Certain defined terms

These Capital and Risk Management Pillar 3 Disclosures as at 31 December 2009 (‘Pillar 3 Disclosures 2009’) contain certain forward-looking statements with respect to the financial condition, results of operations and business of HSBC. Statements that are not historical facts, including statements about HSBC’s beliefs and expectations, are forward-looking statements. Words such as ‘expects’, ‘anticipates’, ‘intends’, ‘plans’, ‘believes’, ‘seeks’, ‘estimates’, ‘potential’ and ‘reasonably possible’, variations of these words and similar expressions are intended to identify forward-looking statements. These statements are based on current plans, estimates and projections, and therefore undue reliance should not be placed on them. Forward-looking statements speak only as of the date they are made, and it should not be assumed that they have been revised or updated in the light of new

information or future events. Written and/or oral forward-looking statements may also be made in the periodic reports to the United States Securities and Exchange Commission, summary financial statements to shareholders, proxy statements, offering circulars and prospectuses, press releases and other written materials, and in oral statements made by HSBC’s Directors, officers or employees to third parties, including financial analysts.

     Forward-looking statements involve inherent risks and uncertainties. Readers are cautioned that a number of factors could cause actual results to differ, in some instances materially, from those anticipated or implied in any forward-looking statement. These factors include changes in general economic conditions in the markets in which HSBC operates, changes in government policy and regulation and factors specific to HSBC. A more detailed cautionary statement is provided on pages 6 to 7 of the Annual Report and Accounts 2009.

HSBC is one of the largest banking and financial services organisations in the world, with a market capitalisation of US$199 billion at 31 December 2009.

     Through its subsidiaries and associates, HSBC provides a comprehensive range of banking and related financial services. Headquartered in London, HSBC operates through long-established businesses and has an international network of some 8,000 properties in 88 countries and territories in six geographical regions: Europe; Hong Kong; Rest of Asia-Pacific; the Middle East; North America and Latin America. Previously, the Middle East was reported as part of Rest of Asia-Pacific. Within these regions, a comprehensive range of financial services is offered to personal, commercial, corporate, institutional, investment and private banking clients. Services are delivered primarily by domestic banks, typically with large retail deposit bases, and by consumer finance operations.

     Details of the Group’s principal activities and its strategic direction can be found on page 12 of the Annual Report and Accounts 2009.

The United Kingdom (‘UK’) Financial Services Authority (‘FSA’) supervises HSBC on a consolidated basis, and therefore receives information on the capital adequacy of, and sets capital requirements for, HSBC as a whole. Individual banking subsidiaries are directly regulated by their local banking supervisors, who set and monitor their capital adequacy requirements.

     HSBC calculates capital at a Group level using the Basel II framework of the Basel Committee on Banking Supervision (‘Basel Committee’); local regulators are at different stages of implementation and local rules may still be on a Basel I basis, notably in the United States (‘US’). In most jurisdictions, non-banking financial subsidiaries are also subject to the supervision and capital requirements of local regulatory authorities.

     Basel II is structured around three ‘pillars’: minimum capital requirements; supervisory review process; and market discipline. The Capital Requirements Directive (‘CRD’) implemented Basel II in the European Union (‘EU’) and the FSA then gave effect to the CRD by including the requirements of the CRD in its own rulebooks.

Pillar 3 complements the minimum capital requirements and the supervisory review process. Its aim is to encourage market discipline by developing a set of disclosure requirements which allow market participants to assess certain specified information on the scope of application of Basel II, capital, particular risk exposures and risk assessment processes, and hence the capital adequacy of the institution. Disclosures consist of both quantitative and qualitative information and are provided at the consolidated level.

     Banks are required to disclose all their material risks as part of the pillar 3 framework. All material and non-proprietary information required by pillar 3 is included in the Pillar 3 Disclosures 2009. The FSA permits certain pillar 3 requirements to be satisfied by inclusion within the financial statements. Where this is the case, page references are provided to the relevant sections in the Annual Report and Accounts 2009.

The regulation and supervision of financial institutions is currently undergoing a period of significant change in response to the global financial crisis. An overview of the risks associated with regulatory reform is presented on page 16 of the Annual Report and Accounts 2009.

     Increased capital requirements and pillar 3 disclosures for market risk and securitisations have already been announced by the Basel Committee and are due for implementation in the EU in 2011. The Basel Committee issued further proposals in a Consultative Document ‘Strengthening the resilience of the banking sector’ on 17 December 2009. The Committee’s proposals are part of global initiatives to strengthen the financial regulatory system, and have been endorsed by the Financial Stability Board and the G20 leaders. A comprehensive impact assessment will be carried out on the proposals in the first half of 2010, with the aim of developing a fully calibrated set of standards by the end of 2010. The proposals will be phased in as financial conditions improve and the economic recovery is assured, with the aim of implementation by the end of 2012. Within this context, the Basel Committee will also consider appropriate transition and grandfathering arrangements. The consultation period for these proposals closes on 16 April 2010.

In accordance with FSA requirements, the Group intends to publish comprehensive pillar 3 disclosures

annually. Capital structure, capital requirements and capital ratios will next be disclosed at the half year in the Interim Report 2010.

The Pillar 3 Disclosures 2009 have been prepared in accordance with regulatory capital adequacy concepts and rules, rather than in accordance with International Financial Reporting Standards (‘IFRSs’). Therefore, some information in the Pillar 3 Disclosures 2009 is not directly comparable with the financial information in the Annual Report and Accounts 2009. This is most pronounced for the credit risk disclosures, where credit exposure is defined as the maximum loss the Group has estimated under specified Basel II parameters. This differs from similar information in the Annual Report and Accounts 2009, which is mainly reported as at the balance sheet date and, therefore, does not reflect the likelihood of future drawings of committed credit lines.

The Pillar 3 Disclosures 2009 have been appropriately verified internally but have not been audited by the Group’s external auditor.

Links to the financial information of significant subsidiaries, including capital resources and requirements, are available on HSBC’s investor relations website page www.hsbc.com/investor-relations/financial-results/hsbc-group-companies.

The basis of consolidation for financial accounting purposes is described on page 367 of the Annual Report and Accounts 2009 and differs from that used for regulatory purposes. Investments in banking associates, which are equity accounted in the financial accounting consolidation, are proportionally consolidated for regulatory purposes. Subsidiaries and associates engaged in insurance and non-financial activities are excluded from the regulatory consolidation and are deducted from regulatory capital. The regulatory consolidation does not include Special Purpose Entities (‘SPE’s) where significant risk has been transferred to third parties. Exposures to these SPEs are treated as securitisation positions for regulatory purposes and are either risk-weighted or deducted from capital.

Basel II provides three approaches of increasing sophistication to the calculation of pillar 1 credit risk capital requirements. The most basic, the standardised approach, requires banks to use external credit ratings to determine the risk weightings applied to rated counterparties and group other counterparties into broad categories and apply standardised risk weightings to these categories. The next level, the internal ratings-based (‘IRB’) foundation approach, allows banks to calculate their credit risk capital requirements on the basis of their internal assessment of the probability that a counterparty will default (‘PD’), but subjects their quantified estimates of exposure at default (‘EAD’) and loss given default (‘LGD’) to standard supervisory parameters. Finally, the IRB advanced approach allows banks to use their own internal assessment in both determining PD and quantifying EAD and LGD.

     The capital resources requirement, which is intended to cover unexpected losses, is derived from a formula specified in the regulatory rules, which incorporates these factors and other variables such as maturity and correlation. Expected losses under the IRB approaches are calculated by multiplying PD by EAD and LGD. Expected losses are deducted from capital to the extent that they exceed accounting impairment allowances.

     For credit risk, with the FSA’s approval, HSBC has adopted the IRB advanced approach for the majority of its business, with the remainder on either IRB foundation or standardised approaches.

     For consolidated group reporting, the FSA’s rules permit the use of other regulators’ standardised approaches where they are considered equivalent. The use of other regulators’ IRB approaches is subject to the agreement of the FSA. Under the Group’s Basel II rollout plans, a number of Group companies are in transition to advanced IRB approaches. At December 2009, corporate portfolios in France, Hong Kong and Rest of Asia-Pacific completed the transition from foundation to advanced IRB approaches. Other Group companies and portfolios remain on the standardised or foundation approaches under Basel II, pending definition of local regulations or model approval, or under exemptions from IRB treatment.

Counterparty credit risk in both the trading and non-trading books is the risk that the counterparty to a transaction may default before completing the satisfactory settlement of the transaction. Three approaches to

calculating counterparty credit risk and determining exposure values are defined by Basel II: standardised, mark-to-market and internal model method (‘IMM’). These exposure values are used to determine capital requirements under one of the credit risk approaches; standardised, IRB foundation and IRB advanced.

     HSBC uses the mark-to-market and IMM approaches for counterparty credit risk. Its longer-term aim is to migrate more positions from the mark-to-market to the IMM approach.

Market risk is the risk that movements in market risk factors, including foreign exchange, commodity prices, interest rates, credit spread and equity prices will reduce HSBC’s income or the value of its portfolios. Market risk is measured, with FSA permission, using Value at Risk (‘VAR’) models or the standard rules prescribed by the FSA.

     HSBC uses both VAR and standard rules approaches for market risk. Its longer-term aim is to migrate more positions from standard rules to VAR.

Basel II includes capital requirements for operational risk, again utilising three levels of sophistication. The capital required under the basic indicator approach is a simple percentage of gross revenues, whereas under the standardised approach it is one of three different percentages of gross revenues allocated to each of eight defined business lines. Both these approaches use an average of the last three financial years’ revenues. Finally, the advanced measurement approach uses banks’ own statistical analysis and modelling of operational risk data to determine capital requirements.

     HSBC has adopted the standardised approach in determining its Group operational risk capital requirements.

HSBC’s capital management approach is driven by its strategic and organisational requirements, taking into account the regulatory, economic and commercial environment in which it operates.

     It is HSBC’s objective to maintain a strong capital base to support the development of its business and to meet regulatory capital requirements at all times. To achieve this, the Group’s policy is to hold capital in a range of different forms and from diverse sources and all capital raising is agreed with major subsidiaries as part of their individual and the Group’s capital management processes.

     The Group’s policy is underpinned by the Capital Management Framework, which enables HSBC to manage its capital in a consistent and aligned manner. The framework, which is approved by the Group Management Board (‘GMB’), incorporates a number of different capital measures

including market capitalisation, invested capital, economic capital and regulatory capital.

     The responsibility for global capital allocation principles and decisions rests with GMB. Through its structured internal governance processes, HSBC maintains discipline over its investment and capital allocation decisions, seeking to ensure that returns on investment are adequate after taking account of capital costs. HSBC’s strategy is to allocate capital to businesses on the basis of their economic profit generation, regulatory and economic capital requirements and cost of capital.

HSBC Holdings is the primary provider of equity capital to its subsidiaries. Each subsidiary manages its own capital to support its planned business growth and meet its local regulatory requirements within the context of the approved annual Group capital plan. In accordance with HSBC’s Capital Management Framework, capital generated by

subsidiaries in excess of planned requirements is returned to HSBC Holdings, normally by way of dividends. During 2009 and 2008, none of the Group’s subsidiaries experienced significant restrictions on paying dividends or repaying inter-company loans and advances.

HSBC assesses the adequacy of its capital by considering the resources necessary to cover unexpected losses arising from discretionary risks, being those which it accepts such as credit risk and market risk, or non-discretionary risks, being those which arise by virtue of its operations, such as operational risk and reputational risk. The HSBC Capital Management Principles, which are approved by GMB, together with related policies define the Internal Capital Adequacy Assessment Process (‘ICAAP’) by which GMB examines the Group’s risk profile from both regulatory and economic capital viewpoints and ensures that the Group’s level of capital:

•

remains sufficient to support the Group’s risk profile and outstanding commitments;

•

exceeds the Group’s formal minimum regulatory capital requirements by an agreed margin;

•

is capable of withstanding a severe economic downturn stress scenario; and

•

remains consistent with the Group’s strategic and operational goals, and shareholder and rating agency expectations.

     The regulatory and economic capital assessments rely upon the use of models that are integrated into the Group’s management of risk. Economic capital is the internally calculated capital requirement which is deemed necessary by HSBC to support the risks to which it is exposed, and is set at a confidence level consistent with a target credit rating of AA. The minimum regulatory capital that HSBC is required to hold is determined by the rules established by the FSA for the consolidated Group and by HSBC’s local regulators for individual Group companies. The economic capital assessment is the more risk-sensitive measure as it covers a wider range of risks and takes account of the substantial diversification of risk accruing from the Group’s operations. HSBC’s economic capital models are calibrated to quantify the level of capital that is sufficient to absorb potential losses over a one-year time horizon to a 99.95 per cent level of confidence for its banking activities and to a 99.5 per cent level of confidence for its insurance activities and pension risks. HSBC’s approach to capital management is

aligned to the Group’s corporate structure, business model and strategic direction. The Group’s discipline around capital allocation is maintained within established processes and benchmarks, in particular the approved annual Group capital plan, of which further details can be found on page 286 of the Annual Report and Accounts 2009.

     Economic capital is the metric by which risk is measured and linked to capital within the Group’s risk appetite framework. The framework, which expresses the types and quantum of risks to which HSBC wishes to be exposed, is approved annually by the Board of Directors of HSBC Holdings (‘the Board’), and its implementation is overseen by GMB. Further details on the risk appetite framework may be found on page 14.

     HSBC’s risk management framework fosters the continuous monitoring of the risk environment and an integrated evaluation of risks and their interactions. Certain of these risks are assessed and managed via the capital planning process. Risks assessed via capital and those that are not are compared below:

Credit (including counterparty credit), market and operational risk

HSBC assesses economic capital requirements for these risk types by utilising the embedded operational infrastructure used for the pillar 1 capital calculation, together with an additional suite of models that take into account, in particular:

•

the increased level of confidence required to meet HSBC’s strategic goals (99.95 per cent); and

•

internal assessments of diversification of risks within the Group’s portfolios and, similarly, any concentrations of risk that arise.

     The Group’s economic capital assessment operates alongside the Group’s regulatory capital process and consistently demonstrates a substantially lower overall capital requirement for credit risk than the regulatory equivalent, reflecting the empirical evidence of the benefits of global diversification. However, the Group maintains a prudent stance on capital coverage, ensuring that any model risk is mitigated. Economic capital requirements are used to monitor the Group’s risks against its risk appetite.

Interest rate risk in the banking book

Interest rate risk in the banking book (‘IRRBB’) is defined as the exposure of the non-trading products

of the Group to interest rates. Non-trading portfolios include positions that arise from the interest rate management of HSBC’s retail and commercial banking assets and liabilities, and financial investments designated as available for sale and held to maturity. IRRBB arises principally from mismatches between the future yields on assets and their funding costs, as a result of interest rate changes. Analysis of this risk is complicated by having to make assumptions on embedded optionality within certain product areas such as the incidence of mortgage prepayments, and from behavioural assumptions regarding the economic duration of liabilities which are contractually repayable on demand such as current accounts. IRRBB economic capital is measured as the amount of capital necessary to cover an unexpected loss in the value of the Group’s non-trading products over one year to a 99.95 per cent level of confidence.

HSBC operates a bancassurance model which provides insurance products for customers with whom the Group has a banking relationship. Many of these insurance products are manufactured by HSBC subsidiaries but, where the Group considers it operationally more effective, third parties are engaged to manufacture and provide insurance products which HSBC sells through its banking network. The Group works with a limited number of market-leading partners to provide these products. When manufacturing products, the Group underwrites the insurance risk and retains the risks and rewards associated with writing insurance contracts.

     Significant progress has been made in the finalisation of a risk-based capital methodology for the Group’s insurance businesses. While this is being implemented across HSBC, a Net Asset Value capital deduction methodology is being employed for Group economic capital assessment purposes.

HSBC operates a number of pension plans throughout the world. Some of these pension plans are defined benefit plans, of which the largest is the HSBC Bank (UK) Pension Scheme. The benefits payable under the defined benefit plans are typically a function of salary and length of service. In order to fund the benefits, sponsoring Group companies (and in some instances, employees) make regular contributions in accordance with advice from actuaries and in consultation with the scheme’s trustees (where relevant). The defined benefit plans

invest these contributions in a range of investments designed to meet their long-term liabilities.

     Pension risk arises from the potential for a deficit in a defined benefit plan to arise from a number of factors, which could include:

•

investments delivering a return below that required to provide the projected plan benefits. This could arise, for example, when there is a fall in the market value of equities, or when increases in long-term interest rates cause a fall in the value of fixed income securities held;

•

the prevailing economic environment leading to corporate failures, thus triggering write-downs in asset values (both equity and debt);

•

a change in either interest rates or inflation which causes an increase in the value of the scheme liabilities; and

•

scheme members living longer than expected (known as longevity risk).

     Pension risk is assessed by way of an economic capital model that takes into account potential variations in these factors, using a VAR model.

Residual risk is, primarily, the risk that mitigation techniques prove less effective than expected. This category also includes risks that arise from specific reputational or business events that give rise to exposures not deemed to be included in the major risk categories. HSBC conducts economic capital assessments of such risks on a regular, forward-looking basis to ensure that their impact is adequately covered by the Group’s capital base.

Liquidity and funding risk management is described in detail on page 244 of the Annual Report and Accounts 2009.

     The Group uses cash-flow stress testing as part of its control processes to assess liquidity risk. HSBC does not manage liquidity through the explicit allocation of capital as, in common with standard industry practice, this is not considered to be an appropriate or adequate mechanism for managing these risks. However, HSBC recognises that a strong capital base can help to mitigate liquidity risk both by providing a capital buffer to allow an entity to raise funds and deploy them in liquid positions and by serving to reduce the credit risk taken by providers of funds to the Group.

Structural foreign exchange risks arise from the Group’s net investments in subsidiaries, branches and associates, the functional currencies of which are other than the US dollar. Unrealised gains or losses due to revaluations of structural foreign exchange exposures are reflected in reserves, whereas other unrealised gains or losses arising from revaluations of foreign exchange positions are reflected in the income statement.

     HSBC’s structural foreign exchange exposures are managed with the primary objective of ensuring, where practical, that HSBC’s consolidated capital ratios and the capital ratios of the individual banking subsidiaries are largely protected from the effect of changes in exchange rates. This is usually achieved by ensuring that, for each subsidiary bank, the ratio of structural exposures in a given currency to risk-weighted assets (‘RWA’s) denominated in that currency is broadly equal to the capital ratio of the subsidiary in question. The Group evaluates residual structural foreign exchange exposures using a VAR model, but typically does not assign any economic capital for these since they are managed within appropriate economic capital buffers.

     Details of the Group’s management of structural foreign exchange risk can be found on page 257 of the Annual Report and Accounts 2009.

Reputational risk

Details of the Group’s management of reputational risk can be found on page 263 of the Annual Report and Accounts 2009.

     As a banking group, HSBC’s reputation depends upon the way in which it conducts its business, but it can also be affected by the way in which clients to whom it provides financial services conduct themselves. A Group Reputational Risk Committee was established in 2008, at which Group functions with responsibility for activities that attract reputational risk are represented.

Sustainability (environmental and social) risks arise from the provision of financial services to companies or projects which run counter to the needs of sustainable development. Details of the Group’s management of sustainability risk can be found on page 264 of the Annual Report and Accounts 2009.

The FSA specifies that banks, as part of their internal assessment of capital adequacy process, should review their exposure to business risk.

     Business risk is the potential negative impact on profits and capital from the Group not meeting its strategic objectives, as set out in the rolling operating plan, as a result of unforeseen changes in the business and regulatory environment, exposure to economic cycles and technological changes. HSBC does not explicitly set aside capital against business risk, as a distinct category, as it believes that this risk is effectively covered by the capital set aside for other major risks such as credit risk, market risk and operational risk.

Scenario analysis and stress testing are important mechanisms in understanding the sensitivities of the Group capital and business plans to the adverse effects of extreme, but plausible, events. As well as considering the potential financial effect on plans, a key output of this tool is the consideration and establishment of management action plans for mitigating such events should they, or similar events, arise.

     HSBC’s scenario analysis and stress testing framework and processes are overseen by the Group Stress Testing Oversight Forum (‘GSTOF’). GSTOF meets regularly to monitor and review scenario analysis and stress testing reports. Membership comprises representatives of Group and regional risk and capital management functions.

     Regulatory capital supply is regularly assessed against demand under a range of stress scenarios, including projected global and local economic downturns. Qualitative and quantitative techniques are used to estimate the potential impact on HSBC’s capital position under such scenarios. HSBC also participates, where appropriate, in standard scenario analyses requested by regulatory bodies.

     In addition to macro-economic analysis, a suite of event-driven scenarios, including operational, market and credit events, are regularly formulated and analysed in detail, ensuring that management has considered the potential impact, and what actions would be necessary, should a range of risks materialise.

     In particular, this framework has aided management in mitigating some of the effects of the global financial crisis. While the prediction of future events cannot cover all eventualities, nor precisely

identify future events, a number of the scenarios analysed in the past provided additional management insight into the actions necessary to mitigate the risks when similar events occurred.

     In addition to the suite of risk scenarios considered for the HSBC Group, each major subsidiary conducts regular macro-economic and event-driven scenario analyses specific to that region under the Group governance framework. Executive managers from across HSBC meet regularly to consider and debate the outcome of these scenarios and formulate recommended management actions. Macro-economic analyses are considered by GMB.

     As part of the Group’s risk appetite process, business and capital plans are supported by forecasts of the risk parameters that drive the Group’s capital requirements. The Group and regional macro-economic stress tests consider sensitivities of these drivers under a variety of potential economic forecasts in order to examine the possible capital positions that could arise. In any material economic downturn, proactive and structured intervention by management is both an inevitable and necessary consequence. Therefore, HSBC incorporates the effect of such management actions in determining whether or not the Group is likely to be able to withstand such an event.

All HSBC’s activities involve, to varying degrees, the measurement, evaluation, acceptance and management of the previously noted risks or combinations of those risks.

     As risk is not static, the risk profiles of HSBC and its individual entities change continually as the scope and impact of a range of factors, from transactional to geopolitical, change. The risk environment requires continual monitoring and assessment in an integrated manner in order to understand and manage the complex risk interactions across the Group. The risk management framework that HSBC has put in place is designed to meet these challenges and is described below in terms of its organisational structure, governance, risk strategies and appetite, and supporting, monitoring and reporting processes.

A well established risk governance and ownership structure ensures oversight of, and accountability for,

the effective management of risk at Group, regional, customer group and operating entity levels.

     The Board is the Group’s senior ‘governing body’ as defined by the FSA’s rules. It approves HSBC’s risk appetite framework, plans and performance targets for the Group and its principal operating subsidiaries, the appointment of senior officers, the delegation of authorities for credit and other risks and the establishment of effective control procedures.

     The Board delegates authority for the day-to-day management of the Group to GMB, the Group’s senior executive committee. Chaired by the Group Chief Executive, GMB’s members include the Chief Financial Officer, Executive Director, Risk and Regulation; the Group Chief Technology and Services Officer; the Group Chief Risk Officer (‘GCRO’) and other executives appointed by the Board. GMB exercises the powers and authorities of the Board in so far as they concern the management and day-to-day running of the Group in accordance with policies and directions determined by the Board. GMB’s performance is assessed against the achievement of HSBC’s strategy, medium-term outlook and rolling operating plans, building sustainable business and brand value around its customers, and a strong competitive performance in earnings per share growth and efficiency.

     When considering risk matters, GMB convenes as the Risk Management Meeting (‘RMM’), chaired by the Chief Financial Officer, Executive Director, Risk and Regulation. RMM is the Group’s senior ‘designated committee’ as defined by the FSA’s rules, and has responsibility for setting risk appetite and approving definitive risk policies and controls. It formulates high-level Group risk management policy, exercises delegated risk authorities and oversees the implementation of risk appetite and controls. It monitors all categories of risk, receives reports on actual performance and emerging issues, determines action to be taken and reviews the efficacy of HSBC’s risk management framework.

     The Group Audit Committee, which is formed of non-executive directors, meets regularly with HSBC’s senior financial, internal audit, risk, legal and compliance management and the external auditor to consider HSBC Holdings’ financial reporting, the nature and scope of audit reviews and the effectiveness of the systems of internal control, compliance and risk management. The Committee has discussed the risk management recommendations of the Walker Review. Following the Committee’s recommendation of appropriate terms of reference, a separate Group Risk

Committee was established by the Board on 26 February 2010.

     The terms of reference of HSBC Holdings’ committees serve as models for those of Group companies. Further details on principal governing bodies are provided on pages 310 to 313 of the Annual Report and Accounts 2009.

Primary responsibility for managing risk at operating entity level lies with the respective boards and Chief Executive Officers (‘CEO’s), as custodians of their balance sheets and, at the most senior level, members of GMB. In their oversight and stewardship of risk management at Group level, however, GMB and RMM are supported by a dedicated Global Risk function, headed by the GCRO, who is a member of both bodies and reports to the Chief Financial Officer, Executive Director, Risk and Regulation.

     Global Risk has functional responsibility for the principal financial risk types, namely retail and wholesale credit, market, operational, security and fraud risks. For these it establishes Group policy, exercises Group-wide oversight and provides reporting and analysis of portfolio composition and trends on a global and regional basis to senior management. Accountability and consistent control across the Global Risk function is provided through the Global Risk Management Board, chaired by the GCRO, the members of which include the Chief Risk Officers of HSBC’s regions and the heads of risk disciplines within Group Management Office (‘GMO’). Regional Chief Risk Officers report both within the business line to their local CEOs and also functionally to the GCRO, who has joint responsibility with CEOs for the appointment of the most senior risk officers and the setting of their performance objectives.

     Group Risk works closely with its functional colleagues across the Group to develop and communicate global strategies and to guide the setting of consistent performance measures, targets and key performance indicators. It also co-ordinates the continued development of the Group’s risk appetite, economic capital and stress testing frameworks and participates in discussions with regulators and in industry fora on risk and regulatory policy developments, assesses their implications and makes recommendations accordingly.

     The Global Risk function also works closely with Asset and Liability Management Committees (‘ALCO’s) across the Group to harmonise capital management disciplines across risk types.

The Group is organised into six geographical regions: Europe; Hong Kong; Rest of Asia-Pacific; Middle East (previously, Middle East was reported as part of Rest of Asia-Pacific); North America and Latin America, within which country managers are the Group’s principal representatives in their respective jurisdictions.

     Regional heads and country managers are responsible for growing and controlling Group businesses in line with Group standards, policies and procedures, and for ensuring that the Group’s corporate responsibilities are met in the communities in which it operates.

     The Group manages its business around its customers through two global businesses, Global Banking and Markets and Private Banking, and two customer groups, Personal Financial Services, which incorporates the Group’s consumer finance businesses, and Commercial Banking.

HSBC’s risk management policies are encapsulated in the Group Standards Manual and cascaded in a hierarchy of policy manuals throughout the Group to communicate standards, instructions and guidance to employees. They support the formulation of risk appetite and establish procedures for monitoring and controlling risks, with timely and reliable reporting to management.

     The principal risk categories to which the Group is exposed have each been assigned to ‘risk owners’ within GMO functions for the purposes of general oversight and the development of risk measures, key risk indicators and stress testing processes at Group level, to ensure that the Group’s risk appetite is adhered to and that RMM is kept abreast of emerging risk issues. Risk ownership extends to Group policies and procedures documented in the policy manuals which all Group offices must observe, subject to dispensations agreed by the risk owner and reviewed by internal audit.

     HSBC regularly reviews and updates its risk management policies, systems and methodologies to reflect changes in law, regulation, markets, products and emerging best practice.

     It is a responsibility of all Group officers to identify, assess and manage risks within the scope of their assigned responsibilities. Personal accountability, reinforced by the Group’s governance structure and instilled by training and experience, helps to foster a disciplined and constructive culture

of risk management and control. Risk management is emphasised within the Group Remuneration policy and requirements are in place to ensure remuneration is consistent with effective risk management. Further details of the Group Remuneration policy are set out on page 318 of the Annual Report and Accounts 2009.

HSBC’s risk appetite framework describes the quantum and types of risk that HSBC is prepared to take in executing its strategy. It is central to an integrated approach to risk, capital and business management and supports the Group in achieving its return on equity objectives, as well as being a key element of meeting the Group’s obligations under the supervisory review process of Basel II.

     The formulation of risk appetite considers HSBC’s risk capacity, its financial position, the strength of its core earnings and the resilience of its reputation and brand. It is expressed both qualitatively, describing which risks are taken and why, and quantitatively. HSBC’s senior management attaches quantitative metrics to individual risk types to ensure that:

•

underlying business activity may be guided and controlled so it continues to be aligned to the risk appetite framework;

•

key assumptions underpinning risk appetite can be monitored and, as necessary, adjusted through subsequent business planning cycles; and

•

business decisions expected to be necessary to mitigate risk are flagged and acted upon promptly.

     The Group’s risk appetite framework is also maintained at regional and customer group levels. It operates through two key mechanisms:

•

the framework itself defines the governance bodies, processes, metrics and other features of how HSBC addresses risk appetite as part of its ongoing business; and

•

periodic risk appetite statements define, at various levels in the business, the desired level of risk commensurate with return and growth targets and in line with the corporate strategy and stakeholder objectives.

     The risk appetite framework covers both the beneficial and adverse aspects of risk. Within it, economic capital is a common currency by means of which risk is measured. It is used as the basis for risk evaluation, capital allocation and performance

measurement across regions and customer groups. Risk appetite is executed through the operational limits that control the levels of risk run by the Group, regions and customer groups and is measured using risk-adjusted performance metrics.

The purpose of HSBC’s risk measurement and reporting systems is to ensure that risks are comprehensively captured with all the attributes necessary to support well-founded decisions, that those attributes are accurately assessed and that information is delivered in a timely way to the right points in the organisation for those risks to be successfully managed and mitigated.

     Risk measurement and reporting systems are also subject to a robust governance framework, to ensure that their design is fit for purpose and that they are functioning properly. Group risk information technology systems development is a key responsibility of the GCRO, while the operation and development of risk rating and management systems and processes are ultimately subject to the oversight of RMM and the Board.

     HSBC invests significant resources in information technology systems and processes to maintain and improve its risk management capabilities. Group policy promotes the deployment of preferred technology where practicable. Group standards govern the procurement and operation of systems used in the Group’s subsidiaries, processing risk information within business lines and risk functions. The measurement and monitoring of the major risks encountered by the Group, including credit, market and operational risks, are increasingly delivered by central systems or, where this is not the case for sound business reasons, through structures and processes that nevertheless support comprehensive oversight by senior management. Much of this is being progressed within the formalised structure of a wide-reaching transformation programme (‘One HSBC’) designed to integrate products, processes and systems.

     Risk measurement, monitoring and reporting structures deployed at GMO level are replicated in global businesses and subsidiaries through a common operating model for integrated risk management and control. This model, the regional implementation of which was substantially completed during 2009, sets out the respective responsibilities of Group Risk, regional and country Risk functions in respect of such matters as risk governance and oversight, approval authorities and

lending guidelines, global and local scorecards, management information and reporting, and relations with third parties including regulators, rating agencies and auditors.

     There is regular reporting on risk to business line management, to specialist functions and to the senior governance bodies of the Group. In the case of credit risk, this includes portfolio reporting using key risk indicators. Examples of credit risk portfolio reporting are detailed on page 202 of the Annual Report and Accounts 2009.

Credit risk is the risk of financial loss if a customer or counterparty fails to meet a payment obligation under a contract. It arises principally from direct lending, trade finance and leasing business, but also from off-balance sheet products such as counterparty risk guarantees and credit derivatives, and from the Group’s holdings of debt securities. Among the risks the Group engages in, credit risk generates the largest regulatory capital requirement. This includes a capital requirement for counterparty credit risk in the banking and trading books. Further details regarding the Group’s management of counterparty credit risk can be found on page 33 below.

The objectives of credit risk management, underpinning sustainably profitable business, are principally:

•

to maintain a strong culture of responsible lending, supported by a robust risk policy and control framework;

•

to both partner and challenge business originators effectively in defining and implementing risk appetite, and its re-evaluation under actual and scenario conditions; and

•

to ensure independent, expert scrutiny and approval of credit risks, their costs and their mitigation.

Group Risk supports the GCRO in overseeing credit risks at the highest level. Its major duties comprise: undertaking independent reviews of larger and higher-risk credit proposals, oversight of the Group’s wholesale and retail credit risk management disciplines, ownership of the Group’s credit policy and credit systems programmes, and reporting on risk matters to senior executive management and to regulators. It works closely with other parts of the Risk function, for example: with Fraud/Security Risk

on enhancement of protection against retail product fraud, with Market Risk on complex transactions, with Operational Risk on the internal control framework and with Risk Strategy on developing the Group’s economic capital model, risk appetite process and stress testing. The responsibilities of Group Risk are set out in detail on pages 201 to 203 of the Annual Report and Accounts 2009.

     Group-wide, the Credit Risk function comprises a network of credit risk management offices reporting within regional, integrated risk functions. Together with Group Risk, they fulfil an essential role as independent risk control units distinct from business line management in providing an objective scrutiny of risk rating assessments, credit proposals for approval and other risk matters.

     HSBC operates through a hierarchy of personal credit limit approval authorities, not committee structures. Risk officers of individual operating companies, acting under authorities delegated by their boards and executive bodies within local and Group standards, are accountable for their recommendations and credit approval decisions. Each operating company is responsible for the quality and performance of its credit portfolios, and for monitoring and controlling all credit risks in those portfolios, to Group standards.

     Above certain risk-based thresholds established in line with authorities delegated by the Board, GMO concurrence must be sought for locally-approved facilities before they are extended to the customer. Moreover, risk proposals in certain portfolios – sovereign obligors, banks, some non-bank financial institutions and intra-Group exposures – are approved centrally in GMO to facilitate efficient control and the reporting of regulatory large and cross-border exposures; most approval authorities for these exposures are delegated by the local CEO to the GCRO, with only limited levels of authority being maintained locally.

The Group Credit Analytics function is located within Group Risk as part of a wider analytics discipline supporting credit, economic capital and stress testing. Group Credit Analytics formulates technical responses to industry developments and regulatory policy in the field of credit risk analytics. It develops HSBC’s global credit risk models and maintains a directory of local models in use around the Group in order to facilitate governance, prioritise resources for independent review and inform the monitoring of progress toward the Group’s implementation targets for the IRB advanced

approach. It also provides support for the Group Credit Risk Analytics Oversight Committee (‘CRAOC’) which meets monthly and reports to RMM. Group CRAOC is chaired by the GCRO, and its membership is drawn from Global Risk, Group global businesses and customer groups and major Group subsidiaries; its primary responsibilities are to oversee the governance of HSBC’s risk rating models for both wholesale and retail business, to manage the development of global models and to oversee the development of local models.

     Parallel model governance and decision-making arrangements are in place in the Group’s major subsidiaries.

HSBC’s exposure to credit risk arises from a very wide range of customer and product types, and the risk rating systems in place to measure and monitor these risks are correspondingly diverse. Each major subsidiary typically has some exposures across this range, and requirements differ from place to place.

     Credit risk exposures are generally measured and managed in portfolios of either distinct customer types or product categories. Risk rating systems for the former are designed to assess the default risk of, and loss severity associated with, customers who are typically managed as individual relationships; these rating systems tend to have a higher subjective content. Risk ratings systems for the latter are generally more purely analytical, applying techniques such as behavioural analysis across product portfolios comprising large numbers of homogeneous transactions.

     Whatever the nature of the exposure, a fundamental principle of the Group’s policy and approach is that analytical risk rating systems and scorecards are all merely tools at the disposal of management, serving ultimately judgemental decisions for which individual approvers are accountable. In the case of automated decision making processes, therefore, as used in retail credit origination where risk decisions may be taken ‘at

the point of sale’ with no management intervention, that accountability rests with those responsible for the parameters built into those processes/systems and the controls surrounding their use. For distinct customers, the credit process provides for at least annual review of facility limits granted. Review may be more frequent, as required by circumstances, such as the development of adverse risk factors, and any consequent amendments to risk ratings must be promptly implemented.

     HSBC seeks constantly to improve the quality of its risk management. Thus, for central management and reporting purposes, Group information technology systems have been deployed to process credit risk data efficiently and consistently; a database has been constructed within GMO Finance and Risk covering substantially all the Group’s direct lending exposures and holding the output of risk rating systems Group-wide, to support regulatory reporting and to deliver comprehensive management information at an increasingly granular level.

     Group standards govern the process through which risk rating systems are initially developed, judged fit for purpose, approved and implemented; the conditions under which analytical risk model outcomes can be overridden by decision-takers; and the process of model performance monitoring and reporting. The emphasis here is on an effective dialogue between business line and risk management, suitable independence of decision-takers, and a good understanding and robust challenge on the part of senior management.

     Like other facets of risk management, analytical risk rating systems are not static and are subject to review and modification in the light of the changing environment and the greater availability and quality of data. Structured processes and metrics are in place to capture relevant data and feed this into continuous model improvement.

     The following pages set out credit risk exposure values, RWAs and regulatory capital requirements as at 31 December 2009 along with 31 December 2008 comparatives.