Company: HBCYF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001089113-25-000040
Chunk: 257

Company: HSBC HOLDINGS PLC
Filing Date: 2025-02-20
Form: 20-F
Chunk 257
---
 are made, how key relationships are managed and our understanding of third-party dependencies and their impact on service provision. The inadequate management of third-party risk could impact our ability to meet strategic, regulatory and customer expectations. This may lead to a range of impacts, including regulatory censure, penalties or damage both to shareholder value and to our reputation. This could have a material adverse effect on our business, financial condition, results of operations, prospects, capital position and reputation.

Risks related to our governance and internal controls Our data management and data privacy controls must be sufficiently robust to support the increasing data volumes and evolving regulations As the HSBC Group becomes more data-driven and our business processes move to digital channels, the volume of data that we rely on has increased. As a result, management of data (including data retention and deletion, data quality, data privacy and data architecture) from creation to destruction must be robust and designed to identify quality and availability issues. Inadequate data management could result in negative impacts to customer service, business processes, or require manual intervention to reduce the risk of errors in reporting to senior management, executives or regulators. Expanding data privacy, national security and cybersecurity laws in a number of markets could pose potential challenges to intra-group data sharing. These developments could increase financial institutions’ compliance obligations in respect of cross-border transfers of personal information, which may affect our ability to manage financial crime risks across markets. In addition, failure to comply with data privacy laws and other legislation in the jurisdictions in which we operate may result in regulatory sanctions. Any of these failures could have a material adverse effect on our business, financial condition, results of operations, prospects, and reputation. Third parties may use us as a conduit for illegal activities without our knowledge We are required to comply with applicable financial crime laws and regulations, and have adopted various policies, procedures and controls aimed at preventing the exploitation of HSBC's products and services for criminal activity. Financial crime includes fraud, bribery and corruption, tax evasion, sanctions and export control violations, money laundering, terrorist financing and proliferation financing (see ‘Regulation and supervision - Financial crime regulation’). There are instances, as permitted by regulation, where we may rely upon counterparties to undertake certain financial crime risk management activities on our behalf. Any controls implemented and maintained by HSBC to manage the risk created by such reliance may not prevent

| HSBC Holdings plcAnnual Report on Form 20-F | 163 |

third parties from using us (and our relevant counterparties) as a conduit for financial crime, without our