HSBC Holdings plc - Pillar 3 at 31 Dec 2018-Part 1

IFRS 9 Financial instruments

HSBC adopted the requirements of IFRS 9 Financial Instruments on 1 January 2018, with the exception of the provisions relating to the presentation of gains and losses on financial liabilities designated at fair value, which were adopted from 1 January 2017.

The IFRS 9 classification and measurement of financial assets and the recognition and measurement of expected credit losses ('ECL') differ from the previous approach under IAS 39 'Financial Instruments: Recognition and Measurement' and IAS 37 'Provisions, Contingent Liabilities and Contingent Assets'.

As prior periods have not been restated, comparative periods remain in accordance with the legacy accounting standards and are therefore not necessarily comparable to the IFRS 9 amounts recorded for 2018.

The adoption of IFRS 9 has not resulted in any significant change to HSBC's business model or that of our four global businesses. This includes our strategy, country presence, product offerings and target customer segments.

Existing stress testing and regulatory models, skills and expertise were adapted in order to meet IFRS 9 requirements. Data from various client, finance and risk systems have been integrated and validated. As a result of IFRS 9 adoption, management has additional insight and measures not previously utilised, which over time, may influence our risk appetite and risk management processes.

For regulatory reporting, the Group has adopted the transitional arrangements (including paragraph 4 of CRR article 473a) published by the EU on 27 December 2017 for IFRS 9 Financial Instruments. These permit banks to add back to their capital base a proportion of the impact that IFRS 9 has upon their loan loss allowances during the first five years of use. The proportion that banks may add back starts at 95% in 2018, and reduces to 25% by 2022.

The impact of IFRS 9 on loan loss allowances is defined as:

•     the increase in loan loss allowances on day one of IFRS 9 adoption; and

•     any subsequent increase in ECL in the non credit-impaired book thereafter.

The impact is calculated separately for portfolios using the STD and IRB approaches. For IRB portfolios, there is no add-back to capital unless loan loss allowances exceed regulatory 12-month expected losses. Any add-back must be tax effected and accompanied by a recalculation of capital deduction thresholds, exposure and risk-weighted assets ('RWAs').

Additional details on IFRS 9 are disclosed on page 224]of the Annual Report and Accounts 2018.

IFRS 16 Leases

From 1 January 2019, IFRS 16 Leases will replace IAS 17 Leases. IFRS 16 requires lessees to capitalise most leases within the scope of the standard, similar to how finance leases were accounted for under IAS 17. Lessees will recognise a right-of-use ('ROU') asset and a corresponding financial liability on the balance sheet. The asset will be amortised over the length of the lease, and the financial liability measured at amortised cost. Lessor accounting remains substantially the same as under IAS 17.

HSBC expects to adopt IFRS 16 using a modified retrospective approach where the cumulative effect of applying the standard is recognised in the opening balance of retained earnings.

For regulatory reporting, the ROU assets will not be deducted from regulatory capital; instead they will be risk-weighted at 100%.

For further information about the Group's implementation of IFRS 16, refer to Note 1 of the Annual Report and Accounts 2018.

Our risk management framework

We use an enterprise-wide risk management framework across the organisation and across all risk types. It is underpinned by our risk culture and is reinforced by the HSBC Values and our Global Standards programme.

The framework fosters continuous monitoring of the risk environment, and promotes risk awareness and sound operational and strategic decision making. It also ensures we have a consistent approach to monitoring, managing and mitigating the risks we accept and incur in our activities.

Further information on our risk management framework is set out on page 73 of the Annual Report and Accounts 2018. The management and mitigation of principal risks facing the Group is described in our top and emerging risks on page 69 of the Annual Report and Accounts 2018.

Commentary on hedging strategies and associated processes can be found in the Market risk and Securitisation sections of this document. Additionally, a comprehensive overview of this topic can be found in Note 1.2(h) on page 229 of the Annual Report and Accounts 2018.

Risk culture

HSBC has long recognised the importance of a strong risk culture, the fostering of which is a key responsibility of senior executives. Our risk culture is reinforced by the HSBC Values and our Global Standards programme. It is instrumental in aligning the behaviours of individuals with our attitude to assuming and managing risk, which helps to ensure that our risk profile remains in line with our risk appetite.

Our risk culture is further reinforced by our approach to remuneration. Individual awards, including those for senior executives, are based on compliance with the HSBC Values and the achievement of financial and non-financial objectives that are aligned to our risk appetite and strategy.

Further information on risk and remuneration is set out on pages 69 and 199 of the Annual Report and Accounts 2018.

Risk governance

The Board has ultimate responsibility for the effective management of risk and approves HSBC's risk appetite. It is advised on risk-related matters by the Group Risk Committee ('GRC') and  the Financial System Vulnerabilities Committee ('FSVC').

The activities of the GRC and the FSVC are set out on pages 161 to 163 of the Annual Report and Accounts 2018.

Executive accountability for the ongoing monitoring, assessment and management of the risk environment, and the effectiveness of the risk management framework resides with the Group Chief Risk Officer. He is supported by the Risk Management Meeting ('RMM') of the Group Management Board.

The management of financial crime risk resides with the Group Chief Compliance Officer. He is supported by the Financial Crime Risk Management Meeting.

Further information is available on page 85 of the Annual Report and Accounts 2018.

Day-to-day responsibility for risk management is delegated to senior managers with individual accountability for decision making. These senior managers are supported by global functions. All employees have a role to play in risk management. These roles are defined using the three lines of defence model, which takes into account the Group's business and functional structures.

Our executive risk governance structures ensure appropriate oversight and accountability for risk, which facilitates the reporting and escalation to the RMM.

Further information about the Group's three lines of defence model and executive risk governance structures is available on page 75 of the Annual Report and Accounts 2018.

Risk appetite

Risk appetite is a key component of our management of risk. It describes the type and quantum of risk that the Group is willing to accept in achieving its medium- and long-term strategic goals. In HSBC, risk appetite is managed through a global risk appetite framework and articulated in a risk appetite statement ('RAS'), which is approved biannually by the Board on the advice of the GRC.

The Group's risk appetite informs our strategic and financial planning process, defining the desired forward-looking risk profile of the Group. It is also integrated within other risk management tools, such as the top and emerging risks report and stress testing, to ensure consistency in risk management.

Information about our risk management tools is set out on page 74 of the Annual Report and Accounts 2018. Details of the Group's overarching risk appetite are set out on page 69 of the Annual Report and Accounts 2018.

Stress testing

HSBC operates a wide-ranging stress testing programme that supports our risk management and capital planning. It includes execution of stress tests mandated by our regulators. Our stress testing is supported by dedicated teams and infrastructure.

Our testing programme assesses our capital strength and enhances our resilience to external shocks. It also helps us understand and mitigate risks, and informs our decision about capital levels. As well as taking part in regulatory driven stress tests, we conduct our own internal stress tests.

The Group stress testing programme is overseen by the GRC, and results are reported, where appropriate, to the RMM and GRC.

Further information about stress testing and details of the Group's regulatory stress test results are set out on page 76 of the Annual Report and Accounts 2018.

Global Risk function

We have a dedicated Global Risk function, headed by the Group Chief Risk Officer, which is responsible for the Group's risk management framework. This includes establishing global policy, monitoring risk profiles, and forward-looking risk identification and management. Global Risk is made up of sub-functions covering all risks to our operations. It is independent from the global businesses, including sales and trading functions, helping to ensure balance in risk/return decisions. The Global Risk function operates in line with the three lines of defence model.

For further information see page 74 of the Annual Report and Accounts 2018.

Risk management and internal control systems

The Directors are responsible for maintaining and reviewing the effectiveness of risk management and internal control systems, and for determining the aggregate level and risk types they are willing to accept in achieving the Group's business objectives. On behalf of the Board, the GAC has responsibility for oversight of risk management and internal controls over financial reporting, and the GRC has responsibility for oversight of risk management and internal controls other than for financial reporting.

The Directors, through the GRC and the GAC, conduct an annual review of the effectiveness of our system of risk management and internal control. The GRC and the GAC received confirmation that executive management has taken or is taking the necessary actions to remedy any failings or weaknesses identified through the operation of our framework of controls.

HSBC's key risk management and internal control procedures are described on page 164 of the Annual Report and Accounts 2018, where the Report of the Directors on the effectiveness of internal controls can also be found.

Risk measurement and reporting systems

Our risk measurement and reporting systems are designed to help ensure that risks are comprehensively captured with all the attributes necessary to support well-founded decisions, that those attributes are accurately assessed, and that information is delivered in a timely manner for those risks to be successfully managed and mitigated.

Risk measurement and reporting systems are also subject to a governance framework designed to ensure that their build and implementation are fit for purpose and functioning appropriately. Risk information systems development is a key responsibility of the Global Risk function, while the development and operation of risk rating and management systems and processes are ultimately subject to the oversight of the Board.

We continue to invest significant resources in IT systems and processes in order to maintain and improve our risk management capabilities. A number of key initiatives and projects to enhance consistent data aggregation, reporting and management, and work towards meeting our Basel Committee data obligations are in progress. Group standards govern the procurement and operation of systems used in our subsidiaries to process risk information within business lines and risk functions.

Risk measurement and reporting structures deployed at Group level are applied throughout global businesses and major operating subsidiaries through a common operating model for integrated risk management and control. This model sets out the respective responsibilities of Group, global business, region and country level risk functions in respect of risk governance and oversight, compliance risks, approval authorities and lending guidelines, global and local scorecards, management information and reporting, and relations with third parties such as regulators, rating agencies and auditors.

Risk analytics and model governance

The Global Risk function manages a number of analytics disciplines supporting the development and management of models, including those for risk rating, scoring, economic capital and stress testing covering different risk types and business segments. The analytics functions formulate technical responses to industry developments and regulatory policy in the field of risk analytics, develops HSBC's global risk models, and oversees local model development and use around the Group toward our implementation targets for IRB approaches.

The Global Model Oversight Committee ('Global MOC') is the primary committee responsible for the oversight of Model Risk globally within HSBC. It serves an important role in providing strategic direction on the management of models and their associated risks to HSBC's businesses globally and is an essential element of the governance structure for model risk management. Global MOC is supported by Functional MOCs at the Global and Regional levels which are responsible for model risk management within their functional areas, including wholesale credit risk, market risk, retail risk, and finance.

The Global MOC meets regularly and reports to RMM. It is chaired by the Group CRO and membership includes the CEOs of the Global Businesses, and senior executives from Risk, Finance and global businesses. Through its oversight of the functional MOCs, it identifies emerging risks for all aspects of the risk rating system, ensuring that model risk is managed within our risk appetite statement, and formally advises RMM on any material model-related issues.

Models are also subject to an independent validation process and governance oversight by the Model Risk Management team within Global Risk. The team provides robust challenge to the modelling approaches used across the Group. It also ensures that the performance of those models is transparent and that their limitations are visible to key stakeholders.

The development and use of data and models to meet local requirements are the responsibility of global businesses or functions, as well as regional and/or local entities under the governance of their own management, subject to overall Group policy and oversight.