions such as the development of climate-related policies, our disclosures and financing and investment decisions relating to our ambition.

We will face additional risks if we are perceived to mislead stakeholders in respect of our climate strategy, the climate impact of a product or service, or the commitments of our customers. Climate risk may also impact on model risk, as the uncertain impacts of climate change and data and methodology limitations present challenges to creating reliable and accurate model outputs.

We also face reporting risk in relation to our climate disclosures, as any data, methodologies and standards we have used may evolve over time in line with market practice, regulation or owing to developments in climate science. While emissions reporting has improved over time, data remains of limited quality and consistency. The use of inconsistent or incomplete data and models could result in sub-optimal decision making. Any changes could result in revisions to our internal frameworks and reported data, and could mean that reported figures are not reconcilable or comparable year on year. We may also have to re-evaluate our progress towards our climate-related targets in future and this could result in reputational, legal and regulatory risks.

There is increasing evidence that a number of nature-related risks beyond climate change, which include risks that can be represented more broadly by impact and dependence on nature, can and will have significant economic impact. These risks arise when the provision of natural services - such as water availability, air quality and soil quality - is compromised by overpopulation, urban development, natural habitat and ecosystem loss, ecosystem degradation arising from economic activity and other environmental stresses beyond climate change. They can show themselves in various ways, including through macroeconomic, market, credit, reputational, legal and regulatory risks, for both HSBC and our customers. We continue to engage with investors, regulators and customers on nature-related risks to evolve our approach and understand best practice risk mitigation.

Regulation and disclosure requirements in relation to human rights, and to modern slavery in particular, are increasing. Businesses are expected to be transparent about their efforts to identify and respond to the risk of negative human rights impacts arising from their business activities and relationships.

Mitigating actions

• We aim to deepen our understanding of the drivers of climate risk. A dedicated Climate Risk Oversight Forum is responsible for shaping and overseeing our approach and providing support in managing climate risk. For further details of the Group's ESG governance structure, see page 86.

• Our climate risk programme continues to support the development of our climate risk management capabilities across four key pillars: governance and risk appetite, risk management, stress testing and scenario analysis, and disclosures. We also aim to enhance our approach to greenwashing risk management.

• In December 2022, we published our updated policy covering the broader energy system including upstream oil and gas, oil and gas power generation, coal, hydrogen, renewables and hydropower, nuclear, biomass and energy from waste. We also expanded our thermal coal phase-out policy, in which we committed to not provide new finance or advisory services for the specific purposes of the conversion of existing coal-to-gas fired power plants, or new metallurgical coal mines (see page 65).

• Climate stress tests and scenarios are being used to further improve our understanding of our risk exposures for use in risk management and business decision making.

• In 2022, we reviewed our salient human rights issues following the methodology set out in the UNGPs. These are the human rights at risk of the most severe potential negative impact through our business activities and relationships. This review built on an earlier review that had identified modern slavery and discrimination as priority human rights issues. For further details, see page 87 of the ESG review.

• In 2021, we joined several industry working groups dedicated to helping us assess and manage nature-related risks, such as the Taskforce on Nature-related Financial Disclosures ('TNFD'). In 2022 our asset management business published its biodiversity policy to publicly explain how our analysts address nature-related issues.

• We continue to engage with our customers, investors and regulators proactively on the management of ESG risks. We also engage with initiatives, including the Climate Financial Risk Forum, Equator Principles, Task Force on Climate-related Financial Disclosures and CDP (formerly the Carbon Disclosure Project) to help drive best practice for climate risk management.

For further details of our approach to climate risk management, see 'Climate risk' on page 221.

For further details of ESG risk management, see 'Financial crime risk' on page 231 and 'Regulatory compliance risk environment including conduct' on page 225.

Our ESG review can be found on page 44.

Digitalisation and technological advances risk

Developments in technology and changes to regulations are enabling new entrants to the industry, particularly with respect to payments. This challenges us to continue innovating and taking advantage of new digital capabilities so that we improve how we serve our customers, drive efficiency and adapt our products to attract and retain customers. As a result, we may need to increase our investment in our business to adapt or develop products and services to respond to our customers' evolving needs. We also need to ensure that new digital capabilities do not weaken our resilience or wider risk management capabilities.

New technologies such as blockchain and quantum computing offer both business opportunities and potential risks for HSBC. As with all use of technologies, we aim to maximise their potential while seeking to ensure a robust control environment is in place to help manage the inherent risks, such as the impact on encryption algorithms.

Mitigating actions:

• We continue to monitor this emerging risk, as well as the advances in technology, and changes in customer behaviours to understand how these may impact our business.

• We assess new technologies to help develop appropriate controls and maintain resilience.

• We closely monitor and assess financial crime risk and the impact on payment transparency and architecture.

Internally driven

Risks associated with workforce capability, capacity and environmental factors with potential impact on growth

Our global businesses and functions in all of our markets are exposed to risks associated with workforce capacity challenges, including challenges to retain, develop and attract high-performing employees in key labour markets, and compliance with employment laws and regulations. Changed working arrangements, and the residual impact of local Covid-19-related restrictions and health concerns during the pandemic, have also affected employee mental health and well-being.

Mitigating actions

• We seek to promote a diverse and inclusive workforce and provide health and well-being support. We continue to build our speak-up culture through active campaigns.

• We monitor hiring activities and levels of employee attrition, with each business and function putting in place plans to help ensure they have effective workforce forecasting to meet business demands.

• We monitor people risks that could arise due to organisational restructuring, helping to ensure we manage redundancies sensitively and support impacted employees. We encourage our people leaders to focus on talent retention at all levels, with an empathetic mindset and approach, while ensuring the whole proposition of working at HSBC is well understood.

• Our Future Skills curriculum helps provides skills that will help to enable employees and HSBC to be successful in the future.

• We develop succession plans for key management roles, with oversight from the Group Executive Committee.

•

Risks arising from the receipt of services from third parties

We use third parties to provide a range of goods and services. Risks arising from the use of third-party providers and their supply chain may be harder to identify. It is critical that we ensure we have appropriate risk management policies, processes and practices over the selection, governance and oversight of third parties and their supply chain, particularly for key activities that could affect our operational resilience. Any deficiency in the management of risks associated with our third parties could affect our ability to support our customers and meet regulatory expectations.

Mitigating actions

• We continue to monitor the effectiveness of the controls operated by our third-party providers and request third-party control reports, where required. We have made further enhancements to our framework to help ensure risks associated with these arrangements are understood and managed effectively by our global businesses, global functions and regions.

• We continue to enhance the effective management of our intra-Group arrangements using the same control standards as we have for external third-party arrangements.

• We are implementing the changes required by new regulations as set by our regulators.

Model risk

Model risk arises whenever business decision making includes reliance on models. We use models in both financial and non-financial contexts, as well as in a range of business applications such as customer selection, product pricing, financial crime transaction monitoring, creditworthiness evaluation and financial reporting. Assessing model performance is a continuous undertaking. Models can need redevelopment as market conditions change. Significant increases in global inflation and interest rates have impacted the reliability and accuracy of both credit and market risk models.

We continued to prioritise the redevelopment of internal ratings-based ('IRB') and internal model methods ('IMM') models, in relation to counterparty credit, as part of the IRB repair and Basel III programmes with a key focus on enhancing the quality of data used as model inputs. A number of these models have been submitted to the UK's Prudential Regulation Authority ('PRA') and other key regulators for feedback, and approval is in progress. Some IMM and internal model approach ('IMA') models have been approved for use, and feedback has been received for some IRB models. Climate risk modelling is a key focus for the Group as HSBC's commitment to ESG has become a key part of the Group's strategy.

Model risk remains a key area of focus given the regulatory scrutiny in this area, with local regulatory exams taking place in many jurisdictions and further developments in policy expected from many regulators, including the PRA.

Mitigating actions

• We have continued to embed the enhanced monitoring, review and challenge of expected credit loss model performance through our Model Risk Management function as part of a broader quarterly process to determine loss levels. The Model Risk Management team aims to provide effective review and challenge of any future redevelopment of these models.

• Model Risk Governance committees at the Group, business and functional levels continue to provide oversight of model risk.

• Model Risk Management works closely with businesses to ensure that IRB/IMM/IMA models in development meet risk management, pricing and capital management needs. Global Internal Audit provides assurance over the risk management framework for models.

• Additional assurance work is performed by the model risk governance teams, which act as second lines of defence. The teams test whether controls implemented by model users comply with model risk policy and if model risk standards are adequate.

• Models using advanced machine learning techniques are validated and monitored to help ensure that risks that are determined by the algorithms have adequate oversight and review. A framework to manage the range of risks that are generated by these advanced techniques, and to recognise the multidisciplinary nature of these risks, is being developed.

Data risk

We use multiple systems and growing quantities of data to support our customers. Risk arises if data is incorrect, unavailable, misused, or unprotected. Along with other banks and financial institutions, we need to meet external regulatory obligations and laws that cover data, such as the Basel Committee on Banking Supervision's 239 guidelines and the General Data Protection Regulation ('GDPR').

Mitigating actions

• Through our global data management framework, we monitor the quality, availability and security of data that supports our customers and internal processes. We work towards resolving any identified data issues in a timely manner.

• We have made improvements to our data policies. We are implementing an updated control framework (which includes trusted sources, data flows and data quality) in order to enhance the end-to-end management of data risk.

• We have established a global data management utility, and continue to simplify and unify data management activities across the Group.

• We seek to protect customer data through our data privacy framework, which establishes practices, design principles and guidelines that enable us to demonstrate compliance with data privacy laws and regulations.

• We continue to modernise our data and analytics infrastructure through investments in Cloud technology, data visualisation, machine learning and artificial intelligence.

• We continue to educate our employees on data risk and data management. We have delivered regular mandatory training globally on how to protect and manage data appropriately.

Change execution risk

We have continued investment in strategic change to support the delivery of our strategic priorities and regulatory commitments. This requires change to be executed safely and efficiently.

Mitigating actions

• In 2022, we added change execution risk to our risk taxonomy and control library, so that it could be defined, assessed, managed, reported and overseen in the same way as our other material risks.

• The Transformation Oversight Executive Committee oversees the prioritisation, strategic alignment and management of execution risk for all change portfolios and initiatives.

•

During 2022, a number of areas were identified and considered as part of our top and emerging risks because of the effect they may have on the Group. While considered under the themes captured under top and emerging risks, in this section we have placed a particular focus on the Covid-19 pandemic.

Risks related to Covid-19

The impact from the Covid-19 pandemic remains a continuing risk to our customers and organisation. However, the appetite for public health restrictions has reduced following the successful roll-out of vaccine programmes, and as societies have adapted. Countries continue to differ in their approach, although China has recently reversed restrictions on activity and mobility.

In most countries, high vaccination rates and acquired population immunity have minimised the public health risks and the need for restrictions. However, in mainland China and Hong Kong, adherence

to public health restrictions had adverse economic implications throughout much of 2022. Government-imposed restrictions on

activity in major Chinese cities, and restrictions on travel, adversely affected global tourism and supply chains.

While the recovery in China resulting from the relaxation of Covid-19 related restrictions on movement, international travel and tourism in China that commenced in December 2022, raises the prospect of global growth, it could also lead to renewed inflationary pressures as demand for commodities and other goods rises. However, there are still short-term risks, as any surge in Covid-19 infections in China may dampen confidence and activity, and lead to the emergence of new vaccine-resistant variants of the virus.

We continue to monitor the situation closely, and given the continuing uncertainties related to the post-pandemic landscape, additional mitigating actions may be required.

The material risk types associated with our banking and insurance manufacturing operations are described in the following tables:

Our insurance manufacturing subsidiaries are regulated separately from our banking operations. Risks in our insurance entities are managed using methodologies and processes that are subject to Group oversight. Our insurance operations are also subject to many of

the same risks as our banking operations, and these are covered by the Group's risk management processes. However, there are specific risks inherent to the insurance operations as noted below.

Contents

Overview

Credit risk is the risk of financial loss if a customer or counterparty fails to meet an obligation under a contract. Credit risk arises principally from direct lending, trade finance and leasing business, but also from other products such as guarantees and derivatives.

Credit risk management

Key developments in 2022

There were no material changes to the policies and practices for the management of credit risk in 2022. We continued to apply the requirements of IFRS 9 'Financial Instruments' within the Credit Risk sub-function. For certain retail portfolios, we enhanced the significant increase in credit risk ('SICR') approach in relation to capturing relative movements in probability of default ('PD') since origination.

For our retail portfolios, we adopted the EBA 'Guidelines on the application of definition of default' during 2022 and, for our wholesale portfolios, these guidelines were adopted during 2021. Adoption of these guidelines did not have a material impact on our portfolios and comparative disclosures have not been restated.

We actively managed the risks related to macroeconomic uncertainties, including inflation, fiscal and monetary policy, the Russia-Ukraine war, broader geopolitical uncertainties, and the continued risks resulting from the Covid-19 pandemic.

For further details, see 'Top and emerging risks' on page 135.

Governance and structure

We have established Group-wide credit risk management and related IFRS 9 processes. We continue to assess the impact of economic developments in key markets on specific customers, customer segments or portfolios. As credit conditions change, we take mitigating actions, including the revision of risk appetites or limits and tenors, as appropriate. In addition, we continue to evaluate the terms under which we provide credit facilities within the context of individual customer requirements, the quality of the relationship, local regulatory requirements, market practices and our local market position.

Credit Risk sub-function

(Audited)

Credit approval authorities are delegated by the Board to the Group Chief Executive together with the authority to sub-delegate them. The Credit Risk sub-function in Group Risk and Compliance is responsible for the key policies and processes for managing credit risk, which include formulating Group credit policies and risk rating frameworks, guiding the Group's appetite for credit risk exposures, undertaking independent reviews and objective assessment of credit risk, and monitoring performance and management of portfolios.

The principal objectives of our credit risk management are:

• to maintain across HSBC a strong culture of responsible lending, and robust risk policies and control frameworks;

• to both partner and challenge our businesses in defining, implementing and continually re-evaluating our risk appetite under actual and scenario conditions; and

• to ensure there is independent, expert scrutiny of credit risks, their costs and their mitigation.

Key risk management processes

IFRS 9 'Financial Instruments' process

The IFRS 9 process comprises three main areas: modelling and data; implementation; and governance.

Modelling, data and forward economic guidance

We have established IFRS 9 modelling and data processes in various geographies, which are subject to internal model risk governance including independent review of significant model developments.

We have a centralised process for generating unbiased and independent global economic scenarios. Scenarios are subject to a process of review and challenge by a dedicated team, as well as regional groupings. Each quarter, the scenarios and probability weights are reviewed and checked for consistency with the economic conjuncture and current economic and financial risks. These are subject to final review and approval by senior management in a Forward Economic Guidance Global Business Impairment Committee.

Implementation

A centralised impairment engine performs the expected credit losses calculation using data, which is subject to a number of validation checks and enhancements, from a variety of client, finance and risk systems. Where possible, these checks and processes are performed in a globally consistent and centralised manner.

Governance

Regional management review forums are established in key sites and regions in order to review and approve the impairment results. Regional management review forums have representatives from Credit Risk and Finance. The key site and regional approvals are reported up to the relevant global business impairment committee for final approval of the Group's ECL for the period. Required members of the committee are the Wholesale Global Chief Corporate Credit Officer and Chief Risk Officer for Wealth and Personal Banking Risk, as well as the relevant global business Chief Financial Officer and the Global Financial Controller.

Concentration of exposure

(Audited)

Concentrations of credit risk arise when a number of counterparties or exposures have comparable economic characteristics, or such counterparties are engaged in similar activities or operate in the same geographical areas or industry sectors so that their collective ability to meet contractual obligations is uniformly affected by changes in economic, political or other conditions. We use a number of controls and measures to minimise undue concentration of exposure in our portfolios across industries, countries and global businesses. These include portfolio and counterparty limits, approval and review controls, and stress testing.

Credit quality of financial instruments

(Audited)

Our risk rating system facilitates the internal ratings-based approach under the Basel framework adopted by the Group to support the calculation of our minimum credit regulatory capital requirement. The five credit quality classifications encompass a range of granular internal credit rating grades assigned to wholesale and retail customers, and the external ratings attributed by external agencies to debt securities.

For debt securities and certain other financial instruments, external ratings have been aligned to the five quality classifications based upon the mapping of related customer risk rating ('CRR') to external credit rating.

Wholesale lending

The CRR 10-grade scale summarises a more granular underlying 23-grade scale of obligor probability of default ('PD'). All corporate customers are rated using the 10- or 23-grade scale, depending on the degree of sophistication of the Basel approach adopted for the exposure.

Each CRR band is associated with an external rating grade by reference to long-run default rates for that grade, represented by the average of issuer-weighted historical default rates. This mapping between internal and external ratings is indicative and may vary over time.

Retail lending

Retail lending credit quality is based on a 12-month point-in-time probability-weighted PD.

1 Customer risk rating ('CRR').

2 12-month point-in-time probability-weighted probability of default ('PD').

Forborne loans and advances

(Audited)

Forbearance measures consist of concessions towards an obligor that is experiencing or about to experience difficulties in meeting its financial commitments.

We continue to class loans as forborne when we modify the contractual payment terms due to having significant concerns about the borrowers' ability to meet contractual payments when they were due.

In 2022, we expanded our definition of forborne to capture non-payment-related concessions, such as covenant waivers. For our wholesale portfolio, we began identifying non-payment-related concessions in 2021 when our internal policies were changed. For our retail portfolios, we began identifying them during 2022.

The comparative disclosures have been presented under the prior definition of forborne for the wholesale and retail portfolios.

For details of our policy on forbearance, see Note 1.2(i) in the financial statements.

Credit quality of forborne loans

For wholesale lending, where payment-related forbearance measures result in a diminished financial obligation, or if there are other indicators of impairment, the loan will be classified as credit impaired if it is not already so classified. All facilities with a customer, including loans that have not been modified, are considered credit impaired following the identification of a payment-related forborne loan. For

retail lending, where a material payment-related concession has been granted, the loan will be classified as credit impaired. In isolation, non-payment forbearance measures may not result in the loan being classified as credit impaired unless combined with other indicators of credit impairment. These are classed as performing forborne loans for both wholesale and retail lending.

Wholesale and retail lending forborne loans are classified as credit impaired until there is sufficient evidence to demonstrate a significant reduction in the risk of non-payment of future cash flows, observed over a minimum one-year period, and there are no other indicators of impairment. Any forborne loans not considered credit impaired will remain forborne for a minimum of two years from the date that credit impairment no longer applies. For wholesale and retail lending, any forbearance measures granted on a loan already classed as forborne results in the customer being classed as credit impaired.

Forborne loans and recognition of expected credit losses

(Audited)

Forborne loans expected credit loss assessments reflect the higher rates of losses typically experienced with these types of loans such that they are in stage 2 and stage 3. The higher rates are more pronounced in unsecured retail lending requiring further segmentation. For wholesale lending, forborne loans are typically assessed individually. Credit risk ratings are intrinsic to the impairment assessments. The individual impairment assessment takes into account the higher risk of the future non-payment inherent in forborne loans.

Impairment assessment

(Audited)

For details of our impairment policies on loans and advances and financial investments, see Note 1.2(i) on the financial statements.

Write-off of loans and advances

(Audited)

For details of our policy on the write-off of loans and advances, see Note 1.2(i) on the financial statements.

Unsecured personal facilities, including credit cards, are generally written off at between 150 and 210 days past due. The standard period runs until the end of the month in which the account becomes 180 days contractually delinquent. However, in exceptional circumstances to achieve a fair customer outcome, and in line with regulatory expectations, they may be extended further.

For secured facilities, write-off should occur upon repossession of collateral, receipt of proceeds via settlement, or determination that recovery of the collateral will not be pursued.

Any secured assets maintained on the balance sheet beyond 60 months of consecutive delinquency-driven default require additional monitoring and review to assess the prospect of recovery.

There are exceptions in a few countries and territories where local regulation or legislation constrains earlier write-off, or where the realisation of collateral for secured real estate lending takes more time. Write-off, either partially or in full, may be earlier when there is no reasonable expectation of further recovery, for example, in the event of a bankruptcy or equivalent legal proceedings. Collection procedures may continue after write-off.

Credit risk in 2022

At 31 December 2022, gross loans and advances to customers and banks of $1,041bn decreased by $99.1bn, compared with 31 December 2021. This included adverse foreign exchange movements of $59.2bn and an $81.2bn decrease due to a reclassification of businesses to assets held for sale, including our banking business in Canada and our retail banking operations in France.

Excluding foreign exchange movements, the underlying decrease of $39.9bn was driven by a $36.1bn decrease in personal loans and advances to customers and by a $29.9bn decrease in wholesale loans and advances to customers. These were partly offset by a $25.9bn increase in loans and advances to banks.

The underlying decrease in personal loans and advances to customers was driven by the $50.1bn reclassification of businesses to assets held for sale, and by a decrease in other personal lending, mainly in Hong Kong (down $1.5bn). This was offset by mortgage growth of $15.4bn, mainly in the UK (up $8.9bn), Hong Kong (up $3.4bn) and Australia (up $1.6bn).

The underlying increase in loans and advances to banks was driven by growth in the UK (up $10.6bn), Hong Kong (up $7.9bn) and Egypt (up $1.9bn), driven mainly by higher central bank placements.

At 31 December 2022, the allowance for ECL of $12.6bn increased by $0.5bn compared with 31 December 2021, including favourable foreign exchange movements of $0.6bn and the effect of reclassifications to assets held for sale of $0.4bn. The $12.6bn allowance comprised $12.1bn in respect of assets held at amortised cost, $0.4bn in respect of loan commitments and financial guarantees, and $0.1bn in respect of debt instruments measured at fair value through other comprehensive income ('FVOCI').

Excluding foreign exchange movements, the allowance for ECL in relation to loans and advances to customers increased by $0.6bn from 31 December 2021. This was attributable to:

• a $0.7bn increase in wholesale loans and advances to customers, of which $0.7bn was driven by stage 3; and

• a $0.1bn decrease in personal loans and advances to customers, of which $0.4bn was driven by stage 3, partly offset by an increase of $0.3bn in stages 1 and 2.

Stage 3 balances at 31 December 2022 increased by $1.9bn from 31 December 2021. This was driven by a $3.2bn increase in wholesale loans and advances to customers, mainly in corporate real estate portfolios in Hong Kong. This was partly offset by a decrease of $1.3bn in personal loans and advances to customers.

At 31 December 2022, for certain retail lending portfolios, we introduced enhancements in the significant increase in credit risk ('SICR') approach in relation to capturing relative movements in probability of default ('PD'). The enhanced approach captured relative movements in PD since origination, which resulted in a significant migration to stage 2 from loans to customers gross carrying amounts in stage 1.

The volume of stage 1 customer accounts with lower absolute levels of credit risk who have exhibited some amount of relative increase in PD since origination have migrated into stage 2, and accounts originated with higher absolute levels of credit risk with no or insignificant increases in PD since origination have been transferred to stage 1, with no material overall change in risk.

The impact on ECL is immaterial due to the offsetting ECL impacts of stage migrations and due to the low loan-to-value ('LTV') profiles. This is particularly applicable to UK customers.

The enhancement of the SICR approach constitutes an improvement towards more responsive models that better reflect the SICR since origination. This includes consideration of the current cost of living pressures, as markets adjust to the higher interest-rate environment.

In wholesale lending, China's commercial real estate sector continued to deteriorate in 2022, resulting in further stage 2 allowances on downgrades and new and additional stage 3 charges.

The ECL charge for 2022 was $3.6bn, inclusive of recoveries. This was driven by higher ECL charges relating to increasing inflationary pressures, rising interest rates, China commercial real estate exposures and economic uncertainty, partly offset by a release in Covid-19-related allowances at the beginning of the year.

The ECL charge comprised: $2.4bn in respect of wholesale lending, of which $1.7bn were in stage 3 and purchased or originated credit impaired ('POCI'); $1.1bn in respect of personal lending, of which $0.5bn were in stage 3; and $0.1bn in respect of debt instruments measured at FVOCI.

Income statement movements are analysed further on page 101.

While credit risk arises across most of our balance sheet, ECL have typically been recognised on loans and advances to customers and banks, in addition to securitisation exposures and other structured products. As a result, our disclosures focus primarily on these two areas. For further details of:

• maximum exposure to credit risk, see page 153;

• measurement uncertainty and sensitivity analysis of ECL estimates, see page 153;

• reconciliation of changes in gross carrying/nominal amount and allowances for loans and advances to banks and customers including loan commitments and financial guarantees, see page 162;

• credit quality, see page 165;

• total wholesale lending for loans and advances to banks and customers by stage distribution, see page 171;

• wholesale lending collateral, see page 180;

• total personal lending for loans and advances to customers at amortised cost by stage distribution, see page 188; and

• personal lending collateral, see page 193.

•

Summary of credit risk

The following disclosure presents the gross carrying/nominal amount of financial instruments to which the impairment requirements in IFRS 9 are applied and the associated allowance for ECL.

1 The total ECL is recognised in the loss allowance for the financial asset unless the total ECL exceeds the gross carrying amount of the financial asset, in which case the ECL is recognised as a provision.

2 For further details on gross carrying amounts and allowances for ECL related to assets held for sale, see 'Assets held for sale' on page 151.

3 Includes only those financial instruments that are subject to the impairment requirements of IFRS 9. 'Prepayments, accrued income and other assets' as presented within the consolidated balance sheet on page 326 comprises both financial and non-financial assets, including cash collateral and settlement accounts.

4 Represents the maximum amount at risk should the contracts be fully drawn upon and clients default.

5 Debt instruments measured at FVOCI continue to be measured at fair value with the allowance for ECL as a memorandum item. Change in ECL is recognised in 'Change in expected credit losses and other credit impairment charges' in the income statement.

The following table provides an overview of the Group's credit risk by stage and industry, and the associated ECL coverage. The financial assets recorded in each stage have the following characteristics:

• Stage 1: These financial assets are unimpaired and without significant increase in credit risk on which a 12-month allowance for ECL is recognised.

• Stage 2: A significant increase in credit risk has been experienced on these financial assets since initial recognition for which a lifetime ECL is recognised.

• Stage 3: There is objective evidence of impairment and the financial assets are therefore considered to be in default or otherwise credit impaired on which a lifetime ECL is recognised.

• POCI: Financial assets that are purchased or originated at a deep discount are seen to reflect the incurred credit losses on which a lifetime ECL is recognised.

•

1 Represents the maximum amount at risk should the contracts be fully drawn upon and clients default.

2 Purchased or originated credit-impaired ('POCI').

Unless identified at an earlier stage, all financial assets are deemed to have suffered a significant increase in credit risk when they are 30 days past due ('DPD') and are transferred from stage 1 to stage 2. The following disclosure presents the ageing of stage 2

financial assets by those less than 30 days and greater than 30 DPD and therefore presents those financial assets classified as stage 2 due to ageing (30 DPD) and those identified at an earlier stage (less than 30 DPD).

1 Days past due ('DPD').

2 The days past due amounts presented above are on a contractual basis and include the benefit of any customer relief payment holidays granted.

1 Represents the maximum amount at risk should the contracts be fully drawn upon and clients default.

2 Purchased or originated credit-impaired ('POCI').

1 Days past due ('DPD').

2 The days past due amounts presented above are on a contractual basis and include the benefit of any customer relief payment holidays granted.

Stage 2 decomposition

The following table presents the stage 2 decomposition of gross carrying amount and allowances for ECL for loans and advances to customers. It also sets out the reasons why an exposure is classified as stage 2 and therefore presented as a significant increase in credit risk at 31 December 2022.

The quantitative classification shows gross carrying values and allowances for ECL for which the applicable reporting date probability of default ('PD') measure exceeds defined quantitative thresholds for retail and wholesale exposures, as set out in Note 1.2 'Summary of significant accounting policies', on page 342.

The qualitative classification primarily accounts for CRR deterioration, watch-and-worry and retail management judgemental adjustments.

A summary of our current policies and practices for the significant increase in credit risk is set out in 'Summary of significant accounting policies' on page 342.

1 Where balances satisfy more than one of the above three criteria for determining a significant increase in credit risk, the corresponding gross exposure and ECL have been assigned in order of categories presented.

2 Days past due ('DPD').

Assets held for sale

(Audited)

During 2022, gross loans and advances and related impairment allowances were reclassified from 'loans and advances to customers' and 'loans and advances to banks' to 'assets held for sale' in the balance sheet.

At 31 December 2022, the most material balances held for sale came from our banking business in Canada and from our retail banking operations in France.

Disclosures relating to assets held for sale are provided in the following credit risk tables, primarily where the disclosure is relevant to the measurement of these financial assets:

• 'Maximum exposure to credit risk' (page 153);

• 'Distribution of financial instruments by credit quality at 31 December' (page 165);

Although there was a reclassification on the balance sheet, there was no separate income statement reclassification. As a result, charges for changes in expected credit losses and other credit impairment charges shown in the credit risk disclosures include charges relating to financial assets classified as 'assets held for sale'.

'Loans and other credit-related commitments' and 'financial guarantees', as reported in credit disclosures, also include exposures and allowances relating to financial assets classified as 'assets held for sale'.

At 31 December 2022, gross loans and advances of our banking business in Canada were $55.5bn, and the related allowance for ECL were $0.2bn. Gross loans of our retail banking operations in France were $25.1bn, and the related allowance for ECL were $0.1bn.

Lending balances held for sale continue to be measured at amortised cost less allowances for impairment and, therefore, such carrying amounts may differ from fair value.

These lending balances are part of associated disposal groups that are measured in their entirety at the lower of carrying amount and fair value less costs to sell. Any difference between the carrying amount of these assets and their sales price is part of the overall gain or loss on the associated disposal group as a whole.

For further details of the carrying amount and the fair value at 31 December 2022 of loans and advances to banks and customers classified as held for sale, see Note 23 on the financial statements.