Annual Financial Report - 34 of 56

Additional information

The amount of assets pledged to secure liabilities reported in Note 18 on the Financial Statements may be greater than the book value of assets reported as being encumbered in the table on page 163. Examples of where such differences occur are:

·   ABSs and covered bonds, where the amount of liabilities issued plus the required mandatory over-collateralisation is lower than the book value of assets pledged to the pool. Any difference is categorised in the table above as 'Unencumbered - readily realisable assets';

·   negotiable securities held by custodians or settlement agents, where a floating charge has been given over the entire holding to secure intra-day settlement liabilities, are only reported as encumbered to the extent that we have a liability to the custodian or settlement agent at the reporting date, with the balance reported as 'Unencumbered - readily realisable assets'; and

·   assets pre-positioned with central banks or government agencies are only reported as encumbered to the extent that we have secured funding with the collateral. The unutilised pre‑positioned collateral is reported as 'Unencumbered - readily realisable assets'.

Securities reflected on the balance sheet that are pledged as collateral against an existing liability or lent are reflected as encumbered for the duration of the transaction. When securities are received as collateral or borrowed, and when we have the right to sell or re-pledge these securities, they are reflected as available and unencumbered for the duration of the transaction, unless re-pledged or sold. Further analysis regarding the encumbrance of securities resulting from repos and stock lending and available unencumbered assets arising from reverse repos and stock borrowing is provided under the heading 'Encumbered and unencumbered assets' on page 162.

In the normal course of business we do not seek to utilise repo financing as a source of funding to finance customer assets, beyond the collateralised security financing activities within Markets described above.

The original contractual maturity of reverse repo, stock borrowing, repo and stock lending is short term with the vast majority of transactions being for less than 90 days.

Management of cross-currency liquidity and funding risk

Our liquidity and funding risk framework also considers the ability of each entity to continue to access foreign exchange markets under stress when a surplus in one currency is used to meet a deficit in another currency, for example, by the use of the foreign currency swap markets. Where appropriate, operating entities are required to monitor stressed coverage ratios and advances to core funding ratios for non-local currencies.

HSBC Holdings

HSBC Holdings' primary sources of cash are dividends received from subsidiaries, interest on and repayment of intra-group loans and securities with interest earned on its own liquid funds. HSBC Holdings also raises ancillary funds in the debt capital markets through subordinated and senior debt issuance. Cash is primarily used for the provision of capital and TLAC funding to subsidiaries, interest payments to debt holders and dividend payments to shareholders.

HSBC Holdings is also subject to contingent liquidity risk by virtue of credit-related commitments and guarantees and similar contracts issued. Such commitments and guarantees are only issued after due consideration of HSBC Holdings' ability to finance the commitments and guarantees and the likelihood of the need arising.

Market risk

Market risk is the risk that movements in market factors, such as foreign exchange rates, interest rates, credit spreads, equity prices and commodity prices, will reduce our income or the value of our portfolios.

Market risk in global businesses

The diagram below summarises the main business areas where trading and non-trading market risks reside and the market risk measures used to monitor and limit exposures.

 

1   The interest rate risk on the fixed-rate securities issued by HSBC Holdings is not included in the Group VaR. The management of this risk is described on page 171.

Where appropriate, we apply similar risk management policies and measurement techniques to both trading and non-trading portfolios. Our objective is to manage and control market risk exposures in order to optimise return on risk while maintaining a market profile consistent with our status as one of the world's largest banking and financial services organisations.

The nature of the hedging and risk mitigation strategies performed across the Group corresponds to the market risk management instruments available within each operating jurisdiction. These strategies range from the use of traditional market instruments, such as interest rate swaps, to more sophisticated hedging strategies to address a combination of risk factors arising at portfolio level.

Market risk governance

(Audited)

Market risk is managed and controlled through limits approved by the RMM for HSBC Holdings and our various global businesses. These limits are allocated across business lines and to the Group's legal entities.

The management of market risk is principally undertaken in GB&M, where 94% of the total value at risk of HSBC (excluding insurance) and almost all trading VaR resides, using risk limits approved by the GMB. VaR limits are set for portfolios, products and risk types, with market liquidity being a primary factor in determining the level of limits set. Global Risk is responsible for setting market risk management policies and measurement techniques. Each major operating entity has an independent market risk management and control sub-function which is responsible for measuring market risk exposures in accordance with the policies defined by Global Risk, and monitoring and reporting these exposures against the prescribed limits on a daily basis. The market risk limits are governed according to the framework illustrated to the left. Each operating entity is required to assess the market risks arising on each product in its business and to transfer them to either its local GB&M unit for management, or to separate books managed under the supervision of the local ALCO. Our aim is to ensure that all market risks are consolidated within operations that have the necessary skills, tools, management and governance to manage them. In certain cases where the market risks cannot be fully transferred, we identify the effect of varying scenarios on valuations or on net interest income resulting from any residual risk positions. Further details on the control and management process for residual risks are provided on page 212.

Model risk is governed through Model Oversight Committees ('MOC's) at the regional and global Wholesale Credit and Market Risk levels. They have direct oversight and approval responsibility for all traded risk models utilised for risk measurement and management and stress testing. The MOCs prioritise the development of models, methodologies and practices used for traded risk management within the Group and ensure that they remain within our risk appetite and business plans. The Markets
MOC reports into the Group MOC, which oversees all model risk types at Group level. Group MOC informs the RMM about material issues at least on a bi-annual basis. The RMM is the Group's 'Designated Committee' according to regulatory rules and has delegated day-to-day governance of all traded risk models to the Markets MOC.

Our control of market risk in the trading and non-trading portfolios is based on a policy of restricting individual operations to trading within a list of permissible instruments authorised for each site by Global Risk, of enforcing new product approval procedures, and of restricting trading in the more complex derivative products only to offices with appropriate levels of product expertise and robust control systems.

Market risk measures

Monitoring and limiting market risk exposures

Our objective is to manage and control market risk exposures while maintaining a market profile consistent with our risk appetite.

We use a range of tools to monitor and limit market risk exposures including sensitivity analysis, value at risk and stress testing.

Sensitivity analysis

Sensitivity analysis measures the impact of individual market factor movements on specific instruments or portfolios, including interest rates, foreign exchange rates and equity prices, such as the effect of a one basis point change in yield. We use sensitivity measures to monitor the market risk positions within each risk type. Sensitivity limits are set for portfolios, products and risk types, with the depth of the market being one of the principal factors in determining the level of limits set.

Value at risk

(Audited)

Value at risk ('VaR') is a technique that estimates the potential losses on risk positions as a result of movements in market rates and prices over a specified time horizon and to a given level of confidence. The use of VaR is integrated into market risk management and is calculated for all trading positions regardless of how we capitalise those exposures. Where there is not an approved internal model, we use the appropriate local rules to capitalise exposures.

In addition, we calculate VaR for non-trading portfolios to have a complete picture of risk. Our models are predominantly based on historical simulation. VaR is calculated at a 99% confidence level for a one-day holding period. Where we do not calculate VaR explicitly, we use alternative tools as summarised in the Market Risk Stress Testing table on page 213.

Our VaR models derive plausible future scenarios from past series of recorded market rates and prices, taking into account inter-relationships between different markets and rates such as interest rates and foreign exchange rates. The models also incorporate the effect of option features on the underlying exposures.

The historical simulation models used incorporate the following features:

·   historical market rates and prices are calculated with reference to foreign exchange rates and commodity prices, interest rates, equity prices and the associated volatilities;

·   potential market movements utilised for VaR are calculated with reference to data from the past two years; and

·   VaR measures are calculated to a 99% confidence level and use a one-day holding period.

The nature of the VaR models means that an increase in observed market volatility will lead to an increase in VaR without any changes in the underlying positions. 

We are committed to the ongoing development of our in-house risk models.

VaR model limitations

Although a valuable guide to risk, VaR should always be viewed in the context of its limitations. For example:

·   the use of historical data as a proxy for estimating future events may not encompass all potential events, particularly those which are extreme in nature;

·   the use of a holding period assumes that all positions can be liquidated or the risks offset during that period. This may not fully reflect the market risk arising at times of severe illiquidity, when the holding period may be insufficient to liquidate or hedge all positions fully;

·   the use of a 99% confidence level, by definition, does not take into account losses that might occur beyond this level of confidence;

·   VaR is calculated on the basis of exposures outstanding at the close of business and therefore does not necessarily reflect intra-day exposures; and

·   VaR is unlikely to reflect loss potential on exposures that only arise under conditions of significant market movement.

Risk not in VaR framework

Our VaR model is designed to capture significant basis risks such as CDS versus bond, asset swap spreads and cross-currency basis. Other basis risks which are not completely covered in VaR, such as the Libor tenor basis, are complemented by our risk not in VaR ('RNIV') calculations, and are integrated into our capital framework.

The RNIV framework therefore aims to capture and capitalise material market risks that are not adequately covered in the VaR model. An example of this is Libor-overnight index swap basis risk for minor currencies. In such instances the RNIV framework uses stress tests to quantify the capital requirement. On average in 2015, the capital requirement derived from these stress tests represented 2.3% of the total internal model-based market risk requirement.

Risks covered by RNIV represented 19% of market risk RWAs for models with regulatory approval and included those resulting from underlying risk factors which are not observable on a daily basis across asset classes and products, such as dividend risk and implied correlation risks.

Risk factors are reviewed on a regular basis and either incorporated directly in the VaR models, where possible, or quantified through the VaR-based RNIV approach or a stress test approach within the RNIV framework. The severity of the scenarios is calibrated to be in line with the capital adequacy requirements. The outcome of the VaR-based RNIV is included in the VaR calculation and back-testing; a stressed VaR RNIV is also computed for the risk factors considered in the VaR-based RNIV approach.

Level 3 assets

The fair values of Level 3 assets and liabilities in trading portfolios are disclosed on page 382, and represent only a small proportion of the overall trading portfolio. Market risk arising from Level 3 instruments is managed by various market risk techniques such as stress testing and notional limits. The table on page 384 shows the movement in Level 3 financial instruments.

Stress testing

Stress testing is an important procedure that is integrated into our market risk management tool to evaluate the potential impact on portfolio values of more extreme, although plausible, events or movements in a set of financial variables. In such scenarios, losses can be much greater than those predicted by VaR modelling.

Stress testing is implemented at legal entity, regional and overall Group levels. A standard set of scenarios is utilised consistently across all regions within the Group. Scenarios are tailored to capture the relevant events or market movements at each level. The risk appetite around potential stress losses for the Group is set and monitored against referral limits.

 

Market risk reverse stress tests are undertaken on the premise that there is a fixed loss. The stress testing process identifies which scenarios lead to this loss. The rationale behind the reverse stress test is to understand scenarios which are beyond normal business settings that could have contagion and systemic implications.

Stressed VaR and stress testing, together with reverse stress testing and the management of gap risk, provide management with insights regarding the 'tail risk' beyond VaR for which HSBC's appetite is limited.

Trading portfolios

Volcker Rule

In 2013, US regulators finalised the Volcker Rule. Section 619 of the Dodd-Frank Wall Street Reform and Consumer Protection Act and its final implementing rules (collectively referred to as the 'Volcker Rule') imposes broad restrictions on HSBC's ability to engage in 'proprietary trading' or to own, sponsor, or have certain relationships with hedge funds, private equity funds, and certain other collective investment vehicles (broadly defined as 'covered funds'). These restrictions are subject to a number of exemptions or exclusions, including market making, underwriting and risk-mitigating hedging, organising covered funds for customers and issuers of asset-backed securities, and underwriting or market making in covered fund interests.

The Volcker Rule broadly went into effect on 22 July 2015, with the exception of certain legacy fund activities that are able to rely on an extension of the conformance date.

HSBC has implemented a programme to comply with the Volcker Rule, including policies and procedures, internal controls, corporate governance, independent testing, training, and record keeping and, eventually, calculation and reporting of quantitative metrics for certain trading activities.

HSBC has completed training for all affected front office and control personnel, has conformance plans for those covered funds to which the extension applies, and believes that it is compliant in all material respects with the Volcker Rule.

Back-testing

We routinely validate the accuracy of our VaR models by back-testing them against both actual, which replaced clean profit and loss from 1 August 2015, and hypothetical profit and loss against the corresponding VaR numbers. Hypothetical profit and loss excludes non-modelled items such as fees, commissions and revenues of intra-day transactions. 

We would expect on average to see two or three profits and two or three losses in excess of VaR at the 99% confidence level over a one-year period. The actual number of profits or losses in excess of VaR over this period can therefore be used to gauge how well the models are performing.

We back-test our Group VaR at various levels which reflect a full legal entity scope of HSBC, including entities that do not have local permission to use VaR for regulatory purposes.

Gap risk

Certain products, such as non-recourse margin loans, are not exposed to small day-to-day moves in market rates or prices, but are exposed large discontinuous moves. Such movements may occur, for example, when, in reaction to an adverse event or unexpected news announcement, some parts of the market move far beyond their normal volatility range and become temporarily illiquid. Products which exhibit exposure only to large discontinuous moves (gap risk) are not well captured by VaR measures or traditional market risk sensitivity measures.  HSBC has implemented additional stress measurement and controls over such products.

In 2015, gap risk exposure was primarily due to non-recourse loan transactions, mostly for corporate clients, where the collateral against the loan is limited to the posted assets. Upon occurrence of a gap event, the value of the collateral could fall below the outstanding loan amount.

We did not incur any notable gap loss in 2015.

De-peg risk

For certain currencies (pegged or managed) the spot exchange rate is pegged at a fixed-rate (typically to US dollars or euros), or managed within a predefined band around a pegged rate. De-peg risk is the risk of the peg or managed band changing or being abolished, and moving to a floating regime.

HSBC has extensive experience in managing fixed and managed currency regimes. Using stressed scenarios on spot rates, we are able to analyse how de-peg events would affect the positions held by HSBC. We monitor such scenarios to pegged or managed currencies, such as the Hong Kong dollar, renminbi and Middle Eastern currencies, and limit any potential losses that would occur. This historical VaR measures, which may not fully capture the risk involved in holding positions in pegged or managed currencies, as such currencies may not have experienced a de-peg event during the historical timeframe being considered.

ABS/MBS exposures

The ABS/MBS (asset and mortgage-backed securities) exposures within the trading portfolios are managed within sensitivity and VaR limits as described on page 167, and are included within the stress testing scenarios described above.

Non-trading portfolios

(Audited)

Most of the Group's non-trading VaR relates to Balance Sheet Management ('BSM') or local treasury management functions. Contributions to Group non-trading VaR are driven by interest rates and credit spread risks arising from all global businesses. There is no commodity market risk in the non-trading portfolios.

Non-trading VaR also includes the interest rate risk of non-trading financial instruments held by the global businesses and transferred into portfolios managed by BSM or local treasuries. In measuring, monitoring and managing risk in our non-trading portfolios, VaR is just one of the tools used. The management of interest rate risk in the banking book is described further in 'Non-trading interest rate risk' below, including the role of BSM.

Non-trading VaR excludes equity risk on available-for-sale securities, structural foreign exchange risk, and interest rate risk on fixed-rate securities issued by HSBC Holdings, the scope and management of which are described in the relevant sections below.

Our control of market risk in the non-trading portfolios is based on transferring the assessed market risk of non-trading assets and liabilities created outside BSM or Markets, to the books managed by BSM, provided the market risk can be neutralised. The net exposure is typically managed by BSM through the use of fixed-rate government bonds (liquid assets held in available-for-sale books) and interest rate swaps. The interest rate risk arising from fixed-rate government bonds held within available-for-sale portfolios is reflected within the Group's non-traded VaR. Interest rate swaps used by BSM are typically classified as either a fair value hedge or a cash flow hedge and are included within the Group's non-traded VaR. Any market risk that cannot be neutralised in the market is managed by local ALCOs in segregated ALCO books.

Equity securities classified as available for sale

Potential new commitments are subject to risk appraisal to ensure that industry and geographical concentrations remain within acceptable levels for the portfolio. Regular reviews are performed to substantiate the valuation of the investments within the portfolio and investments held to facilitate ongoing business, such as holdings in government-sponsored enterprises and local stock exchanges.

Structural foreign exchange exposures

Structural foreign exchange exposures represent net investments in subsidiaries, branches and associates, the functional currencies of which are currencies other than the US dollar. An entity's functional currency is that of the primary economic environment in which the entity operates.

Exchange differences on structural exposures are recognised in 'Other comprehensive income'. We use the US dollar as our presentation currency in our consolidated financial statements because the US dollar and currencies linked to it form the major currency bloc in which we transact and fund our business. Our consolidated balance sheet is, therefore, affected by exchange differences between the US dollar and all the non-US dollar functional currencies of underlying subsidiaries.

We hedge structural foreign exchange exposures only in limited circumstances. Our structural foreign exchange exposures are managed with the primary objective of ensuring, where practical, that our consolidated capital ratios and the capital ratios
of individual banking subsidiaries are largely protected from the effect of changes in exchange rates. This is usually achieved
by ensuring that, for each subsidiary bank, the ratio of structural exposures in a given currency to RWAs denominated in that currency is broadly equal to the capital ratio of the subsidiary in question.

We may also transact hedges where a currency in which we have structural exposures is considered likely to revalue adversely, and it is possible in practice to transact a hedge. Any hedging is undertaken using forward foreign exchange contracts which are accounted for under IFRSs as hedges of a net investment in a foreign operation, or by financing with borrowings in the same currencies as the functional currencies involved. We evaluate residual structural foreign exchange exposures using an expected shortfall method.

Non-trading interest rate risk

Non-trading book interest rate risk arises principally from mismatches between the future yield on assets and their funding cost, as a result of interest rate changes. Analysis of this risk is complicated by making assumptions on embedded optionality within certain product areas such as the incidence of mortgage prepayments, and from behavioural assumptions regarding the economic duration of liabilities which are contractually repayable on demand such as current accounts, and the re-pricing behaviour of managed rate products. These assumptions around behavioural features are captured in our interest rate risk behaviouralisation framework, which is described below.

We aim, through our management of market risk in non-trading portfolios, to mitigate the effect of prospective interest rate movements which could reduce future net interest income, while balancing the cost of such hedging activities on the current net revenue stream.

Our funds transfer pricing policies give rise to a two stage funds transfer pricing approach. For details see page 207.

Interest rate risk behaviouralisation

Unlike liquidity risk, which is assessed on the basis of a very severe stress scenario, non-trading interest rate risk is assessed and managed according to 'business-as-usual' conditions. In many cases the contractual profile of non-trading assets/liabilities arising from assets/liabilities created outside Markets or BSM does not reflect the behaviour observed.

Behaviouralisation is therefore used to assess the market interest rate risk of non-trading assets/liabilities and this assessed market risk is transferred to BSM, in accordance with the rules governing the transfer of interest rate risk from the global businesses to BSM.

Behaviouralisation is applied in three key areas:

·   the assessed re-pricing frequency of managed rate balances;

·   the assessed duration of non-interest bearing balances, typically capital and current accounts; and

·   the base case expected prepayment behaviour or pipeline take-up rate for fixed-rate balances with embedded optionality.

Interest rate behaviouralisation policies have to be formulated in line with the Group's behaviouralisation policies and approved at least annually by local ALCOs and regional ALCMs, in conjunction with local, regional and Group market risk monitoring teams.

The extent to which balances can be behaviouralised is driven by:

·   the amount of the current balance that can be assessed as 'stable' under business-as-usual conditions; and

·   for managed rate balances, the historical market interest rate re-pricing behaviour observed; or

·   for non-interest bearing balances, the duration for which the balance is expected to remain under business-as-usual conditions. This assessment is often driven by the re-investment tenors available to BSM to neutralise the risk through the use of fixed-rate government bonds or interest rate derivatives, and for derivatives the availability of cash flow hedging capacity.

Balance Sheet Management

Effective governance across BSM is supported by the dual reporting lines it has to the CEO of GB&M and to the Group Treasurer. In each operating entity, BSM is responsible for managing liquidity and funding under the supervision of the local ALCO (which usually meets on a monthly basis). It also manages the non-trading interest rate positions transferred to it within a Markets limit structure.

In executing the management of the liquidity risk on behalf of ALCO, and managing the non-trading interest rate positions transferred to it, BSM invests in highly-rated liquid assets in line with the Group's liquid asset policy. The majority of the liquidity is invested in central bank deposits and government, supranational and agency securities with most of the remainder held in short-term interbank and central bank loans.

Withdrawable central bank deposits are accounted for as cash balances. Interbank loans, statutory central bank reserves and loans to central banks are accounted for as loans and advances to banks. BSM's holdings of securities are accounted for as available-for-sale or, to a lesser extent, held-to-maturity assets.

Statutory central bank reserves are not recognised as liquid assets. The statutory reserves that would be released in line with the Group's stressed customer deposit outflow assumptions are reflected as stressed inflows.

BSM is permitted to use derivatives as part of its mandate to manage interest rate risk. Derivative activity is predominantly through the use of vanilla interest rate swaps which are part of cash flow hedging and fair value hedging relationships.

Credit risk in BSM is predominantly limited to short-term bank exposure created by interbank lending, exposure to central banks and high quality sovereigns, supranationals or agencies which constitute the majority of BSM's liquidity portfolio. BSM does not manage the structural credit risk of any Group entity balance sheets.

BSM is permitted to enter into single name and index credit derivatives activity, but it does so to manage credit risk on the exposure specific to its securities portfolio in limited circumstances only. The risk limits are extremely limited and closely monitored. At 31 December 2015, BSM had no open credit derivative index risk.

VaR is calculated on both trading and non-trading positions held in BSM. It is calculated by applying the same methodology used for the Markets business and utilised as a tool for market risk control purposes.

BSM holds trading portfolio instruments in only very limited circumstances. Positions and the associated VaR were not significant during 2015.

Sensitivity of net interest income

A principal part of our management of market risk in non-trading portfolios is to monitor the sensitivity of expected net interest income under varying interest rate scenarios (simulation modelling). This monitoring is undertaken at an entity level by local ALCOs.

Entities apply a combination of scenarios and assumptions relevant to their local businesses, and standard scenarios which are required throughout HSBC. The latter are consolidated to illustrate the combined pro forma effect on our consolidated net interest income.

Projected net interest income sensitivity figures represent the effect of the pro forma movements in net interest income based on the projected yield curve scenarios and the Group's current interest rate risk profile. This effect, however, does not incorporate actions which would probably be taken by BSM or in the business units to mitigate the effect of interest rate risk. In reality, BSM seeks proactively to change the interest rate risk profile to minimise losses and optimise net revenues. The net interest income sensitivity calculations assume that interest rates of all maturities move by the same amount in the 'up-shock' scenario. Rates are not assumed to become negative in the 'down-shock' scenario which may, in certain currencies, effectively result in non-parallel shock. In addition, the net interest income sensitivity calculations take account of the effect on net interest income of anticipated differences in changes between interbank interest rates and interest rates over which the entity has discretion in terms of the timing and extent of rate changes.

Defined benefit pension schemes

Market risk arises within our defined benefit pension schemes to the extent that the obligations of the schemes are not fully matched by assets with determinable cash flows. See 'Pension risk' on page 225 for additional information.

HSBC Holdings

As a financial services holding company, HSBC Holdings has limited market risk activity. Its activities predominantly involve maintaining sufficient capital resources to support the Group's diverse activities; allocating these capital resources across our businesses; earning dividend and interest income on its investments in our businesses; providing dividend payments to its equity shareholders and interest payments to providers of debt capital; and maintaining a supply of short-term capital resources for deployment under extraordinary circumstances. It does not take proprietary trading positions.

The main market risks to which HSBC Holdings is exposed are non-trading interest rate risk and foreign currency risk. Exposure to these risks arises from short-term cash balances, funding positions held, loans to subsidiaries, investments in long-term financial assets and financial liabilities including debt capital issued. The objective of HSBC Holdings' market risk management strategy is to reduce exposure to these risks and minimise volatility in capital resources, cash flows and distributable reserves. Market risk for HSBC Holdings is monitored by HSBC Holdings ALCO in accordance with its risk appetite statement.

Operational risk

The objective of our operational risk management is to manage and control operational risk in a cost effective manner within targeted levels of operational risk consistent with our risk appetite, as defined by the GMB.

Operational risk is organised as a specific risk discipline within Global Risk, and a formal governance structure provides oversight over its management. The Global Operational Risk sub-function supports the Group Chief Risk Officer and the Global Operational Risk Committee. It is responsible for establishing and maintaining the Operational Risk Management Framework ('ORMF') and monitoring the level of operational losses and the effectiveness of the control environment. It is also responsible for operational risk reporting at Group level, including the preparation of reports for consideration by the RMM and the Group Risk Committee. The Global Operational Risk Committee meets at least quarterly to discuss key risk issues and review the effective implementation of the ORMF.

The ORMF defines minimum standards and processes and the governance structure for the management of operational risk and internal control in our geographical regions, global businesses and global functions. The ORMF has been codified in a high level standards manual supplemented with detailed policies which describes our approach to identifying, assessing, monitoring and controlling operational risk and gives guidance on mitigating action to be taken when weaknesses are identified.

Business managers throughout the Group are responsible for maintaining an acceptable level of internal control commensurate with the scale and nature of operations, and for identifying and assessing risks, designing controls and monitoring the effectiveness of these controls. The ORMF helps managers to fulfil these responsibilities by defining a standard risk assessment methodology and providing a tool for the systematic reporting of operational loss data.

A centralised database is used to record the results of the operational risk management process. Operational risk and control self-assessments are input and maintained by business units. Business and functional management and business risk and control managers monitor the progress of documented action plans to address shortcomings. To ensure that operational risk losses are consistently reported and monitored at Group level, all Group companies are required to report individual losses when the net loss is expected to exceed $10,000, and to aggregate all other operational risk losses under $10,000. Losses are entered into the Group Operational Risk database and are reported to the RMM on a monthly basis.

Compliance risk

Compliance risk falls within the definition of operational risk. All Group companies are required to observe the letter and spirit of all relevant laws, codes, rules, regulations and standards of good market practice. These rules, regulations, Group policies and formal standards include those relating to AML, counter-terrorist and proliferation financing, sanctions compliance, anti-bribery and corruption, conduct of business and other regulations.

The two Compliance sub-functions: Financial Crime Compliance ('FCC') and Regulatory Compliance ('RC'), are appropriately supported by a shared Compliance Operating Office and Reputational Risk Management teams. The Global Head of Financial Crime Compliance and the Global Head of Regulatory Compliance both report to the Group Chief Risk Officer.

There are compliance teams in each of the countries where we operate and in all global businesses. These compliance teams are principally overseen by Heads of Financial Crime Compliance and Regulatory Compliance located in Europe, the US, Canada, Latin America, Asia and the Middle East and North Africa. The effectiveness of the regional and global business compliance teams are reviewed by the respective FCC and RC Assurance teams.

Global policies and procedures require the prompt identification and escalation to Financial Crime Compliance or Regulatory Compliance of all actual or suspected breaches of any law, rule, regulation, policy or other relevant requirement. Reportable events are reported to the relevant Risk Management Committees and those of Group significance are escalated to the RMM, the Group Risk Committee and the Board, as appropriate. They are disclosed in the Annual Report and Accounts and Interim Report, as appropriate.

Legal risk

Each legal department is required to have processes and procedures in place to manage legal risk that conform to Group standards.

Legal risk falls within the definition of operational risk and includes:

·   contractual risk, which is the risk of a member of HSBC suffering financial loss, legal or regulatory action or reputational damage because its rights and/or obligations under a contract to which it is a party are technically defective;

·   dispute adjudication risk, which is the risk of a member of HSBC suffering financial loss or reputational damage due to an adverse dispute environment or a failure to take appropriate steps to defend, prosecute and/or resolve actual or threatened legal claims brought against or by a Group member, including for the avoidance of doubt, regulatory matters;

·   legislative risk, which is the risk that a Group member fails to or is unable to identify, analyse, track, assess or correctly interpret applicable legislation, case law or regulation, or new regulatory, legislative or doctrinal interpretations of existing laws or regulations, or decisions in the Courts or regulatory bodies; and

·   non-contractual rights risk, which is the risk that a Group member's assets are not properly owned or protected or are infringed by others, or a Group member infringes another party's rights.

Global security and fraud risk

Security and fraud risk issues are managed at Group level by Global Security and Fraud Risk. This unit, which has responsibility for information, fraud, contingency, financial intelligence, physical and geopolitical risks is fully integrated within the central Global Risk function. This enables management to identify and mitigate the permutations of these and other non-financial risks to its business lines across the jurisdictions in which we operate.

·   The Information Security Risk sub-function is responsible for defining the strategy and policy by which the organisation protects its information assets and services from compromise, corruption or loss, whether caused deliberately or inadvertently by internal or external parties. It provides independent advice, guidance and oversight to the business about the effectiveness of information security controls and practices in place or being proposed.

·   The Fraud Risk sub-function is responsible for ensuring that effective prevention, detection and investigation measures are in place against all forms of fraudulent activity, whether initiated internally or externally, and is available to support any part of the business. To achieve that and to attain the level of integration needed to face the threat, the management of all types of fraud (e.g. card fraud, non-card fraud and internal fraud, including investigations) is established within one management structure and is part of the Global Risk function. We use technology extensively to prevent and detect fraud. For example, customers' credit and debit card spending is monitored continuously and suspicious transactions are highlighted for verification, internet banking sessions are reviewed and transactions monitored in a similar way and all new account applications are screened for fraud. We have a fraud systems strategy which is designed to provide minimum standards and allow easier sharing of best practices to detect fraud and minimise false alerts. We have developed a holistic and effective anti-fraud strategy which, in addition to the use of advanced technology, includes fraud prevention policies and practices, the implementation of strong internal controls, investigations response teams and liaison with law enforcement where appropriate.

·   The Contingency Risk sub-function is responsible for ensuring that the group's critical systems, processes and functions have the resilience to maintain continuity in the face of major disruptive events. Within this wider risk, business continuity management covers the pre-planning for recovery, seeking to minimise the adverse effects of major business disruption, either globally, regionally or within country, against a range of actual or emerging risks. The pre-planning concentrates on the protection of customer services, our staff, revenue generation, the integrity of data and documents and meeting regulatory requirements. Each business has its own recovery plan, which is developed following the completion of a business impact analysis. This determines how much time the business could sustain an outage before the level of losses becomes unacceptable, i.e. its criticality. These plans are reviewed and tested every year. The planning is undertaken against Group policy and standards and each business confirms in an annual compliance certificate that all have been met. Should there be exceptions, these are raised and their short-term resolution is overseen by Group and regional business continuity teams. It is important that plans are dynamic and meet all risks, particularly those of an emerging nature such as possible pandemics and cyber attacks. The ORMF is used to measure our resilience to these risks, and is confirmed to Group and regional risk committees. Resilience is managed through various risk mitigation measures. These include agreeing with IT acceptable recovery times of systems, ensuring our critical buildings have the correct infrastructure to enable ongoing operations, requiring critical vendors to have their own recovery plans and arranging with Group Insurance appropriate cover for business interruption costs.

·   The Financial Intelligence Unit is jointly administered by Security and Fraud Risk and Financial Crime Compliance. It uses advanced analytics and subject matter expertise to detect indicators of financial crime in the Group's clients and counter-parties.

·   The Physical Security sub-function develops practical physical, electronic and operational counter-measures to ensure that the people, property and assets managed by the Group are protected from crime, theft, attack and groups hostile to HSBC's interests.

Systems risk

Systems risk is the risk of failure or malfunction in the automated platforms that support the Group's daily execution (application systems) and the systems infrastructure on which they reside (data centres, networks and distributed computers).

The management of systems risk is overseen globally by the HSBC Operations, Services and Technology ('HOST') organisation. Oversight is provided through monthly risk management committee meetings that provide a comprehensive overview of existing and emerging top risks.

HOST manages the control environment over systems risks using risk and control assessments and scenario analysis. Material risks are monitored through the periodic testing of associated key controls.

Business-critical services have been identified. Quantitative scorecards called risk appetite statements are used for monitoring performance, and have been established for each of these services.

Vendor risk management