Company: HBCYF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001089113-25-000040
Chunk: 230

Company: HSBC HOLDINGS PLC
Filing Date: 2025-02-20
Form: 20-F
Chunk 230
---
ating actions – We monitor regulatory developments to understand the evolving regulatory landscape, and seek to respond with changes in a timely manner. – We engage with governments and regulators, and respond to consultations with a view to help shape regulations that can be implemented effectively. – We hold regular meetings with relevant authorities to discuss strategic contingency plans, including those arising from geopolitical issues. – Our purpose-led conduct approach aligns to our purpose and values, in particular the value ‘we take responsibility’.

Internally driven Data risk We use multiple systems and growing quantities of data to support our customers. Risk arises if data is incorrect, unavailable, misused or unprotected. Along with other banks and financial institutions, we need to meet external regulatory obligations and laws that cover data, such as the Basel Committee on Banking Supervision’s 239 guidelines and the General Data Protection Regulation. Mitigating actions – Through our global data management framework, we monitor the quality, availability and security of data that supports our customers and internal processes. We work towards resolving any identified data issues in a timely manner. – We continue to make improvements to our data policies and to our control framework – which includes trusted sources, data flows and data quality – in order to enhance the end-to-end management of data risk. – We have established a global data management utility and continue to simplify and unify data management activities across the Group. – We seek to protect customer data through our data privacy framework, which establishes practices, design principles and guidelines that enable us to demonstrate compliance with data privacy laws and regulations. – We continue to modernise our data and analytics infrastructure through investments in cloud technology, data visualisation, machine learning and AI. – We continue to educate our employees on data risk and data management. We have delivered regular mandatory training globally on how to protect and manage data appropriately. Risks arising from the receipt of services from third parties We use third parties to provide a range of goods and services. It is critical that we seek to have appropriate risk management policies, processes and practices over the selection, governance and oversight of third parties and their supply chain, particularly for key activities that could affect our operational resilience. Any deficiency in the management of risks associated with our third parties could affect our ability to support our customers and meet regulatory expectations. Mitigating actions – We continue to monitor the effectiveness of the controls operated by our third-party providers and request third-party control reports, where required. – We continued to develop the management of our intra-group arrangements using the same control standards as we apply to external third party arrangements. – We