Cautionary statement regarding forward-looking statements

The Capital and Risk Management Pillar 3 Disclosures as at 31 December 2010 (‘Pillar 3 Disclosures 2010’) contains certain forward-looking statements with respect to HSBC’s financial condition, results of operations and business.

     Statements that are not historical facts, including statements about HSBC’s beliefs and expectations, are forward-looking statements. Words such as ‘expects’, ‘anticipates’, ‘intends’, ‘plans’, ‘believes’, ‘seeks’, ‘estimates’, ‘potential’ and ‘reasonably possible’, variations of these words and similar expressions are intended to identify forward-looking statements. These statements are based on current plans, estimates and projections, and therefore undue reliance should not be placed on them. Forward-

looking statements speak only as of the date they are made, and it should not be assumed that they have been revised or updated in the light of new information or future events.

     Written and/or oral forward-looking statements may also be made in the periodic reports to the US Securities and Exchange Commission, summary financial statements to shareholders, proxy statements, offering circulars and prospectuses, press releases and other written materials, and in oral statements made by HSBC’s Directors, officers or employees to third parties, including financial analysts. Forward-looking statements involve inherent risks and uncertainties. Readers are cautioned that a number of factors could cause actual results to differ, in some instances materially, from those anticipated or implied in any forward-looking

statement. These factors include changes in general economic conditions in the markets in which we operate, changes in government policy and regulation and factors specific to HSBC. A more detailed cautionary statement is provided on page 379 of the Annual Report and Accounts 2010.

Introduction

Headquartered in London, HSBC is one of the world’s largest banking and financial services organisations and one of the industry’s most valuable brands. We provide a comprehensive range of financial services to around 95 million customers through two customer groups, Personal Financial Services (including consumer finance), and Commercial Banking, and two global businesses, Global Banking and Markets, and Global Private Banking.

     Our international network covers 87 countries and territories in six geographical regions; Europe, Hong Kong, Rest of Asia-Pacific, the Middle East, North America and Latin America.

     With listings on the London, Hong Kong, New York, Paris and Bermuda stock exchanges, shares in HSBC Holdings plc are held by over 221,000 shareholders in 127 countries and territories.

     Details of the Group’s principal activities and its strategic direction can be found on page 10 of the Annual Report and Accounts 2010.

Basel II

The United Kingdom (‘UK’) Financial Services Authority (‘FSA’) supervises HSBC on a consolidated basis, and therefore receives information on the capital adequacy of, and sets capital requirements for, the Group as a whole. Individual banking subsidiaries are directly regulated by their local banking supervisors, who set and monitor their capital adequacy requirements.

     We calculate capital at a Group level using the Basel II framework of the Basel Committee on Banking Supervision (‘Basel Committee’). However, local regulators are at different stages of implementation and local reporting may still be on a Basel I basis, notably in the United States (‘US’). In most jurisdictions, non-banking financial subsidiaries are also subject to the supervision and capital requirements of local regulatory authorities.

     Basel II is structured around three ‘pillars’: minimum capital requirements, supervisory review process and market discipline. The Capital Requirements Directive (‘CRD’) implemented Basel II in the European Union (‘EU’) and the

FSA then gave effect to the CRD by including the requirements of the CRD in its own rulebooks.

Pillar 3 disclosures 2010

Pillar 3, market discipline, complements the minimum capital requirements and the supervisory review process. Its aim is to encourage market discipline by developing a set of disclosure requirements which allow market participants to assess certain specified information on the scope of application of Basel II, capital, particular risk exposures and risk assessment processes, and hence the capital adequacy of the institution. Disclosures consist of both quantitative and qualitative information and are provided at the consolidated level.

     Banks are required to disclose all their material risks as part of the pillar 3 framework. All material and non-proprietary information required by pillar 3 is included in the Pillar 3 Disclosures 2010. The FSA permits certain Pillar 3 requirements to be satisfied by inclusion within the financial statements. Where this is the case, page references are provided to the relevant sections in the Annual Report and Accounts 2010.

Future developments

The regulation and supervision of financial institutions continues to undergo significant change in response to the global financial crisis. In December 2010, the Basel Committee issued final rules in two documents: A global regulatory framework for more resilient banks and banking systems and International framework for liquidity risk measurement, standards and monitoring, which together are commonly referred to as ‘Basel III’. The new minimum capital requirements will be phased in from 1 January 2013, with full implementation required by 1 January 2019. The minimum common equity tier 1 requirement of 4.5% and additional capital conservation buffer requirement of 2.5% will be phased in sequentially from 1 January 2013, becoming fully effective on 1 January 2019. Any additional countercyclical capital buffer requirements will also be phased in, starting in 2016, in parallel with the capital conservation buffer to a maximum level of 2.5% effective on 1 January 2019, although individual jurisdictions may choose to implement larger countercyclical capital buffers. The leverage ratio will be subject to a supervisory monitoring period, which commenced on 1 January 2011, and a parallel run period which will run from 1 January 2013 until 1 January 2017. Further calibration of the leverage ratio will be carried out in the first half of 2017, with a view to migrating to a

Pillar 1 requirement from 1 January 2018. The Basel Committee has increased the capital requirements for the trading book and complex securitisation exposures, which are due to be implemented on 31 December 2011. They will continue to conduct the fundamental review of the trading book, which is targeted for completion by the end of 2011. In addition to the reforms discussed above, institutions designated as Global Systemically Important Financial Institutions (‘G-SIFI’s) may be subjected to additional requirements, which have yet to be proposed by regulators. The Basel Committee will provide the approach to defining G-SIFIs by the end of 2011. On 13 January 2011, the Basel Committee issued further minimum requirements to ensure that all classes of capital instruments fully absorb losses at the point of non-viability before taxpayers are exposed to loss. Instruments issued on or after 1 January 2013 may only be included in regulatory capital if the new requirements are met. The capital treatment of securities issued prior to this date will be phased out over a 10-year period commencing 1 January 2013.

     Under the proposed liquidity framework, a liquidity coverage ratio and a net stable funding ratio have been developed. These measures will be phased in from 1 January 2015 and 1 January 2018 respectively, after a period of observation which commences on 1 January 2012.

Impact of Basel III

In order to provide some insight into the possible effects of the new Basel III rules on HSBC, we have estimated the pro forma common equity tier 1 ratio of the Group on the basis of our interpretation of those rules, as they would apply at 1 January 2019, but based on the position at 31 December 2010. We have estimated that the application of the full Basel III rules on a pro forma basis would result in a

common equity tier 1 ratio which is lower than the Basel II core tier 1 ratio by some 250–300 basis points. However, as the new rules will be phased in

between 1 January 2013 and 1 January 2019, their impact will be gradual over that period. This estimate does not, however, take account of any future retained earnings, nor any management actions to reduce RWAs. The Basel III changes relate to increased capital deductions, new regulatory adjustments and increases in RWAs. The majority of the increase in RWAs relates to Basel III changes which are scheduled to come into effect on 1 January 2013, in particular to changes to counterparty credit risk capital charges and amounts for securitisation positions that were previously deducted from capital that will now be risk-weighted instead. Other increases in RWAs will begin to be phased in from 1 January 2014, including the majority of the unconsolidated investments that were previously deducted from capital. The remainder of the RWA increase arises from increases in trading book capital requirements which take effect on 31 December 2011, primarily relating to changes in market risk.

     The estimated impact of Basel III is subject to change as regulators develop their requirements around the practical application and interpretation of the new rules, in particular the counterparty credit risk capital charge. Further uncertainty remains regarding any capital requirements which may be imposed on the Group over the period to 1 January 2019 in respect of the countercyclical capital buffer and any additional regulatory requirements for G-SIFIs. Under the Basel III rules as they will apply from 1 January 2019, we believe that ultimately the level for the common equity tier 1 ratio of the Group may lie in the range 9.5% to 10.5%. This exceeds the minimum requirement for common equity tier 1 capital plus the capital conservation buffer. HSBC has a strong track record of capital generation and actively manages its RWAs. Before these new rules come into force, we will take appropriate management action over the implementation period to 1 January 2019 to reduce the quantum of increase in RWAs that would have occurred if the new rules had been in effect at 31 December 2010.

Frequency

In accordance with FSA requirements, we intend to publish comprehensive pillar 3 disclosures annually. Summarised information will be provided each quarter from March 2011.

Comparison with the Annual Report and Accounts 2010

The Pillar 3 Disclosures 2010 have been prepared in accordance with regulatory capital adequacy concepts and rules, rather than in accordance with International Financial Reporting Standards (‘IFRS’s). Therefore, some information in the Pillar 3 Disclosures 2010 is not directly comparable with the financial information in the Annual Report and Accounts 2010. This is most pronounced for the credit risk disclosures, where credit exposure is defined as the maximum loss the Group has estimated under specified Basel II parameters. This differs from similar information in the Annual Report and Accounts 2010, which is mainly reported as at the balance sheet date and, therefore, does not reflect the likelihood of future drawings of committed credit lines.

Verification

The Pillar 3 Disclosures 2010 have been appropriately verified internally, but have not been audited by the Group’s external auditor.

Significant subsidiaries

Links to the financial information of significant subsidiaries, including capital resources and requirements, are available on our investor relations website page www.hsbc.com/investor-relations/financial-results/hsbc-group-companies.

Consolidation basis

The basis of consolidation for financial accounting purposes is described on page 251 of the Annual Report and Accounts 2010 and differs from that used for regulatory purposes. Investments in banking associates, which are equity accounted in the financial accounting consolidation, are proportionally consolidated for regulatory purposes. Subsidiaries and associates engaged in insurance and non-financial activities are excluded from the regulatory consolidation and are deducted from regulatory capital. The regulatory consolidation does not include Special Purpose Entities (‘SPE’s) where significant risk has been transferred to third parties. Exposures to these SPEs are risk-weighted as securitisation positions for regulatory purposes.

Scope of Basel II permissions

Credit risk capital requirements

Basel II applies three approaches of increasing sophistication to the calculation of Pillar 1 credit risk capital requirements. The most basic, the standardised approach, requires banks to use external credit ratings to determine the risk weightings applied to rated counterparties and group other counterparties into broad categories and apply standardised risk weightings to these categories. The next level, the internal ratings-based (‘IRB’) foundation approach, allows banks to calculate their credit risk capital requirements on the basis of their internal assessment of the probability that a counterparty will default (‘PD’), but subjects their quantified estimates of exposure at default (‘EAD’) and loss given default (‘LGD’) to standard supervisory parameters. Finally, the IRB advanced approach allows banks to use their own internal assessment in both determining PD and quantifying EAD and LGD.

     The capital resources requirement, which is intended to cover unexpected losses, is derived from a formula specified in the regulatory rules, which incorporates these factors and other variables such as maturity and correlation. Expected losses under the IRB approaches are calculated by multiplying PD by EAD and LGD. Expected losses are deducted from capital to the extent that they exceed accounting impairment allowances.

     For consolidated group reporting, the FSA’s rules permit the use of other regulators’ standardised approaches where they are considered equivalent. The use of other regulators’ IRB approaches is subject to the agreement of the FSA. For credit risk, we have adopted the IRB advanced approach for the majority of our business. A number of Group companies and portfolios are in transition to IRB advanced from standardised or IRB foundation approaches, pending definition of local regulations or model development and approval; others will remain on standardised under exemptions from IRB treatment.

Counterparty credit risk capital requirement

Counterparty credit risk in both the trading and non-trading books is the risk that the counterparty to a transaction may default before completing the satisfactory settlement of the transaction. Three approaches to calculating counterparty credit risk and determining exposure values are defined by Basel II: standardised, mark-to-market and internal model method (‘IMM’). These exposure values are used to determine capital requirements under one of the credit risk approaches; standardised, IRB foundation and IRB advanced.

     We use the mark-to-market and IMM approaches for counterparty credit risk. Our longer-term aim is to migrate more positions from the mark-to-market to the IMM approach.

Market risk capital requirement

Market risk is the risk that movements in market risk factors, including foreign exchange, commodity prices, interest rates, credit spread and equity prices will reduce our income or the value of our portfolios. The market risk capital requirement is measured, with FSA permission, using Value at Risk (‘VAR’) models or the standard rules prescribed by the FSA.

     We use both VAR and standard rules approaches for market risk. Our aim is to migrate more positions from standard rules to VAR.

Operational risk capital requirement

Basel II includes capital requirements for operational risk, again utilising three levels of sophistication. The capital required under the basic indicator approach is a simple percentage of gross revenues, whereas under the standardised approach, it is one of three different percentages of gross revenues allocated to each of eight defined business lines. Both these approaches use an average of the last three financial years’ revenues. Finally, the advanced measurement approach uses banks’ own statistical analysis and modelling of operational risk data to determine capital requirements.

     We have adopted the standardised approach in determining our operational risk capital requirement.

 

Capital management and allocation

Our approach to capital management is driven by our strategic and organisational requirements, taking into account the regulatory, economic and commercial environment in which we operate.

     It is our objective to maintain a strong capital base to support the development of our business and to meet regulatory capital requirements at all times. To achieve this, our policy is to hold capital in a range of different forms and from diverse sources, and all capital raising is agreed with major subsidiaries as part of their individual and the Group’s overall capital management processes.

     Our policy is underpinned by a capital management framework, which enables us to manage our capital in a consistent and aligned manner. The framework, which is approved by the Group Management Board (‘GMB’), incorporates a number of different capital measures including market capitalisation, invested capital, economic capital and regulatory capital.

     The responsibility for global capital allocation principles and decisions rests with GMB. Through our structured internal governance processes, we maintain discipline over our investment and capital allocation decisions and seek to ensure that returns on investment are adequate after taking account of capital costs. Our strategy is to allocate capital to businesses on the basis of their economic profit generation, regulatory and economic capital requirements and cost of capital.

Transferability of capital within the Group

HSBC Holdings is the primary provider of capital to its subsidiaries and these investments are substantially funded by its own capital issuance and profit retention. As part of its capital management process, HSBC Holdings seeks to maintain a prudent balance between the composition of its capital and that of its investment in subsidiaries. Each of the subsidiaries manage their own capital to support their planned business growth and meet their local regulatory requirements within the context of the approved annual Group capital plan. In accordance with our capital management framework, capital generated by subsidiaries in excess of planned requirements is returned to HSBC Holdings, normally by way of dividends. During 2010 and 2009, none of the Group’s subsidiaries experienced significant restrictions on paying dividends or repaying loans and advances.

Internal assessment of capital adequacy

We assess the adequacy of our capital by considering the resources necessary to cover unexpected losses arising from discretionary risks, such as credit risk and market risk, or non-discretionary risks, such as operational risk and reputational risk. The framework, together with related policies define the Internal Capital Adequacy Assessment Process (‘ICAAP’) by which GMB examines our risk profile from both regulatory and economic capital viewpoints and ensures that our level of capital:

•		remains sufficient to support our risk profile and outstanding commitments;
•		exceeds our formal minimum regulatory capital requirements by an agreed margin;
•		is capable of withstanding a severe economic downturn stress scenario; and
•		remains consistent with our strategic and operational goals, and shareholder and rating agency expectations.

     The regulatory and economic capital assessments rely upon the use of models that are integrated into our management of risk. Economic capital is the internally calculated capital requirement which we deem necessary to support the risks to which we are exposed, at a confidence level consistent with a target credit rating of AA. The minimum regulatory capital that we are required to hold is determined by the rules established by the FSA for the consolidated Group and by local regulators for individual Group companies. The economic capital assessment is the more risk-sensitive measure, as it covers a wider range of risks and takes account of the substantial diversification of risk accruing from our operations. Our economic capital models are calibrated to quantify the level of capital that is sufficient to absorb potential losses over a one-year time horizon to a 99.95% level of confidence for our banking activities and to a 99.5% level of confidence for our insurance activities and pension risks. Our approach to capital management is aligned to our corporate structure, business model and strategic direction. Our discipline around capital allocation is maintained within established processes and benchmarks, in particular the approved annual Group capital plan, further details of which can be found on page 177 of the Annual Report and Accounts 2010.

     Economic capital is the metric by which risk is measured and linked to capital within our risk appetite framework. The framework, which

expresses the types and quantum of risks to which we wish to be exposed, is approved annually by the Board of Directors of HSBC Holdings (‘the Board’), and its implementation is overseen by GMB. Further details on the risk appetite framework may be found on page 87 of the Annual Report and Accounts 2010.

     Our risk management framework fosters the continuous monitoring of the risk environment and an integrated evaluation of risks and their interactions. Certain of these risks are assessed and managed via the capital planning process. Risks assessed via capital and those that are not are compared below:

Risks assessed via capital

Credit (including counterparty credit), market and operational risk

We assess economic capital requirements for these risk types by utilising the embedded operational infrastructure used for the pillar 1 capital calculation, together with an additional suite of models that take into account, in particular:

•		the increased level of confidence required to meet our strategic goals (99.95%); and
•		internal assessments of diversification of risks within our portfolios and, similarly, any concentrations of risk that arise.

     Our economic capital assessment operates alongside our regulatory capital process and consistently demonstrates a substantially lower overall capital requirement for credit risk than the regulatory equivalent, reflecting the empirical evidence of the benefits of global diversification. However, we maintain a prudent stance on capital coverage, ensuring that any model risk is mitigated. Economic capital requirements are used to monitor our risks against our risk appetite.

Interest rate risk in the banking book

Interest rate risk in the banking book (‘IRRBB’) is defined as the exposure of our non-trading products to interest rates.

     Non-trading portfolios include positions that primarily arise from the interest rate management of future yield on assets and their funding costs, as a result of interest rate changes. Analysis of this risk is complicated by having to make assumptions on embedded optionality within certain product areas such as the incidence of mortgage prepayments, and from behavioural assumptions regarding the economic duration of liabilities which are contractually repayable on demand such as current accounts. IRRBB economic capital is measured as

the amount of capital necessary to cover an unexpected loss in the value of our non-trading products over one year to a 99.95% level of confidence.

Insurance risk

We operate a bancassurance model which provides insurance products for customers with whom we have a banking relationship. Many of these insurance products are manufactured by our subsidiaries but, where we consider it operationally more effective, third parties are engaged to manufacture insurance products for sale through our banking network. We work with a limited number of market-leading partners to provide such products. When manufacturing products ourselves, we underwrite the insurance risk and retain the risks and rewards associated with writing insurance contracts.

     We continue to make progress towards the implementation of a risk-based capital methodology for our insurance businesses. While this is being implemented across HSBC, a Net Asset Value capital deduction methodology is being employed for Group economic capital assessment purposes.

Pension risk

We operate a number of pension plans throughout the world. Some of them are defined benefit plans, of which the largest is the HSBC Bank (UK) Pension Scheme. In order to fund the benefits associated with these plans, sponsoring group companies (and in some instances, employees) make regular contributions in accordance with advice from actuaries and in consultation with the scheme’s trustees (where relevant). In situations where a funding deficit emerges, sponsoring Group companies agree to make additional contributions to the plans, to address the deficit over an appropriate repayment period. Further details of such payments can be found in Note 7 on page 274 of the Annual Report and Accounts 2010. The defined benefit plans invest these contributions in a range of investments designed to meet their long-term liabilities.

     Pension risk arises from the potential for a deficit in a defined benefit plan to arise from a number of factors, including:

•

investments delivering a return below that required to provide the projected plan benefits. This could arise, for example, when there is a fall in the market value of equities, or when increases in long-term interest rates cause a fall in the value of fixed income securities held;

•		the prevailing economic environment leading to corporate failures, thus triggering write-downs in asset values (both equity and debt);
•		a change in either interest rates or inflation which causes an increase in the value of the scheme liabilities; and
•		scheme members living longer than expected (known as longevity risk).

     Pension risk is assessed by way of an economic capital model that takes into account potential variations in these factors, using VAR methodology.

Residual risk

Residual risk is, primarily, the risk that mitigation techniques prove less effective than expected. This category also includes risks that arise from specific reputational or business events that give rise to exposures not deemed to be included in the major risk categories. We conduct economic capital assessments of such risks on a regular, forward-looking basis to ensure that their impact is adequately covered by our capital base.

Risks not explicitly assessed via capital

Liquidity risk

Liquidity and funding risk management is described in detail on page 140 of the Annual Report and Accounts 2010.

     We use cash-flow stress testing as part of our control processes to assess liquidity risk. We do not manage liquidity through the explicit allocation of capital as, in common with standard industry practice, this is not considered to be an appropriate or adequate mechanism for managing these risks. However, we recognise that a strong capital base can help to mitigate liquidity risk both by providing a capital buffer to allow an entity to raise funds and deploy them in liquid positions, and by serving to reduce the credit risk taken by providers of funds to the Group.

Structural foreign exchange risk

Structural foreign exchange risks arise from our net investments in subsidiaries, branches and associates, the functional currencies of which are other than the US dollar. Unrealised gains or losses due to revaluations of structural foreign exchange exposures are reflected in reserves, whereas other unrealised gains or losses arising from revaluations of foreign exchange positions are reflected in the income statement.

     Our structural foreign exchange exposures are managed with the primary objective of ensuring, where practical, that our consolidated capital ratios and the capital ratios of the individual banking subsidiaries are largely protected from the effect of changes in exchange rates. This is usually achieved by ensuring that, for each subsidiary bank, the ratio of structural exposures in a given currency to RWAs denominated in that currency is broadly equal to the capital ratio of the subsidiary in question. We evaluate residual structural foreign exchange exposures using a VAR model, but typically do not assign any economic capital for these since they are managed within appropriate economic capital buffers.

     Details of our management of structural foreign exchange risk can be found on page 149 of the Annual Report and Accounts 2010.

Reputational risk

As a banking group, our good reputation depends upon the way in which we conduct our business, but it can also be affected by the way in which clients, to whom we provide financial services, conduct themselves.

     Details of our management of reputational risk can be found on page 172 of the Annual Report and Accounts 2010.

Sustainability risk

Sustainability risks arise from the provision of financial services to companies or projects which run counter to the needs of sustainable development; in effect, this risk arises when the environmental and social effects outweigh economic benefits.

     Details of our management of sustainability risk can be found on page 173 of the Annual Report and Accounts 2010.

Business risk

The FSA specifies that banks, as part of their internal assessment of capital adequacy process, should review their exposure to business risk.

     Business risk is the potential negative impact on profits and capital from the Group not meeting our strategic objectives, as set out in the rolling operating plan, as a result of unforeseen changes in the business and regulatory environment, exposure to economic cycles and technological changes.

     We manage and mitigate business risk through our business planning and stress testing processes, which ensure that our business model and planned

activities are appropriately resourced and capitalised consistent with the commercial, economic and risk environment in which the Group operates and that the potential vulnerability to our business plans are identified at an early stage so that mitigating actions can be taken proactively.

Risk management objectives and policies

Overview

All our activities – whether lending, payment transmission, trading business to support clients and markets, or maintenance of our infrastructure for delivering financial services – involve to varying degrees the measurement, evaluation, acceptance and management of risks.

     The objective of risk management, shared across the organisation, is to support Group strategies to build sustainably profitable business in the best long-term interests of our shareholders and other stakeholders. Our approach is therefore to ensure that risk management is deeply and firmly embedded in how we run our business. This is achieved through:

•		a historically strong risk culture, with personal accountability for decisions;
•		a robust governance structure, with a clear, well understood framework of risk ownership, standards and policy;
•		the alignment of risk and business objectives, and integration of risk appetite into business planning and capital management; and
•		an independent, integrated and specialist global Risk function.

     Our risk culture is a major strength of the Group, and fostering it is a key responsibility of senior executives assisted by the Risk function. All employees are held accountable for identifying, assessing and managing risks within the scope of their assigned responsibilities. A primary duty of the senior executive in each country in which we operate is to maintain an effective risk strategy to address all risks in the business they manage, and we have a system of personal, not collective, authorities for lending decisions. Personal accountability, reinforced by learning and development, helps sustain a disciplined and constructive culture of risk management and control throughout HSBC.

     Our risk governance structure is set out in the Report of the Group Risk Committee (‘GRC Report’) on page 197 of the Annual Report and Accounts 2010. Strong risk management and internal control systems are evidenced in a well established,

clear framework of risk ownership and documented standards, policy and procedure.

     Risk management objectives are integrated into the balanced scorecards of the heads of regions, global businesses and key functions from the GMB down, and cascaded through the organisation. The objectives of the Risk function as such are also fully aligned in this process with strategic business objectives.

     Our approach to risk appetite, explained in further detail in the GRC Report, reinforces the integration of risk considerations into key business goals and planning processes. Preserving our strong capital position remains a key priority for HSBC, and the level of integration of our risk and capital management helps to optimise our response to business demand for regulatory and economic capital (see also ‘Capital management and allocation’ above).

     As risk is not static, our risk profile continually alters as a result of change in the scope and impact of a wide range of factors, from geopolitical to transactional. The risk environment requires continual monitoring and holistic assessment in order to understand and manage its complex interactions across the Group.

     The global Risk function, headed by the Group Chief Risk Officer (‘GCRO’), provides an expert, integrated and independent assessment of risks across the Group:

•		supporting our regions and global businesses in the development and achievement of strategic objectives;
•		partnering the business in risk appetite planning and operation;
•		carrying out central approvals, controls, risk systems leadership and the analysis and reporting of management information;
•		fostering development of the Risk function and the Group’s risk culture; and
•		addressing risk issues in dealings with external stakeholders including regulators and analysts.

     In addition to ‘business as usual’ operations, the Risk function engages fully in business development activities such as new product approval and post-implementation review, and acquisition due diligence.

     Diversification is an important aspect of our management of risk. Our geographical diversification supports our strategies of growth in emerging markets and international connectivity,

and the diversification of our risk portfolio across markets, customer groups and products ensures that we are not dependent on a few sources for revenue and growth, mitigating both business risks and capital usage. Diversification models are developed, together with the business, within Risk’s quantitative analytics division.

     The global Risk function has also led work on stress scenario development, testing and analysis, details of our approach to which are set out in the GRC Report and which is now integrated into our operations’ planning and capital management. In addition to stress scenario analysis, the Risk function pro-actively identifies emerging risks of all kinds, for example in work on sustainability and climate change.

     The external environment for a global financial institution such as HSBC is constantly changing. The main challenges and uncertainties faced by the Group are set out on page 88 of the Annual Report and Accounts 2010.

Scope and nature of risk measurement and reporting systems

The purpose of our risk measurement and reporting systems is to ensure that risks are comprehensively captured with all the attributes necessary to support well-founded decisions, that those attributes are accurately assessed and that information is delivered in a timely way to the right points in the organisation for those risks to be successfully managed and mitigated.

     Risk measurement and reporting systems are also subject to a robust governance framework, to ensure that their design is fit for purpose and that they are functioning properly. Group risk IT systems development is a key responsibility of the GCRO, while the operation and development of risk rating and management systems and processes are ultimately subject to the oversight of the Board.

     We invest significant resources in IT systems and processes in order to maintain and improve our risk management capabilities. Group policy promotes the deployment of preferred technology where practicable. Group standards govern the procurement and operation of systems used in our subsidiaries, processing risk information within business lines and risk functions. The measurement and monitoring of the major risks we encounter, including credit, market and operational risks, are increasingly delivered by central systems or, where this is not the case for sound business reasons, through structures and processes that support comprehensive oversight by senior management.

     Risk measurement, monitoring and reporting structures deployed at Group Management Office (‘GMO’) level are replicated in global businesses and subsidiaries through a common operating model for integrated risk management and control. This model sets out the respective responsibilities of Group Risk, regional and country Risk functions in respect of such matters as risk governance and oversight, approval authorities and lending guidelines, global and local scorecards, management information and reporting, and relations with third parties including regulators, rating agencies and auditors.

Credit risk

Credit risk is the risk of financial loss if a customer or counterparty fails to meet a payment obligation under a contract. It arises principally from direct lending, trade finance and leasing business, but also from off-balance sheet products such as counterparty risk guarantees and credit derivatives, and from our holdings of debt securities. Of the risks in which we engage, credit risk generates the largest regulatory capital requirement. This includes a capital requirement for counterparty credit risk in the banking and trading books. Further details regarding our management of counterparty credit risk can be found on page 32.

Objectives

The objectives of credit risk management, underpinning sustainably profitable business, are principally:

•		to maintain across HSBC a strong culture of responsible lending, and a robust risk policy and control framework;
•		to both partner and challenge our businesses in defining and implementing risk appetite, continually re-evaluating under actual and stress scenario conditions; and
•		to ensure independent, expert scrutiny and approval of credit risks, their costs and their mitigation.

Organisation and responsibilities

Group Risk supports the GCRO in overseeing credit risks at the highest level. For this, its major duties comprise: undertaking independent reviews of larger and higher-risk credit proposals, large exposure policy and reporting oversight of our wholesale and retail credit risk management disciplines, ownership of our credit policy and credit systems programmes, and reporting on risk matters to senior executive management and to regulators. It works closely with

other parts of the Risk function, for example: with Fraud/Security Risk on enhancement of protection against retail product fraud, with Market Risk on complex transactions, with Operational Risk on the internal control framework and with Risk Strategy on developing our economic capital model, risk appetite process and stress testing. The credit responsibilities of Group Risk are set out in detail on page 93 of the Annual Report and Accounts 2010.

     Group-wide, the credit risk function comprises a network of credit risk management offices reporting within regional, integrated risk functions. They fulfil an essential role as independent risk control units distinct from business line management in providing an objective scrutiny of risk rating assessments, credit proposals for approval and other risk matters.

     We operate through a hierarchy of personal credit limit approval authorities, not committee structures. Risk officers of individual operating companies, acting under authorities delegated by their boards and executive bodies within local and Group standards, are accountable for their recommendations and credit approval decisions. Each operating company is responsible for the quality and performance of its credit portfolios, and for monitoring and controlling all credit risks in those portfolios, to Group standards.

     Above certain risk-based thresholds established in line with authorities delegated by the Board, GMO concurrence must be sought for locally-approved facilities before they are extended to the customer. Moreover, risk proposals in certain portfolios – sovereign obligors, banks, some non-bank financial institutions and intra-Group exposures – are approved centrally in GMO to facilitate efficient control and the reporting of regulatory large and cross-border exposures. Most approval authorities for these exposures are delegated by the local Chief Executive Officer to the GCRO, with only limited levels of authority being maintained locally.

Risk analytics

The Group Risk Analytics function is located within Group Risk as part of a wider analytics discipline supporting rating and scoring models, economic capital and stress testing. Group Risk Analytics formulates technical responses to industry developments and regulatory policy in the field of credit risk analytics. It develops HSBC’s global credit risk models and guides and oversees local model development and use around the Group in progress toward our implementation targets for the IRB advanced approach.

     The risk analytics models are governed by the Group Credit Risk Analytics Oversight Committee (‘CRAOC’) which meets monthly and reports to Risk Management Meeting (‘RMM’). Group CRAOC is chaired by the GCRO, and its membership is drawn from Risk, global businesses and customer groups and major Group subsidiaries. Its primary responsibilities are to oversee the governance of our risk rating models for both wholesale and retail business, to manage the development of global models and to oversee the development of local models.

     Parallel model governance and decision-making arrangements are in place in the Group’s major subsidiaries.

Measurement and monitoring – credit risk rating systems

Our exposure to credit risk arises from a very wide range of customer and product types, and the risk rating systems in place to measure and monitor these risks are correspondingly diverse. Each major subsidiary typically has some exposures across this range, and requirements differ from place to place.

     Credit risk exposures are generally measured and managed in portfolios of either customer types or product categories. Risk rating systems for the former are designed to assess the default risk of, and loss severity associated with distinct customers who are typically managed as individual relationships. These rating systems tend to have a higher subjective content. Risk ratings systems for the latter are generally more purely analytical, applying techniques such as behavioural analysis across product portfolios comprising large numbers of homogeneous transactions.

     Whatever the nature of the exposure, a fundamental principle of our policy and approach is that analytical risk rating systems and scorecards are all valuable tools at the disposal of management, serving ultimately judgemental decisions for which individual approvers are accountable. In the case of automated decision-making processes, as used in retail credit origination where risk decisions may be taken ‘at the point of sale’ with no management intervention, that accountability rests with those responsible for the parameters built into those processes/systems and the controls surrounding their use. For customers, the credit process provides for at least an annual review of facility limits granted. Review may be more frequent, as required by circumstances, such as the development of adverse risk factors, and any consequent amendments to risk ratings must be promptly implemented.

     We constantly seek to improve the quality of our risk management. Thus, for central management and reporting purposes, Group information technology systems have been deployed to process credit risk data efficiently and consistently; a database has been constructed within GMO Finance and Risk covering substantially all our direct lending exposures and holding the output of risk rating systems Group-wide, to support regulatory reporting and to deliver comprehensive management information at an increasingly granular level.

     Group standards govern the process through which risk rating systems are initially developed, judged fit for purpose, approved and implemented; the conditions under which analytical risk model

outcomes can be overridden by decision-takers; and the process of model performance monitoring and reporting. The emphasis here is on an effective dialogue between business line and risk management, suitable independence of decision-takers, and a good understanding and robust challenge on the part of senior management.

     Like other facets of risk management, analytical risk rating systems are not static and are subject to review and modification in the light of the changing environment, the greater availability and quality of data and any deficiencies identified through internal and external regulatory review. Structured processes and metrics are in place to capture relevant data and feed this into continuous model improvement.

     The following pages set out credit risk exposure values, RWAs and regulatory capital requirements as at 31 December 2010 together with 31 December 2009 comparatives.