Cap & Risk Mgmt Pillar 3 Disclosures 31 Dec 15 Pt2

Credit risk

Overview and responsibilities

Credit risk represents our largest regulatory capital requirement.

The credit risk functions within Wholesale Credit and Market Risk and RBWM are the constituent parts of Global Risk that support the Group Chief Risk Officer in overseeing credit risks at the highest level. For this, their major duties comprise undertaking independent reviews of large and high-risk credit proposals, overseeing large exposure policy and reporting on our wholesale and retail credit risk management disciplines, owning our credit policy and credit systems programmes, overseeing portfolio management and reporting on risk matters to senior executive management and to regulators.

These credit risk functions work closely with other parts of Global Risk, for example with Security and Fraud Risk on the enhancement of protection against retail product fraud, with Operational Risk on the internal control framework and with Risk Strategy on the risk appetite process. In addition, they work jointly with Risk Strategy and Global Finance on stress testing.

The credit responsibilities of Global Risk are described on page 195 of the Annual Report and Accounts 2015.

Group-wide, the credit risk functions comprise a network of credit risk management offices reporting within regional, integrated risk functions. They fulfil an essential role as independent risk control units distinct from business line management in providing objective scrutiny of risk rating assessments, credit proposals for approval and other risk matters.

Credit risk operates through a hierarchy of personal credit limit approval authorities, not committee structures. Operating company chief executives, acting under authorities delegated by their boards and Group standards, are accountable for credit risk and other risks in their business. In turn, chief executives delegate authority to operating company chief risk officers and management teams on an individual basis. Each operating company is responsible for the quality and performance of its credit portfolios, and for monitoring and controlling all credit risks in those portfolios in accordance with Group standards. Above these thresholds of delegated personal credit limited approval authorities, approval or concurrence must be sought from the regional and, as appropriate, global credit risk function before facilities are advised to the customer.

Moreover, risk proposals in certain portfolios - sovereign obligors, banks, some non-bank financial institutions and intra-Group exposures - are approved centrally in Global Risk to facilitate efficient control and the reporting of regulatory large and cross-border exposures.

Credit risk management

Our exposure to credit risk arises from a wide range of customer and product types, and the risk rating systems in place to measure and monitor these risks are correspondingly diverse. Each major subsidiary typically has some exposures across this range, and requirements may differ according to the jurisdictions in which it operates.

Credit risk exposures are generally measured and managed in portfolios of either customer types or product categories. Risk rating systems are designed to assess the default propensity of, and loss severity associated with, distinct customers who are typically managed as individual relationships or, in the case of retail business exposures, on a product portfolio basis.

Risk rating systems for retail exposures are generally quantitative in nature, applying techniques such as behavioural analysis across product portfolios comprising large numbers of homogeneous transactions. Rating systems for individually managed relationships typically use customer financial statements and market data analysis, but also qualitative elements and a final subjective overlay to better reflect any idiosyncratic elements of the customer's risk profile. See 'Application of the IRB Approach' on page 46.

Whatever the nature of the exposure, a fundamental principle of our policy and approach is that analytical risk rating systems and scorecards are all valuable tools at the disposal of management, informing judgemental decisions for which individual approvers are ultimately accountable.

In the case of automated decision-making processes, as used in retail credit origination where risk decisions may be taken 'at the point of sale' with no management intervention, that accountability rests with those responsible for the parameters built into those processes/systems and the governance and controls surrounding their use.

The credit process provides for at least an annual review of facility limits granted. Review may be more frequent, as required by circumstances such as the emergence of adverse risk factors, and any consequent amendments to risk ratings must be promptly implemented.

We constantly seek to improve the quality of our risk management. For central management and reporting purposes, Group IT systems are deployed to process credit risk data. A central database is used which covers substantially all of our direct lending exposures and holds the output of risk rating systems Group-wide. This continues to be enhanced in order to deliver both comprehensive management information in support of business strategy and solutions to evolving regulatory reporting requirements. The latter continue to present major challenges in view of the number and scope of concurrent initiatives, requiring more frequent and faster provision of regulatory, risk and financial data at an increasingly granular level. Given the global nature of our business we typically need to generate this granular information both at local and Group level, but often in materially different ways. The new stress testing and G‑SIB reporting requirements are prime examples of significant data requirements and related processes that are in the process of being embedded into existing or enhanced systems architecture at various levels in the Group.

Group standards govern the process through which risk rating systems are initially developed, judged fit for purpose, approved and implemented. They also govern the conditions under which analytical risk model outcomes can be over-ridden by decision-takers and the process of model performance monitoring and reporting. The emphasis is on an effective dialogue between business line and risk management, suitable independence of decision-takers, and a good understanding and robust challenge on the part of senior management.

Like other facets of risk management, analytical risk rating systems are not static and are subject to review and modification in light of the changing environment, the greater availability and quality of data and any deficiencies identified through internal and external regulatory review. Structured processes and metrics are in place to capture relevant data and feed this into continuous model improvement. See also the comments on 'Model performance' on page 66.

Credit risk models governance

All new or materially changed IRB capital models require the PRA's approval, as set out in more detail on page 46, and throughout HSBC such models fall directly under the remit of the global functional MOCs. Additionally, the global functional MOCs are responsible for the approval of stress testing models used for regulatory stress testing exercises such as those carried out by the EBA and the Bank of England.

The global functional MOCs are responsible for defining the thresholds above which models require their approval, supporting both internal governance and the PRA approval process, for example if they cover exposures generating credit risk capital requirements exceeding a prescribed threshold or are otherwise deemed material on grounds of risk, portfolio size, or business type.

Wholesale MOC requires all credit risk models for which it is responsible to be approved by delegated senior managers with notification to the committee which retains the responsibility for oversight. RBWM MOC applies different thresholds for approval at the committee depending on model type. For models falling below these thresholds final approval is delegated to regional committees or Regional Heads of RBWM Risk. Where approval has been delegated the RBWM MOC is kept notified of any material model decisions and issues.

Global Risk utilises HSBC standards for the development, validation, independent review, approval, implementation and performance monitoring of credit risk rating models, and oversight of respective local standards for local models. All models are reviewed as frequently as the need arises, but at least annually.

Compliance with Group standards is subject to examination both by Risk oversight and review from within the Risk function itself, and by Internal Audit. While the standards set out minimum general requirements, Global Risk has discretion to approve dispensations on an exceptional basis, and fosters best practice between offices.

The following tables set out credit risk exposure values, RWAs and regulatory capital requirements calculated at 8% of RWAs. Table 22 presents exposure values analysed across geographical regions and tables 23 and 24, respectively, RWAs and RWA density by geographical region. Exposure values are allocated to a region based on the country of incorporation of the HSBC subsidiary or associate where the exposure was originated. In table 25, allocation to industry sectors is based on the Standard Industrial Classification codes. Table 26 shows exposures by period outstanding from the reporting date to the maturity date. The full exposure value is allocated to a residual maturity band based on the contractual end date.

In these tables, and in others in the Credit Risk section of this document unless stated otherwise, the data is presented according to a 'guarantor view', i.e. assigning exposures to the exposure class of the protection provider where applicable. This is to align our disclosure with our supervisory reporting.