Company: HBCYF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001089113-25-000040
Chunk: 359

Company: HSBC HOLDINGS PLC
Filing Date: 2025-02-20
Form: 20-F
Chunk 359
---
 location strategy to this need. We also remotely provide oversight and stewardship, including support of chief risk officers, in territories where we have no physical presence. Governance and structure The Enterprise Risk Management target operating model provides a globally consistent view across resilience risks, strengthening our risk management oversight while operating effectively as part of a simplified non-financial risk structure. We view resilience risk across nine sub-risk types related to: technology and cybersecurity risk; third-party risk; transaction processing risk; business interruption and incident risk; data risk; change execution risk; building unavailability risk; protective security risk and workplace safety. Risk appetite and key escalations for resilience risk are reported to the Non-Financial Risk Management Board, chaired by the Group Chief Risk and Compliance Officer, with an escalation path to the Group Risk Management Meeting and Group Risk Committee. Key risk management processes We operate processes to support our resilience according to our Risk Management Framework. Our operational resilience is our ability to anticipate, prevent, adapt, respond to, recover, and learn from internal or external disruption, continuing to provide Important Business Services to customers and clients, while minimising impact on the wider financial system when disruption occurs. This is achieved via day-to-day oversight and periodic and ongoing assurance, such as deep dive reviews and controls testing, which may result in challenges being raised to our businesses and group governance by our risk stewards. We have invested to improve response and recovery strategies for our important business services and Important Group business services to meet regulatory and customer expectations. Business operations continuity We continue to monitor the Russia-Ukraine war and the conflict in the Middle East, and remain ready to take measures to ensure business continuity in affected markets should the situations require. There have been no related significant disruptions to our services, although businesses and functions in nearby markets continually review their plans and responses to minimise any potential impacts.

| HSBC Holdings plcAnnual Report on Form 20-F | 259 |

Regulatory compliance risk Overview Regulatory Compliance risk is the risk associated with breaching our duty to clients and other counterparties, inappropriate market conduct (including unauthorised trading) and breaching related financial services regulatory standards. Regulatory Compliance risk arises from the failure to observe relevant laws, codes, rules and regulations and can manifest itself in poor market or customer outcomes and lead to fines, penalties and reputational damage to our business. We aim to keep abreast of developments in legal principles or conduct requirements (including in relation to the risk of such developments in one part of the financial industry being construed as applying to other parts of the financial industry,