Externally driven

Geopolitical and macroeconomic risk

The group faces elevated geopolitical risks, with the Russia-Ukraine war continuing to have global economic and political implications. The Israel-Hamas war is also increasing tensions in the Middle East, leading to recent attacks on shipping in the Red Sea and resulting counter-measures, which have begun to disrupt supply chains. The group is monitoring and assessing the impacts of these wars.

The Russia-Ukraine war has continued to elevate geopolitical instability which could have continued ramifications for the group and its customers. We continue to monitor and respond to financial sanctions and trade restrictions that have been adopted in response. These sanctions and trade restrictions are complex, novel and evolving. In particular, the US, the UK and the EU, as well as other countries, have imposed significant sanctions and trade restrictions against Russia. Such sanctions and restrictions target certain Russian government officials, politically exposed persons, business people, Russian oil imports, energy products, financial institutions and other major Russian companies and sanctions evasion networks. These countries have also enacted more generally applicable investment, export, and import bans and restrictions. In December 2023, the US established a new secondary sanctions regime, providing itself broad discretion to impose severe sanctions on non-US banks that are knowingly or even unknowingly engaged in certain transactions or services involving Russia's military-industrial base. This creates challenges associated with the detection or prevention of third-party activities beyond HSBC's control. The imposition of such sanctions against any non-US HSBC entity could result in significant adverse commercial, operational, and reputational consequences for HSBC, including the restriction or termination of the non-US HSBC entity's ability to access the US financial system and the freezing of the entity's assets that are subject to US jurisdiction. In response to such sanctions and trade restrictions, as well as asset flight, Russia has implemented certain countermeasures, including the expropriation of foreign assets.

Our business in Russia principally serves multinational corporate clients headquartered in other countries. Following a strategic review, HSBC Europe BV (a wholly-owned subsidiary of HSBC Bank plc) has entered into an agreement to sell its wholly-owned subsidiary HSBC Bank (RR) (Limited Liability Company). While we remain committed to the sale of our business in Russia, the outcome of the sale became less certain and remains subject to regulatory approval.

Economic and financial risks also remain significant, and we continue to monitor our risk profile closely in the context of uncertainty over global macroeconomic policies.

A fall in global energy and food prices from the highs of 2022 facilitated a process of disinflation across key economies during 2023. Following the reduction in global inflation rates, central banks in most developed markets are expected to have concluded monetary policy tightening in the second half of 2023. A further fall in inflation is expected to enable interest rate reductions through 2024, although forecasts still assume that they remain materially higher than in recent years. Higher financing costs will raise interest payment burdens for many counterparties.

Fiscal deficits are also expected to remain large in both developed and emerging markets, as public spending on items including social welfare, defence and climate transition initiatives is expected to remain high. In many countries, the fiscal response to the Covid-19 pandemic has also left a very high public debt burden. Against a backdrop of slower economic growth and high interest rates, a rise in borrowing costs could increase the financial strains on highly indebted sovereigns.

Macroeconomic, financial and geopolitical risks have all impacted our macroeconomic scenarios. Our Central scenario, which has the highest probability weighting in our IFRS 9 'Financial Instruments' calculations of ECL, assumes that GDP growth across our key markets will remain low in 2024, followed by moderate recovery in 2025. It is anticipated that inflation will converge towards central banks' target rates by early 2025. Similarly, interest rates are expected to decline but remain materially higher than in recent years. We also consider scenarios where commodity prices are materially higher, inflation and interest rates rise and a global recession follows, although we assign these scenarios a lower probability of occurring.

Forecasts remain uncertain, and changing economic conditions and the materialisation of key risks could reduce the accuracy of the Central scenario forecast. In particular, forecasts in recent years have been sensitive to commodity price changes, changing supply chain conditions, monetary policy adjustments and inflation expectations. Uncertainty remains with respect to the relationship between the economic factors and historical loss experience, which has required adjustments to modelled ECL in cases where we determined that the model was unable to capture the material underlying risks.

For further details of our Central and other scenarios, see 'Measurement uncertainty and sensitivity analysis of ECL estimates' on page 41.

A Memorandum of Understanding ('MoU') was signed on 27 June 2023, setting out a framework for voluntary regulatory cooperation in financial services between the UK and the EU, including through the establishment of a Joint UK-EU Financial Regulatory Forum. This is expected to provide a platform on which both parties will be able to discuss financial services-related issues, including future equivalence determinations.

Negotiations between the UK and the EU over the operation of the Northern Ireland Protocol concluded in February 2023. In January 2024, an additional agreement titled, "Safeguarding the Union" was signed. Together, these agreements provide a greater degree of certainty over the regulatory arrangements governing the movement of goods between Great Britain, Northern Ireland and the EU. In  February 2024, the Northern Ireland Executive was reinstated after a power-sharing agreement was reached by key political parties.

Challenges remain in the UK-EU relationship following the UK's withdrawal from the EU. Over the medium to long term, the UK's withdrawal from the EU may continue to adversely impact the terms of EU market access for our UK based clients. We are monitoring the situation closely, including the potential impacts on our customers.

Our business could also be adversely affected by economic or political developments in regions of the world outside Europe. This reflects our extensive business links, through members of the HSBC Group and other entities, in Asia and elsewhere. Tensions between China and the US, extending to the UK, the EU, India and other countries, and political developments in Hong Kong and Taiwan, may adversely affect the group.

The US, the UK, the EU and other countries have imposed various sanctions and trade restrictions on China. In response to foreign sanctions and trade restrictions, China has also announced sanctions, trade restrictions and laws that could impact the group and its customers.

Further sanctions, counter-sanctions and trade restrictions may adversely affect the group, its customers and the markets in which the group operates, by creating regulatory, reputational and market risks.

Mitigating actions

-     We closely monitor geopolitical and economic developments in our key markets and sectors, and undertake scenario analysis where appropriate. This helps us to take actions to manage our portfolios where necessary, including through enhanced monitoring, amending our risk appetite and/or reducing limits and exposures.

-     We continue to monitor the EU's relationship with the UK, and assess the potential impact on our people, operations and portfolios.

-     We continue to monitor our risk profile closely in the context of the current geopolitical and macroeconomic situation, and given the significant uncertainties, additional mitigating actions may be required.

-     We have taken steps, where necessary, to enhance physical security in geographical areas deemed to be at high risk from terrorism and military conflicts.

Credit risk

Despite ongoing macro economic and geopolitical challenges predominantly driven by the Russia-Ukraine war, prolonged high inflation and rising energy costs, our credit portfolio remains stable and resilient with no material concentration risk. Economic prospects for credit risk across our key markets will be driven by a number of factors including how inflationary pressures are managed across the EU and the UK, and whether a global recession develops, exacerbated by the ongoing Russia-Ukraine war. The Israel-Hamas war is also being monitored closely.

Mitigating actions

-     Reviews of key credit portfolios are undertaken regularly to seek to ensure that individual customer or portfolio risks are understood and our management of the level of facilities offered through a period of low economic growth is appropriate.

-     We continue to monitor high risk wholesale industry sectors closely via quarterly industry risk appetite reviews and in 2023 we also undertook specific reviews of portfolios showing vulnerability such as Commodity Traders, Leverage, Construction and Building Materials, Automotives, Retail, 'Consumer Spend' and Commercial Real Estate.

-     Detailed performance monitoring is reviewed on a monthly basis, which includes early warning indicators and a view of concentration risks. Portfolio limits and exposures are re-assessed and reductions implemented where appropriate.

-     We stress test portfolios of particular concern to identify sensitivity to loss under a range of scenarios, with management actions being taken to seek to rebalance exposures and to manage risk appetite where necessary.

Cyber threat and unauthorised access to systems

Together with other organisations, we continue to operate in an increasingly hostile cyber threat environment. These threats include potential unauthorised access to customer accounts, and attacks on our systems or those of our third-party suppliers. These threats require ongoing investment in business and technical controls to defend against them.

Mitigating actions

-     Our cyber intelligence and threat analysis team continually evaluate threat levels for the most prevalent cyber-attack types and their potential outcomes (see page 80 - cross-reference to Cybersecurity). To further protect the group and our customers and to help ensure the safe expansion of our business lines, we continue to strengthen our controls to help reduce the likelihood and impact of advanced malware, data leakage, exposure through third parties and security vulnerabilities.

-     We continue to seek to enhance our cybersecurity capabilities, including Cloud security, identity and access management, metrics and data analytics, and third-party security reviews. An important part of our defence strategy is conducting cybersecurity training and awareness campaigns so that our colleagues remain aware of cybersecurity issues and know how to report incidents.

-     We regularly report and review cyber risk and control effectiveness at executive and non-executive Board level. We also report it across our businesses and functions to help ensure appropriate visibility and governance of the risk and its mitigating actions.

-     We participate globally in industry bodies and working groups to collaborate on tactics employed by cyber-crime groups and to collaborate in helping to defend against, detect and prevent cyber-attacks on financial organisations.

-     We experience numerous attempts to compromise our cybersecurity. We respond to cybersecurity attacks in accordance with our cybersecurity framework and applicable laws, rules and regulations. To date, none of these attacks have had a material impact on our business or operations.

Evolving regulatory environment risk

We aim to keep abreast of the emerging regulatory compliance and conduct risk agenda. Current focus areas include but are not limited to: ESG agenda developments, including in particular managing the risks of 'greenwashing'; ensuring good customer outcomes, including addressing customer vulnerabilities due to cost of living pressures; enhancements to regulatory reporting controls; and employee compliance, including the use of e-communication channels.

We monitor regulatory developments closely and engage with regulators, as appropriate, to help ensure new regulatory requirements are implemented effectively and in a timely way.

The competitive landscape in which the group operates may be impacted by future regulatory changes and government intervention.

Mitigating actions

-     We monitor for regulatory developments to understand the evolving regulatory landscape and seek to respond with changes in a timely way.

-     We continue to support work that is focused on the implementation of UK Consumer Duty requirements.

-     We engage with governments and regulators to seek to make a contribution to regulations and to try and ensure that new requirements are considered properly and can be implemented effectively.

-     We hold regular meetings with relevant authorities to discuss strategic contingency plans, including those arising from geopolitical issues.

-     Our simplified conduct approach has been embedded to align to our purpose and values, in particular the value 'we take responsibility'.

Financial crime and fraud risk

Financial institutions remain under considerable regulatory scrutiny regarding their ability to detect and prevent financial crime. In 2023, these risks were exacerbated by rising geopolitical tensions and ongoing macroeconomic factors. These challenging developments require managing conflicting laws and approaches to legal and regulatory regimes, and implementing increasingly complex and less predictable sanctions and trade restrictions.

Amid high levels of inflation and increasing cost of living pressures, we face increasing regulatory expectations with respect to managing internal and external fraud and protecting vulnerable customers. In addition, the accessibility and increasing sophistication of generative AI brings financial crime risks. While there is potential for the technology to support financial crime detection, there is also a risk that criminals use generative AI to perpetrate fraud, particularly scams.

The digitisation of financial services continues to have an impact on the payments ecosystem, with an increasing number of new market entrants and payment mechanisms, not all of which are subject to the same level of regulatory scrutiny or regulations as banks. Developments around digital assets and currencies have continued at pace, with an increasing regulatory and enforcement focus on the financial crimes linked to these types of assets.

Expectations continue to increase with respect to the intersection of ESG issues and financial crime, as our organisation, customers and suppliers transition to net zero. These are particularly focused on potential 'greenwashing', human rights issues and environmental crimes. In addition, climate change itself could heighten risks linked to vulnerable migrant populations in countries where financial crime is already more prevalent.

We also continue to face increasing challenges presented by national data privacy requirements, which may affect our ability to manage financial crime risks across markets.

Mitigating actions

-     We continue to seek to manage sanctions and trade restrictions through the use of reasonably designed policies, procedures and controls, which are subject to ongoing testing, auditing and enhancements.

-     We continue to develop our fraud controls and invest in capabilities to fight financial crime through the application of

advanced analytics and AI, while monitoring technological developments and engaging with third parties.

-     We are looking at the impact of a rapidly changing payments ecosystem, as well as risks associated with direct and indirect exposure to digital assets and currencies, in an effort to maintain appropriate financial crime controls.

-     We regularly review our existing policies and control framework so that developments relating to ESG are considered and the financial crime risks are mitigated to the extent possible.

-     We engage with regulators, policymakers and relevant international bodies, seeking to address data privacy challenges through international standards, guidance and legislation.

Environmental, social and governance ('ESG') risk

We are subject to financial and non-financial risks associated with ESG-related matters. Our current areas of focus include climate risk, nature-related risks and human rights risks. These can impact us both directly and indirectly through our business activities and relationships.

Our assessment of climate risks covers three distinct time periods, comprising: short term, which is up to 2025; medium term, which is between 2026 and 2035; and long term, which is between 2036 and 2050.

-     We may face credit losses if our customers business models fail to align to a net zero economy or if our customers face disruption to their operations or deterioration to their assets as a result of extreme weather.

-     We may face trading losses if climate change results in changes to macroeconomic and financial variables which negatively impact our trading book exposures.

-     We may face impacts from physical risk on our own operations and premises, owing to the increase in frequency and severity of weather events and chronic shifts in weather patterns, which could affect our ability to conduct our day-to-day operations.

-     We may face increased reputational, legal, and regulatory risks if we fail to make sufficient progress towards the HSBC Group's ESG ambitions, targets and commitments, if we fail to meet evolving regulatory expectations and requirements on the management of climate and broader ESG risks, or if we knowingly or unknowingly make inaccurate, unclear, misleading, or unsubstantiated claims regarding sustainability to our stakeholders.

-   Requirements, policy objectives, expectations or views may vary by jurisdiction and stakeholder in relation to ESG related matters. We may be subject to potentially conflicting approaches to ESG matters in certain jurisdictions, which may impact our ability to conduct certain business within those jurisdictions or result in additional regulatory compliance, reputational, political or litigation risks. These risks may also arise from divergence in the implementation of ESG, climate policy and financial regulation in the many regions in which we operate, including initiatives to apply and enforce policy and regulation with extraterritorial effect.

-     We may face financial reporting risk in relation to our climate-related and broader ESG disclosures, as any data, methodologies, scenarios and reporting standards we have used may evolve over time in line with market practice, regulation or developments in science.  We may also face the risk of making reporting errors due to issues relating to the availability, accuracy and verifiability of data and system, process and control challenges. Any changes and reporting errors could result in revisions to our internal frameworks and reported data and could mean that reported figures are not reconcilable or comparable year-on-year. We may also have to re-evaluate our progress towards the HSBC Group's climate-related targets in the future and this could result in reputational, legal, and regulatory risks.

-     We may face model risk, as the uncertain and evolving impacts of climate change and data and methodology limitations present challenges to creating reliable and accurate model outputs.

-     We may face climate and broader ESG-related litigation and regulatory enforcement risks, either directly if stakeholders think
that we are not adequately managing climate and broader ESG-related risks or indirectly if our clients and customers are themselves the subject of litigation, potentially resulting in the revaluation of client assets.

We may also be exposed to nature-related risks beyond climate change. These risks arise when the provision of natural capital such as water availability, air quality and soil quality is compromised by human activity. Nature risk can manifest through macroeconomic, market, credit, reputational, legal and regulatory risks, for the group as well as our clients and customers.

Regulation and disclosure requirements in relation to human rights, and to modern slavery in particular, are increasing. Businesses are expected to be transparent about their efforts to identify and respond to the risk of negative human rights impacts arising from their business activities and relationships.

We remained aligned to the HSBC Group's materiality-based approach in developing our climate risk management capabilities across our businesses by prioritising sectors, portfolios and counterparties with the highest impacts.

Mitigating actions

-     A dedicated Environmental Risk Oversight Forum is responsible for shaping and overseeing our approach and providing support in managing climate and sustainability risk.

-     The Europe Reputational Risk Committee considers climate-related matters arising from customers, transactions and third parties that either present a serious potential reputational risk to HSBC Bank plc (or the HSBC Group) or merit a decision to ensure a consistent risk management approach across the regions, global businesses and global functions.

-     Our climate risk programme continues to follow the HSBC Group's programme set to support the development of climate risk management capabilities across four key pillars: governance and risk appetite, risk management, stress testing and scenario analysis, and disclosures. We continue to enhance our approach and mitigation to the risk of greenwashing.

-     We have supported the HSBC Group in the development and implementation of an enhanced transition engagement questionnaire, which is used by Relationship Managers to collect information through discussions with our clients in high transition risk sectors, to support their transition away from high carbon activities.

-     We implement HSBC Group's sustainability risk policies as part of its broader reputational risk framework. We focus our policies on sensitive sectors which may have a high adverse impact on people or on the environment and in which we have a significant number of customers. In January 2024, the HSBC Group updated its energy policy covering the broader energy system including upstream oil and gas, oil and gas power generation, coal, hydrogen, renewables and hydropower, nuclear, biomass and energy from waste. The HSBC Group also updated its thermal coal phase-out policy, which aims to drive thermal coal phase-out aligned to science-based timeframes. The HSBC Group takes a risk-based approach in the way that it identifies transactions and clients to which its energy and thermal coal phase-out policies apply, and report on relevant exposures, adopting approaches proportionate to risk and materiality.

-     In 2023, the HSBC Group conducted pilot exercises to assess nature risk exposures, focusing on our HSBC Continental Europe portfolios in line with regulatory expectations.

-     In 2023, the HSBC Group provided practical guidance and training, where relevant, to our colleagues across the group on how to identify and manage human rights risks.

For further details of our approach to climate risk management, see 'Climate risk' on page 78.

Digitalisation and technological advances risk

Developments in technology and changes to regulations are enabling new entrants to the industry, particularly with respect to payments. This challenges us to continue innovating to address evolving customer requirements, drive efficiency and adapt our products to attract and retain customers. As a result, we may need to increase our investment in our business to adapt or develop products and services to respond to our customers' evolving needs. We also need to ensure that new digital capabilities do not weaken our resilience or wider risk management capabilities.

New technologies such as generative AI, large language models blockchain and quantum computing offer both business opportunities and potential risks for the group. As with the use of all technologies, we aim to maximise their potential while seeking to ensure a robust control environment is in place to help manage the inherent risks, such as the impact on encryption algorithms.

Mitigating actions

-     We continue to monitor this emerging risk and advances in technology, as well as changes in customer behaviours, to understand how these may impact our business.

-     We asses new technologies to help develop appropriate controls and maintain resilience.

-     We closely monitor and assess financial crime risk and the impact on payment transparency and architecture.

Internally driven

People risk

While the overall trend in employee turnover has been improving, certain markets in the European region are still facing elevated inflation, higher turnover rates, and labour market complexities. Our success in delivering our strategic priorities and managing the regulatory and legislative environment depends on the development and retention of our leadership and high-performing employees.

Mitigating actions

The ability to continue to attract, develop and retain talent is primarily impacted by a competitive labour market alongside heightened inflationary pressures, coupled with business change impacts on employees. Compliance with employment laws and regulations remains a priority.

-     We seek to promote a diverse and inclusive workforce, provide active support to employees, and continue to build the speak up culture.

-     We monitor people risks that could arise from organisational restructuring. Improved capacity and enhanced workload management through demand planning review and strengthening is applied.

-     Focus and emphasis is maintained on our strategy, values and purpose. We encourage our people leaders to focus on talent retention at all levels, with an empathetic mindset and approach, while ensuring the whole proposition of working in the group is well understood.

-     Strong Senior management oversight is maintained on political, legislative, and regulatory challenges to help mitigate the effect of external factors which may impact our employment practices.

-     We carefully monitor the impact of the rising cost of living across the region. Our fixed pay principles consider the impact of inflation on our employees across the region recognising the pay pressure.

-     Focus is maintained on Future Skills development, with curriculums made available to all employees through the HSBC University.

-     We develop succession plans for key management roles, with consistent oversight from the group's Executive Committee.

-     We monitor hiring activities and levels of employee attrition, with each business and function putting in place plans to help ensure they have effective workforce forecasting to meet business demands.

IT systems infrastructure and operational resilience

We operate in an extensive and complex technology landscape, which needs to remain resilient in order to support customers, the group and markets where we operate. Risks arise where technology is not understood, maintained, or developed appropriately. We remain committed to investing in the reliability and resilience of our IT systems and critical services. The group does so in order to help protect its customers, affiliates and counterparties, and to help ensure they do not receive disruption to services that could result in reputational, legal and regulatory consequences. Increased pressure has been seen on our business operations and customer support centres as our people, processes and systems have responded to meet the current economic environment.

The group's strategy includes simplification of our technology estate to reduce complexity and costs; this includes consolidation of our core banking systems onto a single strategic platform. This platform  will leverage existing and known technology, and will be simpler and easier to maintain. However, as with any strategic transformation programme risks associated with implementation must be managed continuously.

Mitigating actions

-     We continue to invest in transforming how software solutions are developed, delivered and maintained to improve system resilience.

-     We continue to upgrade many of our IT systems, simplify our service provision and replace older IT infrastructure and applications.

-     We manage implementation risks arising from the simplification of our technology estate continuously via oversight of these risks at all levels of the programme and reporting up to our Risk Committee.

Execution risk

In order to deliver our Strategic objectives and meet mandatory regulatory requirements, it is important for the group to maintain a strong focus on change execution risk. Change execution risk remains elevated driven by the current scale, complexity and pace of the group's strategic and regulatory change initiatives. This requires robust management of significant resource and time sensitive programmes that are expected to be executed in 2024.

Mitigating actions

-     Change execution risk is part of our risk taxonomy and control library so that it is defined, assessed, managed, reported and overseen in the same as our other material risks.

-     Our change framework provides colleagues across all levels of the group who deliver on strategic and organisational initiatives with a common and consistent understanding of their role in achieving value and outcomes.

-     The group's Change Oversight Governance function oversees the prioritisation, strategic alignment and management of change execution risk for our Change portfolios and initiatives.

Model risk

Model risk arises whenever business decision making includes reliance on models. We use models in both financial and non-financial contexts and in a range of business applications such as customer selection, product pricing, financial crime transaction monitoring, creditworthiness evaluation and financial reporting. Assessing model performance is a continuous undertaking. Models can need redevelopment as market conditions change.

We continued to prioritise the redevelopment of internal ratings-based ('IRB'), internal model approach ('IMA') and internal model methods ('IMM') models, as part of the IRB repair and Basel III programmes with a key focus on enhancing the quality of data used as model inputs. A new suite of IRB models for local corporates used in France is undergoing regulatory approval from the Prudential Regulation Authority ('PRA') and European Central Bank ('ECB'). A comprehensive development and application plan of key regulatory capital models has been submitted to both regulators and has been designed to help ensure that HSBC meets both the PRA and ECB increased expectations on model risk management. Climate risk

modelling is a key focus as our commitment to ESG has become a critical part of the group's strategy.

Model risk remains a key area of focus given the regulatory scrutiny in this area, with local regulatory exams taking place across the group and revised principles on model risk published by the PRA (SS1/23) and expected to come into force in 2024 and further developments in policy expected from other regulators.

Mitigating actions

-     We have continued to embed the enhanced monitoring, review and challenge of IRB and expected credit loss model performance through our Model Risk Management function. The Model Risk Management team aims to provide strong and effective review and challenge of any future redevelopment of these models.

-     Model Risk Management works closely with our lines of business to ensure that our models meet regulatory requirements as well as risk management, pricing, liquidity and capital management needs. Internal Audit provides assurance over the risk management framework for models.

-     Additional assurance work is performed by the model risk governance teams, which act as second lines of defence. The teams test whether controls implemented by model users comply with model risk policy and if model risk standards are adequate.

-     Models using AI or generative AI techniques are validated and monitored to help ensure that risks that are determined by the algorithms have adequate oversight and review. A framework to manage the range of risks that are generated by these advanced techniques, and to recognise the multidisciplinary nature of these risks, is being developed.

Data risk

We use multiple systems and growing quantities of data to support our customers. Risk arises if data is incorrect, unavailable, misused, or unprotected. We need to meet external regulatory obligations and laws that cover data, such as the Basel Committee on Banking Supervision's 239 guidelines and the General Data Protection Regulation ('GDPR').

Mitigating actions

-     Through our global data management framework, we monitor the quality, availability and security of data that supports our customers and internal processes. We work towards resolving any identified data issues in a timely manner.

-     We have made improvements to our data policies. We are implementing an updated control framework to help enhance the end-to-end management of data risk.

-     We aim to protect customer data through our data privacy framework, which establishes practices, design principles and guidelines that enable us to demonstrate compliance with data privacy laws and regulations.

-     We seek to continue to modernise our data and analytics infrastructure through investments in Cloud technology, data visualisation, machine learning and artificial intelligence.

-     We educate our employees on data risk and data management. We deliver regular mandatory training on how to protect and manage data appropriately.

Third Party risk

We use third parties to provide a range of goods and services. It is critical that we ensure that we have appropriate risk management policies, processes and practices over the selection, governance and oversight of third parties and their supply chain, particularly for key activities that could affect our operational resilience.

Any deficiency in the management of risks associated with our third parties could affect our ability to support our customers and meet regulatory expectations.

Mitigating actions

-     We continuously seek to improve our control framework for the use of third-party providers to seek to ensure risks associated with these arrangements are understood and managed effectively by our businesses and functions across the group.

-     We continue to enhance the management of our intra-group arrangements and external third-party arrangements.

-     We are implementing the changes required by new regulations as set by our regulators.

-