Additional Financial Information Part 1

Standard Chartered PLC - Additional Financial information

Highlights

Standard Chartered PLC (the Group) today releases its results for the year ended 31 December 2025. The following pages provide additional information related to the announcement.

Table of contents

Page 01

Enterprise Risk Management Framework

Risk management is at the heart of banking, it is what we do. Managing risk effectively is how we drive commerce and prosperity for our clients and our communities, and it is how we grow sustainably and profitably as an organisation.

Effective risk management is essential in delivering consistent and sustainable performance for all our stakeholders and is a central part of the financial and operational management of the Group. The Group adds value to clients and the communities in which they operate by balancing risk and reward to generate returns for shareholders.

The Enterprise Risk Management Framework (ERMF) enables the Group to manage enterprise-wide risks, with the objective of maximising risk-adjusted returns while remaining within our Risk Appetite (RA). The ERMF is complemented by frameworks, policies and standards which are mainly aligned to the Principal Risk Types (PRTs), and is embedded across the Group, including its branches and subsidiaries¹. It is reviewed and approved by the Board annually, with the latest version being effective from August 2025.

Risk culture

Risk culture encompasses our general awareness, attitudes, and behaviours towards risk, as well as how risk is managed at enterprise level.

A healthy risk culture is one in which everyone takes personal responsibility to identify and assess, openly discuss, and take prompt action to address existing and emerging risks. We expect our control functions to provide oversight and challenge constructively, collaboratively, and in a timely manner on the risks owned by the first line of defence. This effort is reflected in our valued behaviours and underpinned by our Code of Conduct and Ethics.

The risks we face constantly evolve, and we must always look for ways to manage them as effectively as possible. While unfavourable outcomes will occur from time to time, a healthy risk culture means that we react quickly and transparently. We can then take the opportunity to learn from our experience and improve our framework and processes.

Strategic risk management

The Group's approach to strategic risk management includes the following:

• Risk identification: impact analyses of risks that arise from the Group's growth plans, strategic initiatives, and business model vulnerabilities are reviewed. This assesses how existing risks have evolved in terms of relative importance and whether new risks have emerged.

• Risk Appetite: impact analysis is performed to assess if strategic initiatives can be achieved within RA and highlight areas where additional RA should be considered.

• Stress testing: identified risks are used to develop scenarios for enterprise stress tests.

Roles and responsibilities

Senior Managers Regime²

Roles and responsibilities under the ERMF are aligned to the objectives of the Senior Managers Regime. The Group Chief Risk Officer (GCRO) is responsible for the overall development and maintenance of the Group's ERMF and for identifying material risks which the Group may be exposed to. The GCRO delegates effective implementation of the Risk Type Frameworks (RTF) to Risk Framework Owners (RFO), who provide second line of defence oversight for their respective PRTs.

The Risk function

The Risk function provides independent oversight and challenge on the Group's risk management, ensuring that business is conducted in line with regulatory expectations. The GCRO directly manages the Risk function, which is independent from the origination, trading, and sales functions of the businesses. The Risk function is responsible for:

• proposing the RA for approval by the Board

• maintaining the ERMF, ensuring that it remains relevant and appropriate to the Group's business activities, and is effectively communicated and implemented across the Group

• ensuring that risks are properly assessed, risk and return decisions are transparent and risks are controlled in accordance with the Group's standards and RA

• overseeing and challenging the management of PRTs under the ERMF

• ensuring that the necessary balance in making risk and return decisions is not compromised by short-term pressures to generate revenues.

1  The Group's ERMF and system of internal control applies only to wholly controlled subsidiaries of the Group, and not to associates, joint ventures or structured entities of the Group.

2 Senior managers refer to individuals designated as senior management functions under the FCA and PRA Senior Managers Regime.

Page 02

We have a unified second line of defence, with all the PRTs reporting into the GCRO. The unified second line supports the Group's strategy by building a sustainable ERMF that places regulatory and compliance standards, together with culture of appropriate conduct, at the forefront of the Group's agenda.

Three lines of defence model

The Group applies a three lines of defence model to its day-to-day activities for effective risk management, and to reinforce a strong governance and control environment. Typically:

• Businesses and functions engaged in or supporting revenue generating activities that own and manage risks constitute the first line of defence.

• Group Control functions, independent of the first line of defence, that provide oversight and challenge of risk management activities act as the second line of defence.

• Internal Audit acts as the third line of defence, providing independent assurance on the effectiveness of controls supporting the activities of the first and second lines of defence.

Each PRT has an RTF which outlines the areas of governance and risk management and is the formal mechanism through which authorities are delegated. Risk management plans, processes, activities, and resource allocations are consistent with the three lines of defence model prescribed by the ERMF.

Risk identification and assessment

Identification and assessment of potentially adverse risk events is an essential first step in managing the risks of any business or activity. To ensure consistency we use PRTs to classify our risk exposures. However, we also recognise the need to maintain a holistic perspective since:

• a single transaction or activity may give rise to multiple types of risk exposure

• risk concentrations may arise from multiple exposures that are closely correlated

• a given risk exposure may change its form from one risk type to another.

There are also sources of risk that arise beyond our own operations, such as the Group's dependency on suppliers for the provision of services and technology.

As the Group remains accountable for risks arising from the actions of such third parties, failure to adequately monitor and manage these relationships could materially impact the Group's ability to operate.

The Group maintains a taxonomy of risks inherent to the strategy and business model, as well as a risk inventory which captures identified risks, including the Topical and Emerging Risks (TERs) which the Group is or might be exposed to. Multiple identification and assessment techniques are used to ensure breadth and depth of understanding of the internal and external risk environment, as well as potential opportunities. A risk assessment of the corporate plan is undertaken annually, supplemented by risk assessments of new initiatives. Risk identification findings inform the related risk oversight process, RA and controls setting, scenario selection and design, and model refinement and development.

The GCRO and the Group Risk Committee (GRC) regularly review reports on the risk profile for the PRTs, adherence to Group RA, stress test results and the risk identification results including TERs.

Risk Appetite and profile

The Group recognises the following constraints which determine the risks that we are willing to take in pursuit of our strategy and the development of a sustainable business:

• Risk capacity is the maximum level of risk the Group can assume, given its current capabilities and resources, before breaching constraints determined by capital and liquidity requirements or the internal operational environment, or otherwise failing to meet the expectations of regulator and law enforcement agencies.

• RA is defined by the Group and approved by the Board. It is the boundary for the risk that the Group is willing to undertake to achieve its strategic objectives and corporate plan. We set our RA to enable us to grow sustainably while managing our risks, giving confidence to our stakeholders. The Group RA is supplemented by risk control tools such as granular level limits, policies, and standards to maintain the Group's risk profile within approved RA.

The Board is responsible for approving the RA Statements, which are underpinned by a set of financial and operational control parameters known as RA metrics and their associated thresholds. These set boundaries for the aggregate risk exposures that can be taken across the Group.

The Group RA is reviewed at least annually to ensure that it is fit for purpose and aligned with strategy, with focus given to new or emerging risks.

Risk Appetite Statement

The Group will not compromise adherence to its RA in order to pursue revenue growth or higher returns.

See the table for the set of RA Statements.

Page 03

Stress testing

The objective of stress testing is to support the Group in assessing that it:

• does not carry excessive risk concentrations that could produce unacceptably high losses under severe but plausible scenarios

• has sufficient financial resources to withstand stress, including under severe but plausible scenarios

• understands key business model risks and considers what kind of event might crystallise those risks - even if extreme and with a low likelihood of occurring - and identifies, as required, actions to mitigate the likelihood or impact of those events

• can meet risk appetite and planned distributions after considering relevant downside scenarios

• has set RA metrics at appropriate levels.

Enterprise stress tests incorporate capital and liquidity adequacy stress tests, including recovery and resolution, as well as reverse stress tests. The Group uses historical, topical, emerging and hypothetical forward-looking scenarios. A common set of scenarios is used across all legal entities complemented in some cases with entity-specific scenarios.

Stress tests are performed at the Group, country, business, and portfolio level under a wide range of risks and at varying degrees of severity. Unless specifically set by the regulator, scenario design is a bespoke process that aims to explore risks that can adversely impact the Group.

The Board delegates approval of the Bank of England (BoE) stress test submissions to the Board Risk Committee (BRC), which reviews the recommendations from the GRC. Based on the stress test results, the Group Chief Financial Officer (GCFO) and GCRO can recommend strategic actions to the Board to ensure that the Group's strategy remains within RA.

In addition, analysis is run at the PRT level to assess specific risks and concentrations that the Group may be exposed to. These include qualitative assessments such as stressing of credit sectors or portfolios, and quantitative assessments such as potential losses from severe but plausible market risk scenarios or internal stressed liquidity metrics. RA for market risk stress losses is set at the Group as well as legal entity level.

Non-financial risk types are also stressed to assess the necessary capital requirements and/or operational resilience under the Operational and Technology RTF.

The Group has also undertaken a number of Climate Risk stress tests, both those mandated by regulators as well as management scenarios.

Principal Risk Types

PRTs are those risks that are inherent in our strategy and business model and have been formally defined in the Group's ERMF. These risks are managed through distinct RTFs which are approved by the GCRO.

The PRTs and associated RA Statements are reviewed annually. The table below shows the Group's current PRTs, their definitions and RA statements.

Page 04

1  Fraud forms part of the Financial Crime RA Statement but, in line with market practice, does not apply a zero-tolerance approach.

ERMF effectiveness reviews

The GCRO is responsible for annually affirming the effectiveness of the ERMF to the BRC via an effectiveness review. This review is based on the principle of evidence-based self-assessments for all the RTFs and relevant policies. A top-down review and challenge of the results is conducted by the GCRO with all RFOs and an opinion on the internal control environment is provided by Group Internal Audit.

The ERMF effectiveness review measures year-on-year progress. The key outcomes of the 2025 review are:

• Continued focus on embedding the ERMF across the organisation.

• Financial risks remain effectively managed, and the Group is continually making progress in embedding non-financial risk management.

• Self-assessments performed in branches and banking subsidiaries reflect the embeddedness of the ERMF. Country and cluster risk committees continue to play an active role in overseeing and managing risks across our footprint markets.

Ongoing effectiveness reviews allow for a structured approach to identify improvement opportunities and build plans to address them.

Executive and Board risk oversight

Overview

The corporate governance and committee structure helps the Group to conduct our business. The Board has ultimate responsibility for risk management and approves the ERMF based on the recommendation of the BRC, which also recommends the Group RA Statement for all PRTs and other risks. In addition to the BRC and Audit Committee, the Culture and Sustainability Committee oversees the Group's culture and key sustainability priorities.

Group Risk Committee

The GRC, which derives its authority from the GCRO, is responsible for ensuring the effective management of risk throughout the Group in support of the Group's strategy. The GCRO chairs the GRC, whose members are drawn from the Group Management Team. The GRC oversees the effective implementation of the ERMF for the Group, including the delegation of any part of its authorities to appropriate individuals or sub-committees.

Page 05

Group Asset and Liability Committee

The Group Asset and Liability Committee (GALCO) is chaired by the GCFO. Its members are drawn principally from the Management Team. GALCO is responsible for determining the Group's balance sheet strategy and ensuring that, in executing the Group's strategy, the Group operates within RA and regulatory requirements relating to capital, loss-absorbing capacity, liquidity, leverage, Interest Rate Risk in the Banking Book (IRRBB), Banking Book Basis Risk and Structural Foreign Exchange Risk. GALCO is also responsible for ensuring that internal and external recovery planning requirements are met.

Page 06

Principal risks

We manage and control our PRTs through distinct RTFs, policies and RA.

Credit Risk

Mitigation

Segment-specific policies are in place for Corporate & Investment Banking (CIB) and Wealth & Retail Banking (WRB) which set the principles that must be followed for the end-to-end credit process covering initiation, assessment, documentation, approval, monitoring and governance.

The Group also sets out standards for the eligibility, enforceability, and effectiveness of mitigation arrangements. Potential losses are mitigated using a range of tools, such as collateral, netting agreements, credit insurance, credit derivatives and guarantees.

Risk mitigants are carefully assessed for their market value, legal enforceability, correlation, and counterparty risk of the protection provider. Collateral is valued prior to drawdown and monitored regularly thereafter as required, to reflect current market conditions, the probability of recovery and the period of time to realise the collateral in the event of liquidation. The Group also seeks to diversify its collateral holdings across asset classes and markets.

Where guarantees, credit insurance, standby letters of credit or credit derivatives are used as Credit Risk mitigation, the creditworthiness of the protection provider is assessed and monitored using the same credit process applied to the obligor.

Monitoring

The Group regularly monitors credit exposures, portfolio performance, external trends and emerging risks that may impact risk management outcomes. Internal risk management reports that are presented to risk committees contain information on key political and economic trends across major portfolios and countries, portfolio delinquency and loan impairment performance.

In CIB, clients and portfolios are subject to additional review when they display signs of actual or potential weakness; for example, where there is a decline in the client's position within their industry, financial deterioration, a breach of covenants, or non-performance of an obligation within the stipulated period. Such accounts are subject to a dedicated early alert process overseen by the Credit Issues Committee in the relevant countries where client account strategies and credit grades are re-evaluated. In addition, remedial actions can be undertaken, such as exposure reduction, security enhancement or exiting the account. Credit-impaired accounts are managed by the Group's specialist recovery unit, Stressed Asset Group (SAG), which is independent of the Client Coverage/Relationship Managers. Stressed Asset Risk is the second line risk unit and is responsible for the independent challenge, monitoring and approving of the credit risk decisions including stage 3 credit impairment provision of the credit-impaired accounts.

Regular portfolio reviews across industries are conducted. Senior members from the CIB business and Risk participate in more extensive portfolio reviews (known as the 'industry portfolio review') for certain industry groups. In addition to a review of the portfolio information, this industry portfolio review incorporates industry outlook, key elements of the business strategy, RA, credit profile and emerging and horizon risks. A summary of these industry portfolio reviews is also shared with the CIB Financial Risk Committee.

For WRB, exposures and collateral monitoring are performed at the counterparty and/or portfolio level across different client segments to ensure transactions and portfolio exposures remain within RA. Portfolio delinquency trends are also monitored. Accounts that are past due (or perceived as high risk but not yet past due) are subject to collections or recovery processes managed by a specialist independent function. In some countries, aspects of collections and recovery activities are outsourced. For discretionary lending portfolios, similar processes to those of CIB are followed.

Any material in-country developments that may impact sovereign ratings are monitored closely by Country Risk within the ERM function. The Country Risk Early Warning system, a triage-based risk identification system, categorises countries based on a forward-looking view of possible downgrades and the potential incremental risk-weighted assets (RWA) impact.

In addition, an independent Credit Risk review team within the ERM function performs assessments of the Credit Risk profiles at various portfolio levels. They focus on selected countries and segments through deep dives, comparative analysis, and review and challenge of the basis of credit approvals. The review aims to ensure that the evolving Credit Risk profiles of CIB and WRB are well managed within RA and policies. Results of the reviews are reported to the GRC and BRC.

Credit rating and measurement

All credit proposals are subject to a robust credit risk assessment. It includes a comprehensive evaluation of the client's credit quality, including willingness, ability, and capacity to repay. The primary lending consideration for counterparties is based on their credit quality and operating cash flows, while for individual borrowers it is based on personal income or wealth. The risk assessment gives due consideration to the client's liquidity and leverage position.

Where applicable, the assessment includes a detailed analysis of the Credit Risk mitigation arrangements to determine the level of reliance on such arrangements as the secondary source of repayment in the event of a significant deterioration in a client's credit quality leading to default. Client income, net worth, and the liquidity of assets by class are considered for overall risk assessment for wealth lending. Wealth lending credit limits are subject to the availability of qualified collateral.

Page 07

We implement a standard alphanumeric Credit Risk grade system to differentiate the credit quality of exposures for CIB clients, whereby credit grades (CG) 1 to 12 are assigned to reflect the probability of default of performing clients (CG 1 being the best performing), and credit grades 13 and 14 are assigned to non-performing or defaulted clients.

WRB internal ratings-based portfolios use application and behavioural credit scores that are calibrated to generate a probability of default. The Risk Decision Framework uses a credit rating system to define the portfolio/new booking segmentation, shape and decision criteria for the unsecured consumer business segment.

Advanced Internal Ratings-Based (AIRB) models cover the majority of our exposures and are used in assessing risks at a customer and portfolio level, setting strategy, and optimising our risk-return decisions. The Model Risk Committee (MRC) approves material internal ratings-based risk measurement models. Prior to review and approval, all internal ratings-based models are validated by an independent model validation team. Reviews are also triggered if the performance of a model deteriorates materially against predetermined thresholds, measured through the ongoing model performance monitoring process.

We adopt the AIRB approach under the Basel regulatory framework to calculate Credit Risk capital requirements for the majority of our exposures. The Group has also established a global programme to assess capital requirements necessary to be implemented to meet the latest revised Basel III regulation (referred to as Basel 3.1 or Basel IV).

Credit Concentration Risk

Credit Concentration Risk for CIB is managed through concentration limits covering large exposure limit to a single counterparty or a group of connected counterparties (based on control and economic dependence criteria), or at portfolio level for multiple exposures that are closely correlated. Single name and Portfolio RA metrics are set, where appropriate, by credit grade, industry, products, tenor, collateralisation level, top clients, and exposure to holding companies.

For concentrations that are material at a Group level, breaches and potential breaches are monitored by the respective governance committees and reported to the GRC and BRC.

Credit impairment

For CIB, in line with the regulatory guidelines, Stage 3 expected credit loss (ECL) is considered when an obligor is more than 90 days past due on any amount payable to the Group, or the obligor has symptoms of unlikeliness to pay its credit obligations in full as they fall due. These credit-impaired accounts are managed by SAG.

In WRB, loans to individuals and small businesses are considered credit-impaired as soon as any payment of interest or principal is 90 days overdue or they meet other objective evidence of impairment, such as bankruptcy, debt restructuring, fraud, or death, with unlikely continuation of contractual payments. Financial assets are written off, in the amount that is determined to be irrecoverable, when they meet conditions set such that empirical evidence suggests the client is unlikely to meet their contractual obligations, or a loss of principal is reasonably expected.

Estimating the amount and timing of future recoveries involves significant judgement and considers the assessment of matters such as future economic conditions and the value of collateral, for which there may not be a readily accessible market. The total amount of the Group's impairment provision is inherently uncertain, being sensitive to changes in economic and credit conditions across the markets in which the Group operates.

Underwriting

The underwriting of securities and loans is in scope of the CIB RA. The Underwriting Committee approves individual proposals to underwrite new security issues and loans for our clients in compliance with the RA statement. Additional risk triggers are set based on the type of exposure and credit grade as approved by the GCRO.

Traded Risk

Mitigation

Traded Risk limits are calibrated to ensure that risk exposure is affordable under both BAU and stress conditions. The Traded Risk Policy sets the principles that must be followed for the end-to-end traded risk management process including limit setting, risk capture and measurement, limit monitoring and escalation, risk mitigation and stress testing. Policies are reviewed and approved by the Global Head, Traded Risk Management periodically to ensure their ongoing effectiveness.

Market Risk measurement

The Group uses a VaR model to measure the risk of losses arising from future potential adverse movements in market rates, prices, and volatilities.

VaR provides a consistent measure that can be applied across trading businesses and products over time and can be set against actual daily trading profit and loss outcomes.

For day-to-day risk management, VaR is calculated as at the close of business, generally at UK time, for expected market movements over one business day and to a confidence level of 97.5 per cent.

Page 08

The Group applies two VaR methodologies:

• Historical simulation: this involves the revaluation of all existing positions to reflect the effect of historically observed changes in Market Risk factors on the valuation of the current portfolio. This approach is applied for general Market Risk factors and the majority of specific (credit spread) risk factors. The enhanced Volatility Scaling VaR (VSV) model went live in January 2025, where risk factors' returns are scaled to reflect historical volatility. The VSV model is more responsive to volatility changes observed in the market.

• Monte Carlo simulation: this methodology is used in conjunction with historical simulations when historical data are not directly available. This approach is applied for the idiosyncratic credit spread risk factor or single name equity risk factor. The simulation is performed by calibrating the model to preserve volatility of risk factors.

As an input to regulatory capital, trading book VaR is calculated for expected movements over 10 business days and to a confidence level of 99 per cent. Some types of market risk are not captured in the regulatory VaR measure and these risks not in VaR are subject to capital add-ons.

Counterparty Credit Risk measurement

A Potential Future Exposure (PFE) model is used to measure the credit exposure arising from the positive mark-to-market of traded products. The PFE model provides a quantitative estimate of future potential movements in market rates, prices, and volatilities at a certain confidence level over different time horizons based on the tenor of the transactions.

The Group applies two PFE methodologies: simulation-based, used for the bulk of FX, interest rates and commodity products, and add-on-based for credit products and residual non-simulation-based products.

Monitoring

Traded Risk Management monitors the overall portfolio risk and ensures that it is within specified limits and therefore RA. Limits are typically reviewed at least once a year.

All material Traded Risks are monitored daily against approved limits. Traded Risk limits apply at all times unless separate intra-day limits have been set.

Treasury Risk

Mitigation

The Group develops policies to address material Treasury Risks and aims to maintain its risk profile within RA. In order to do this, metrics are set against Capital Risk, Liquidity and Funding Risk and IRRBB. Where appropriate, RA metrics are cascaded down to clusters and countries in the form of limits and management action triggers.

Capital Risk

In order to manage Capital Risk, strategic business financial plans and capital plans (Corporate Plan) are drawn up covering a five-year horizon and are approved by the Board annually. The plan ensures that adequate levels of capital, including loss-absorbing capacity, and an efficient mix of the different components of capital, are maintained to support our strategy and business plans. This process considers downside scenarios and the availability of recovery actions to course correct, as appropriate.

Treasury is responsible for the ongoing assessment of the demand for capital and the updating of the Group's capital plan.

RA metrics including capital, leverage, minimum requirement for own funds and eligible liability (MREL) and double leverage are assessed within the Corporate Plan to ensure that the strategy can be achieved within risk tolerances.

Structural Foreign Exchange Risk

The Group's structural FX position results from the Group's non-US dollar investment in the share capital and reserves of subsidiaries and branches. The FX translation gains or losses are recorded in the Group's translation reserves with a direct impact on the Group's Common Equity Tier 1 ratio.

The Group contracts hedges to manage its structural FX position in accordance with the RA, and as a result the Group has taken net investment hedges to partially cover its exposure to certain non-US dollar currencies to mitigate the FX impact of such positions on its CET1 ratio.

Liquidity and Funding Risk

At Group, cluster and entity level we implement various business-as-usual and stress risk metrics to monitor and manage Liquidity and Funding risk. This ensures that the Group maintains an adequate and well-diversified liquidity buffer, as well as a stable funding base, to meet its liquidity and funding regulatory requirements.

The risk management approach and RA are assessed annually through the Internal Liquidity Adequacy Assessment Process. A funding plan, which is part of the Corporate Plan process, is developed for efficient liquidity projections to ensure that the Group is adequately funded to support the business growth and meet its obligations and client funding needs.

Page 09

Interest Rate Risk in the Banking Book

This risk arises from differences in the repricing profile, interest rate basis, and optionality of banking book assets, liabilities and off-balance sheet items. IRRBB represents an economic and earnings risk to the Group and its capital adequacy. The Group monitors and manages IRRBB using multiple RA metrics.

Pension Risk

Pension Risk is the potential for loss due to having to meet an actuarially assessed shortfall in the Group's pension plans. Pension Risk arises from the Group's contractual or other liabilities with respect to its occupational pension plans or other long-term benefit obligations. For a funded plan, it represents the risk that additional contributions will need to be made because of a future funding shortfall. For unfunded obligations, it represents the risk that the cost of meeting future benefit payments is greater than currently anticipated.

The Pension Risk is monitored against the RA and reported to the GRC. The RA metric is calculated as the total capital requirement (including both Pillar 1 and Pillar 2A capital) in respect of Pension Risk, expressed as a number of basis points of RWA.

Recovery and resolution planning

In line with PRA requirements, the Group maintains a Recovery Plan, which is a live document to be used by management in the event of financial stress in order to restore the Group's financial strength to a stable and sustainable position. The Recovery Plan includes a set of recovery indicators, an escalation framework, and a set of management actions capable of being implemented during a stress. A Recovery Plan is also maintained within each major entity, and all Recovery Plans are subject to periodic fire-drill testing.

As the UK resolution authority, the BoE set a single point of entry bail-in at the ultimate holding company level (Standard Chartered PLC) as the preferred resolution strategy for the Group. In support of this strategy, the Group has a set of capabilities, arrangements, and resources in place to maintain, test and improve resolution capabilities, and continues to meet the required resolvability outcomes on an ongoing basis.

The Resolvability Self-Assessment Report was submitted by the Group to the PRA in October 2023, with an update provided in January 2024. The Group also published its latest resolvability disclosure, as required by the BoE, on 6 August 2024. The next Group Resolvability Self-Assessment Report will be submitted to the BoE/PRA in October 2026.

Monitoring

On a day-to-day basis, Treasury Risk is managed by Treasury, Finance and country CEOs. The Group regularly reports and monitors Treasury Risk inherent in its business activities and those that arise from internal and external events.

Internal risk management reports covering the balance sheet and the capital, liquidity, and IRRBB positions are presented to the relevant country Asset and Liability Committee. The reports contain key information on balance sheet trends, exposures against RA and supporting risk measures which enable members to make informed decisions around the overall management of the balance sheet. In addition, an independent Treasury CRO team within ERM reviews the prudency and effectiveness of Treasury Risk management.

Pension Risk is managed by the Head of Pensions and Reward Analytics, and monitored by the Treasury CRO on a periodic basis.

Operational and Technology Risk

Mitigation

The Operational and Technology RTF sets out the Group's overall approach to the management of Operational and Technology Risk in line with the Group's Operational and Technology RA. This is supported by the Risk and Control Self-Assessment (RCSA), which provides a systematic approach for identification and assessment of operational risks, including design and operation of mitigating controls (applicable to all risks as per the Non-Financial Risk Taxonomy).

The RCSA is used to determine the design and operating effectiveness of each process, and requires:

• the recording of end-to-end processes which deliver our key client journey and business outcomes

• the identification of risks to support the achievement of client and business outcomes

• the assessment of inherent risk on the impact to client and business outcomes, and likelihood of occurrence

• the design and monitoring of key controls to effectively and efficiently mitigate prioritised risks within acceptable levels and

• the assessment of residual risk and timely treatment of elevated risks.

Elevated Residual Risks require treatment plans to address the underlying causes and reduce the risks to within the RA.

We continue to strengthen our commitment to operational resilience through a robust risk management framework which enables the Group to anticipate, prevent, adapt, respond to, recover from, and learn from both internal and external disruptions, supported by ongoing reviews, control testing, and scenario-based assessments aimed at anticipating and reducing the potential impact of operational disruptions. The Group is required to conduct an annual self-assessment to evaluate its operational resilience. This self-assessment reviews the effectiveness of the operational resilience framework, identifies areas for improvement, and ensures compliance with regulatory expectations. These activities support the continuous oversight and improvement of our response and recovery capabilities.

Page 10

Monitoring

To deliver services to clients and to participate in the financial services sector, the Group runs processes which are exposed to Operational and Technology risks. The Group prioritises and manages risks which are significant to our clients and to the financial services sectors. The control indicators are regularly monitored to determine the Group's exposure to residual risk.

The residual risk assessments and reporting of events form the Group's Operational and Technology Risk profile. The completeness of the Operational and Technology Risk profile ensures appropriate prioritisation and timeliness of risk decisions, including risk acceptances with treatment plans for risks that exceed acceptable thresholds.

The BRC is informed on adherence to Operational and Technology RA through metrics reported for selected risks. These metrics are monitored, and escalation thresholds are devised based on the materiality and significance of the risk. These Operational and Technology RA metrics are consolidated on a regular basis and reported at the relevant Group committees, providing senior management with the relevant information to inform their risk decisions.

Information and Cyber Security (ICS) Risk

Mitigation

ICS Risk is managed through the ICS RTF, comprising a risk assessment methodology and supporting policy, standards, and methodologies. The ICS Policy and standards are aligned to industry best practice models including the National Institute of Standards and Technology Cyber Security Framework. ISO 27001, Payment Card Industry-Data Security Standard (PCI-DSS), Swift Customer Security Controls Framework (CSCF) and Legal, Regulatory and Mandatory (LRM) requirements. We undertake an annual ICS Effectiveness Review to evaluate ICS Risk management practices in alignment with the ERMF.

Monitoring

The Group Chief Information Security Officer (CISO) function monitors the evolving threat landscape covering cyber threats, attack vectors and threat actors that could target the Group. This includes performing a threat-led risk assessment to identify key threats, in-scope applications and key controls required to ensure the Group remains within RA.

The ICS Risk profiles of all businesses, functions and countries are consolidated to present a holistic Group-level ICS Risk profile for ongoing monitoring. During these reviews, the status of each risk is assessed against the Group's controls to identify any changes to impact and likelihood, which affects the overall risk rating.

ICS Board level responsibility and oversight is assured through the BRC. The Board education programme includes updates on the cyber security strategy, which is in place at a Group and Business level to adhere to internal standards and applicable laws and regulations.

ICS Risk Security Testing and External Reviews

The Group assesses its cyber posture through extensive control testing and by executing offensive security testing exercises, including independent vulnerability analysis and testing, code reviews, penetration tests and Red and Purple Team¹ attack simulation testing. This approach constantly tests the Group's defences and approach to cyber security. These show a wider picture of the Group's risk profile, leading to better visibility on potential 'in flight' risks.

We perform independent third-party verification regarding the state of our internal information technology and ICS controls through industry recognised certifications and attestations:

• PCI DSS controls are assessed annually, in line with market regulatory requirements.

• We are System and Organisation Controls 2 type 2 certified, the scope of which covers the digital products and services to financial markets, global banking, cross products, cash management, trade finance, securities services and client services group using the Straight2Bank application suite.

• We undergo assessment based on the requirements stipulated by Swift's Customer Security Programme (CSP) to ensure high compliance.

The Group also tracks remediation of security matters identified by external reviews, such as the BoE CBEST Threat Intelligence-Led Assessment and the Hong Kong Monetary Authority's (HKMA) Intelligence-led Cyber Attack Simulation Testing (iCAST).

The CISO and OTCR functions monitor the ICS Risk profile and ensure that breaches of RA are escalated to the appropriate governance committee or authority levels for remediation and tracking.

1  Red Team focuses on simulating real-world attacks to identify vulnerabilities and test the effectiveness of an organization's defences, acting as adversaries
to challenge the security measures. Purple Team enhances collaboration between the Red Team and the Blue Team (defenders) to improve threat detection,
response, and overall security posture by sharing insights and strategies from both offensive and defensive perspectives

Page 11

Financial Crime Risk

Roles and responsibilities

The Group Head, CFCR is the Group's Chief Compliance and Money-Laundering Reporting Officer and performs the Financial Conduct Authority (FCA) Senior Management Control Functions SMF 16 and SMF 17 in accordance with requirements set out by the FCA, including those set out in the Systems and Controls chapter of the FCA Handbook.

Mitigation

The CFCR function is responsible for the establishment and maintenance of policies, standards, and oversight of first line of defence controls to ensure continued compliance with financial crime laws and regulations, and the mitigation of Financial Crime Risk. This includes controls covering key financial crime risks such as money laundering, terrorist financing, sanctions compliance, bribery and corruption, and fraud. We mitigate these risks through core controls such as client due-diligence, sanctions screening and other risk-based measures, supported by ongoing efforts to build awareness and capability across our people. In this, the requirements of the Operational and Technology RTF are followed to ensure a consistent approach to the management of processes and controls.

Financial Crime Risk management is built on a risk-based approach, meaning the risk management plans, processes, activities, and resource allocations are determined according to the level of risk.

1  Red Team focuses on simulating real-world attacks to identify vulnerabilities and test the effectiveness of an organization's defences, acting as adversaries
to challenge the security measures. Purple Team enhances collaboration between the Red Team and the Blue Team (defenders) to improve threat detection,
response, and overall security posture by sharing insights and strategies from both offensive and defensive perspectives

Monitoring

The Group monitors enterprise-wide financial crime risks through the Financial Crime Risk Assessment. This is undertaken annually to assess the inherent financial crime risk exposures and the associated processes and controls by which these exposures are mitigated. As part of this, the Group monitors sanctions compliance risk, reflecting changes in global sanctions requirements and developments across an increasingly complex sanctions landscape.

The controls designed to mitigate Financial Crime Risk in business operations are governed in line with the Operational and Technology RTF. The Group has a monitoring and reporting process in place for Financial Crime Risk, which includes escalation and reporting to the CFCR and relevant Country, Business, Senior Management and Board committees.

While not a formal governance committee, the CFCR Oversight Group provides oversight of CFCR risks including the effective implementation of the Financial Crime RTF. It also provides oversight, challenge and direction to CFCR policy owners on material changes and positions taken in CFCR-owned policies, including issues relating to regulatory interpretation and the Group's Financial Crime Risk RA.

Compliance Risk

Roles and responsibilities

The Group Head, CFCR is the Group's Chief Compliance and Money-Laundering Reporting Officer and performs the FCA Senior Management Control Functions SMF 16 and SMF 17 in accordance with requirements set out by the FCA, including those set out in the Systems and Controls chapter of the FCA Handbook.

All activities that the Group engages in must comply with the relevant country/local specific and extraterritorial regulations.

Compliance Risk includes the risks associated with a failure to comply with all regulations that are applicable to the Group regardless of the issuing regulatory authority. Where Compliance Risk arises, or could arise, from failure to manage another PRT, the oversight and management processes for that specific PRT must be followed, to ensure that effective oversight and challenge of the first line of defence can be provided by the appropriate second line of defence function.

Areas of regulation can be broadly divided into two distinct categories: those issued by financial service regulatory authorities and those issued by non-financial service regulators. The Group is exposed to both categories of regulation, and roles and responsibilities differ depending on the category. For regulations issued by financial services regulatory authorities and other regulators that may issue regulations pertaining to Compliance Risk, CFCR identifies new and amended regulations as and when issued and communicates the relevant regulatory obligations to the country RFO. Where regulatory obligations do not relate to risks for which CFCR is the RFO, the respective RTF sets out second line of defence ownership.

Each of the assigned second line of defence functions have responsibilities, including monitoring relevant regulatory developments from non-financial services regulators at both Group and country levels, policy development, implementation, and validation as well as oversight and challenge of first line of defence processes and controls.

Mitigation

The CFCR function is responsible for the establishment and maintenance of policies, standards, and oversight of the first line of defence controls to ensure compliance with laws and regulations, and the mitigation of Compliance Risk. In this, the requirements of the Operational and Technology RTF are followed to ensure a consistent approach to the management of processes and controls.

Monitoring

The monitoring of controls designed to mitigate the risk of regulatory non-compliance in processes is governed in line with the Operational and Technology RTF. Compliance Risk reporting includes escalation and reporting to the CFCR and relevant Country, Business, Senior Management and BRC.

Page 12

While not a formal governance committee, the CFCR Oversight Group provides oversight of CFCR risks including the effective implementation of the Compliance RTF, and oversight, challenge and direction to CFCR policy owners on material changes and positions taken in CFCR-owned policies, including issues relating to regulatory interpretation and the Group's Compliance Risk RA. The Regulatory Change Oversight Forum provides visibility and oversight of material and/or complex large-scale regulatory change impacting non-financial risks.

Environmental, Social and Governance and Reputational (ESGR) Risk

Mitigation

The ESGR RTF provides the overall risk management approach for ESGR risks.

The ESG Risk policy outlines the Group's commitment to integrating ESG considerations into its business, operations, and decision-making process. The policy sets out the requirements for identifying, assessing, escalating and managing ESG risks for the Group's operations, clients/ transactions and third parties. The Reputational Risk policy outlines the requirements for identifying, assessing, escalating and managing negative shifts in stakeholder perception arising from client onboarding and due diligence, transactions, product design and product features, or strategic coverages such as entry into new markets or investments. Whenever potential for stakeholder concerns is identified, issues are subject to review and decision by both the first and second lines of defence. The policy also sets out the key considerations for mitigating greenwashing risk that can arise during product and/or deal lifecycle, sustainability reporting and disclosures, and external campaigns related to sustainability themes.

Monitoring

Exposure to Reputational Risks arising from transactions, clients, products and strategic coverage is monitored through established triggers to prompt the appropriate risk-based considerations and assessment by the first line of defence and escalations to the second line of defence. Risk acceptance decisions and thematic trends are also reviewed on a periodic basis.

Exposure to ESG Risks is monitored through triggers embedded within the first line of defence processes. The environmental and social risks are considered for clients and transactions via Client Environmental, Social and Governance Risk Assessments (C-ESGRA), Transaction Environmental and Social Risk Assessments (ESRA), Reputational Risk Materiality Assessments (RRMA) and/or Climate Risk Assessments (CRA).

Vendors that are identified as high risk which meet the high‑risk category and country combinations based on responses provided by the supplier at onboarding, are assessed for modern slavery risk.

Exposure to Climate Risk is monitored in conjunction with other PRTs. We have embedded qualitative and quantitative climate considerations into the Group's Credit Underwriting Principles for Oil and Gas, Mining, Shipping, Commercial Real Estate and Project Finance portfolios. Starting October 2025, we have introduced a client-level Physical Risk Grading Framework in order to identify and monitor key risk hotspots in the CIB portfolio with regard to clients' exposure to extreme weather events. This is in addition to the Transition Risk Grading already in place for CIB clients. We have also expanded coverage of Climate and Credit Risk considerations to physical collateral, as they serve as key risk mitigants, especially in default events. We use available data or proxy methodologies to assess the portfolios within WRB for transition risks particularly consumer mortgage. We assess physical risk concentrations for our WRB portfolio on a quarterly basis and assess the physical risk vulnerabilities of our sites periodically and when new sites are onboarded. We have initiated an evaluation of physical risk vulnerabilities at our primary vendors' delivery sites this year. We are also monitoring the climate risk-related vulnerabilities and readiness of our top corporate liquidity providers, including the concentration of liquidity exposures with clients with high transition and/or high physical risk.

Our Net Zero Climate Risk Working Forum meets at least quarterly to discuss account plans and risk management strategies for high climate risk and net zero divergent clients. We are also enhancing the oversight on any new materially misaligned clients through a mandatory second line review as part of the deal approval process. Stress testing and scenario analysis are used to assess the impact of ESGR-related risks. The impact on capital requirements has been included in the Group Internal Capital Adequacy Assessment Process (ICAAP). Management information is reviewed at a quarterly frequency and any breaches in RA are reported to the GRC and BRC.

Model Risk

Mitigation

The Model Risk Policy and Standards define requirements for model development, validation, implementation and use, including regular model performance monitoring and, where required, model risk mitigants.

Model deficiencies identified through the development or validation process, or model performance issues identified through ongoing monitoring, are mitigated through respective model risk mitigants. Mitigants include model overlays as either post-model adjustments (PMAs) or management adjustments, model restrictions and potentially a model recalibration or redevelopment, all of which undergo independent review, challenge, and approval. PMAs are used to address observed deficiencies caused from within the model, by adjusting the model output either directly or indirectly (e.g. adjusting parameters).

Page 13

Where a PMA is applied as a mitigant for a model used in Pillar 1 or Pillar 2 calculations or models with material impact on financial accounting disclosures (e.g. IFRS 9), the independent review must be performed by Group Model Validation (GMV) with sign-off from the Model Approver prior to implementation. Management adjustments are used to address issues by applying management decisions without adjusting a direct modelling component.

As with all PRTs, operational controls are used to govern all Model Risk-related processes, with regular risk assessments performed to assess appropriateness and effectiveness of those controls, in line with the Operational and Technology RTF, with remediation plans implemented where necessary. Group Model Risk Policy and Standards also define requirements for Deterministic Quantitative Methods (DQMs) that are used as part of an end-to-end modelled process. DQMs are similar in nature to a model, however the processing component is either purely deterministic or has an element of expert judgement. Unlike a model, there is no use of statistical, economic, financial or mathematical theories.

Monitoring

The Group monitors Model Risk via a set of RA metrics. Adherence to Model RA and any threshold breaches are reported to the BRC, GRC and MRC. These metrics and thresholds are reviewed twice per year to ensure that threshold calibration remains appropriate, and the themes adequately cover the current risks.

Models undergo regular performance monitoring based on their level of perceived Model Risk, with monitoring results presented, and breaches escalated to the Model Sponsor, Model Owner, GMV and respective MRC or Individual Delegated Model Approvers. In addition, all models are subject to periodic revalidation, with frequency and intensity of the revalidation work determined by the materiality and uncertainty of the model.

Model Risk management produces Model Risk reports covering the model landscape, which include performance metrics, identified model issues and remediation plans. These are presented for discussion at the Model Risk governance committees on a regular basis.