HSBC 2014 Annual Report Download - page 77

HSBC BANK PLC
Report of the Directors: Risk (continued)
75
Operational risk in 2014
During 2014, our operational risk profile continued to be
dominated by compliance and legal risks as referred to in
the ‘Principal risks’ section and Note 37 on the Financial
Statements. Losses were realised relating to events that
occurred in previous years, albeit at a lower level than in
2013. These events included the possible historical mis-
selling of payment protection insurance (‘PPI’) and
interest rate protection products in the UK (see Note 27
on the Financial Statements). A number of mitigating
actions continue to be taken to prevent future mis-
selling incidents.
The incidence of regulatory and other legal proceedings
against financial service firms is increasing. Proposed
changes relating to capital and liquidity requirements,
remuneration and/or taxes could increase our cost of
doing business, reducing future profitability. We remain
subject to a number of regulatory proceedings including
investigations and reviews by various regulators and
competition and law enforcement authorities around the
world relating to certain past submissions made by panel
banks and the processes for making submissions in
connection with the setting of London interbank offered
rates (‘Libor’) and other benchmark interest rates. As
certain HSBC companies are members of such panels,
HSBC has been the subject of regulatory demands for
information and is cooperating with those investigations
and reviews. Various regulators and competition and law
enforcement authorities around the world are also
conducting investigations and reviews into a number of
firms, including HSBC, related to trading on the foreign
exchange markets and activity in the credit derivatives
market, and various class actions have been filed in the
US related to alleged anti-competitive behaviour related
to precious metals In response, we have undertaken a
number of initiatives, including the restructuring of our
Compliance sub-functions, enhancing our governance
and oversight measures to implement Global Standards
as described on page 9 and other measures put in place
designed to ensure we have the appropriate people,
processes and procedures to manage emerging risks and
new products and business. For further details see
'Compliance risk' on page 76 and for details of the
investigations and legal proceedings see Note 37 of the
Financial Statements.
On 12 November 2014, the UK FCA and the US
Commodity Futures Trading Commission (‘CFTC’) each
announced having concluded regulatory settlements
with a number of banks, including HSBC Bank plc, in
connection with their respective investigations of trading
and other conduct involving foreign exchange
benchmark rates. Under the terms of those settlements,
HSBC Bank plc agreed to pay a financial penalty to the
FCA and a civil monetary penalty to the CFTC and to
undertake various remedial actions. For further
information, see Note 37 on the Financial Statements.
HSBC has undertaken a review of compliance with the
fixed-sum unsecured loan agreement requirements of
the UK Consumer Credit Act (‘CCA’). A liability has been
recognised within ‘Other liabilities’ for the repayment of
interest to customers where annual statements did not
remind them of their right to partially prepay the loan,
notwithstanding that the customer loan documentation
did include this right. There is uncertainty as to whether
other technical requirements of the CCA have been met,
for which we have assessed an additional contingent
liability. For further details see Note 27 on the Financial
Statements.
Other operational risks included:
• fraud risks: the threat of fraud perpetrated by or
against our customers, especially in retail and
commercial banking, may grow during adverse
economic conditions. We increased monitoring,
analysed root causes and reviewed internal controls
to enhance our defences against external attacks and
reduce the level of loss in these areas. In addition,
Group Security and Fraud Risk worked closely with
the global businesses to continually assess these
threats as they evolved and adapt our controls to
mitigate these risks;
• level of change creating operational complexity:
the Global Risk function is engaged with business
management in business transformation initiatives
to ensure robust internal controls are maintained,
including through participation in all relevant
management committees. The Global Transactions
Team has developed an enhanced risk management
framework to be applied to the management of
disposal risks;
• information security: the security of our information
and technology infrastructure is crucial for
maintaining our banking applications and processes
while protecting our customers and the HSBC brand.
A failure of the control framework which protects this
could have implications for the wider financial sector
and result in direct financial loss, and / or the loss of
customer data and other sensitive information which
could undermine both our reputation and our ability
to retain the trust of our customers. Programmes of
work have been ongoing to strengthen internal
security controls to prevent unauthorised access to
our systems which may affect live services or facilitate
data loss or fraud. In common with other banks and
multinational organisations, we continue to be a
target of increasingly sophisticated ‘cyber’ attacks
such as Distributed Denial of Service attacks which
affect the availability of customer-facing websites. In
addition, reliance on standard internet technologies,
protocols and services means we are subject to wide-
scale remediation when flaws are reported in these
technologies. Lessons learnt from attacks experienced
within the industry and information sharing with
other financial institutions, government agencies and
external intelligence providers allows us to develop a
better understanding of our own susceptibilities and
to develop scenarios to test against. They will
continue to be a focus of ongoing initiatives to
strengthen the control environment. Significant
investment has already been made in enhancing
controls around data access, the heightened
monitoring of potential cyber-attacks and continued
training to raise staff awareness. This is an area that
will require continual investment in our operational
processes and contingency plans;
• vendor risk management: we continue to focus on
the management of vendor risks including making