
required. Such compensating controls require a significant degree of
management judgment and assumptions. There is a risk that future
actual results may differ from such judgments and assumptions.
Longer term, the models are likely to require redevelopment to
consider the effects of changes in rates and financial markets.
uFor further details concerning risk weighted assets as at 30 June 2025, refer
to ‘Overview of risk weighted exposure amounts’ in the HSBC Continental
Europe Pillar 3 document. These numbers are for a large part computed using
internal models.
Likewise, models are used to infer the fair value of some financial
instruments, such as over-the-counter derivatives (‘OTC’), whose
price cannot be directly observed on trading platforms: in these cases,
models compute a fair value by leveraging the prices of similar
observable financial instruments.
These may be based on observable inputs only (‘Level 2’ fair value
accounting) or, in some cases, on some unobservable inputs that
have to be prudently estimated (‘Level 3’ fair value accounting).
uFor further details concerning fair values of financial instruments carried at
fair value as at 30 June 2025, refer to Note 5 on page 50.
The adoption of more sophisticated modelling approaches including
artificial intelligence by both HSBC Continental Europe and the
financial services industry could also lead to increased model risk that
will have to be managed in compliance with the EU AI Act.
HSBC Continental Europe’s commitment to changes to business
activities due to climate and sustainability challenges will also have an
impact on model risk going forward. Models will play an important
role in risk management and financial reporting of climate related
risks. Challenges such as uncertainty of the long-dated impacts of
climate change and lack of robust and high-quality climate related data
present challenges to creating reliable and accurate model outputs for
these models.
3.2 HSBC Continental Europe’s operations are highly dependent
on its information technology systems.
Probability: Likely/Impact: High (unchanged from FY24).
HSBC Continental Europe operates in an extensive and complex
technology landscape, which must remain resilient in order to support
customers, the Group and markets globally. Risks arise where
technology is not understood, maintained, or developed appropriately.
The reliability and security of HSBC Continental Europe’s information
technology infrastructure is crucial to the bank's operations and the
provision of financial services to its customers and protecting the
HSBC brand.
The effective functioning of HSBC Continental Europe’s payment
systems, financial control, risk management, credit analysis and
reporting, accounting, customer service and other information
technology systems, as well as the communication networks with the
main data processing centres, are important to HSBC Continental
Europe’s operations.
Critical system failure, extended service unavailability or a material
breach of data security, particularly of confidential customer data,
could compromise HSBC Continental Europe’s ability to serve its
customers. This could lead to breaches of regulations and could cause
long-term damage to its business and brand that could have a material
adverse effect on its business, financial condition, results of
operations, prospects and reputation.
In the first half of 2025, IT incidents (including incidents with third
parties) were reported to local regulators following the revised
incident management process aligned to the DORA that came into
effect in January 2025.
uFor further details – see also Risk Factor: HSBC Continental Europe’s
operations use third party and intra-Group suppliers and service providers.
HSBC is continuing to invest in strengthening the resilience of its
technology infrastructure and the further alignment of IT systems
across HSBC Continental Europe, ensuring an appropriate and
consistent control environment across the IT landscape.
There were no net operational losses related to information
technology in the first half of 2025 (EUR 0.0 million in 2024).
3.3 HSBC Continental Europe remains susceptible to a wide
range of cyber security risks that impact and/or are
facilitated by technology.
Probability: Likely/Impact: High (unchanged from FY24).
The threat of cyber incidents remains a concern for HSBC Continental
Europe, as it does across the financial sector and other industries. As
cyber-threats continue to evolve, failure to protect HSBC Continental
Europe’s operations may result in disruption for its customers, and its
business, cause financial loss or loss of sensitive data. This could
have a negative impact on the bank’s customers, and its own
reputation, among other risks.
Adversaries attempt to achieve their objectives by compromising
HSBC and related third party systems. They use techniques that
include malware (including ransomware), exploitation of both known
and unpublished (zero-day) vulnerabilities in software, phishing emails,
distributed denial of service, as well as potentially physical
compromise of premises, or coercion of staff. Customers may also be
subject to these constantly evolving cyber-attack techniques. HSBC
Continental Europe, like other financial institutions, experiences
numerous attempts to compromise its cyber security. The Bank
expects to continue to be the target of such attacks in the future.
Cyber security risks will continue to increase, due to continued
increase of services delivered over the internet; increasing reliance on
internet-based products, applications and data storage; and an
increased use of hybrid working models by HSBC’s employees,
contractors, third party service providers and their sub-contractors.
A failure in HSBC’s adherence to its cyber security policies,
procedures or controls, employee wrongdoing, or human, governance
or technological error could also compromise HSBC Continental
Europe’s ability to defend against cyber-attacks. Should any of these
cyber security risks materialise, they could have a material adverse
effect on its customers, business, financial condition, results of
operations, prospects and reputation.
There have been no material cyber-related breaches that impacted
HSBC Continental Europe customers or operations in the first half of
2025 due to controls in place despite numerous attacks being
observed on a daily basis. However, the risk remains that future
cyber-related attacks, either directly or via one of its suppliers, could
have a material adverse effect on HSBC Continental Europe's
business, financial condition, results of operations, prospects and
reputation.
3.4 HSBC Continental Europe’s operations use third party and
intra-Group suppliers and service providers.
Probability: Likely/Impact: Medium (unchanged from FY24).
In line with HSBC Continental Europe’s outsourcing and Information
and Communication Technology ('ICT') Third Party risk strategy, there
is reliance on external and intra-Group third parties to supply goods
and services. The activities outsourced are diverse and relate, for
example, to reporting, risk management and securities custody. COO,
which supports all Global Businesses and Global Functions, is the
HSBC Continental Europe Interim Financial Report 2025 19