Page 2

The Risk function

The Risk function provides oversight and challenge on the Group's risk management, ensuring that business is conducted in line with regulatory expectations. The GCRO directly manages the Risk function, which is independent from the origination, trading, and sales functions of the businesses. The Risk function is responsible for:

• proposing the RA for approval by the Board

• maintaining the ERMF, ensuring that it remains relevant and appropriate to the Group's business activities, and is effectively communicated and implemented across the Group

• ensuring that risks are properly assessed, risk and return decisions are transparent and risks are controlled in accordance with the Group's standards and RA

• overseeing and challenging the management of PRTs under the ERMF

• independence of the Risk function by ensuring that the necessary balance in making risk and return decisions is not compromised by short-term pressures to generate revenues.

The Risk function supports the Group's strategy by building a sustainable ERMF that places regulatory and compliance standards, together with culture of appropriate conduct, at the forefront of the Group's agenda.

Our Compliance, Financial Crime and Conduct Risk (CFCR) function,³ works alongside the Risk function within the ERMF to deliver a unified second line of defence. Compliance Risk and Financial Crime Risk, as PRTs, fall under the scope of the CFCR's responsibilities.

Three lines of defence model

The Group applies a three lines of defence model to its day-to-day activities for effective risk management, and to reinforce a strong governance and control environment. Typically:

• Businesses and functions engaged in or supporting revenue generating activities that own and manage risks constitute the first line of defence.

• Control functions, independent of the first line of defence, that provide oversight and challenge of risk management activities act as the second line of defence.

• Internal Audit acts as the third line of defence, providing independent assurance on the effectiveness of controls supporting the activities of the first and second lines of defence.

Each PRT has an RTF which outlines the areas of governance and risk management and is the formal mechanism through which authorities are delegated. Risk management plans, processes, activities, and resource allocations are consistent with the three lines of defence model prescribed by the ERMF.

Risk identification and assessment

Identification and assessment of potentially adverse risk events is an essential first step in managing the risks of any business or activity. To ensure consistency we use PRTs to classify our risk exposures. However, we also recognise the need to maintain a holistic perspective since:

• a single transaction or activity may give rise to multiple types of risk exposure

• risk concentrations may arise from multiple exposures that are closely correlated

• a given risk exposure may change its form from one risk type to another.

There are also sources of risk that arise beyond our own operations, such as the Group's dependency on suppliers for the provision of services and technology.

As the Group remains accountable for risks arising from the actions of such third parties, failure to adequately monitor and manage these relationships could materially impact the Group's ability to operate.

3  From 1 January 2025, our Conduct, Financial Crime and Compliance (CFCC) function was renamed as Compliance, Financial Crime and Conduct Risk (CFCR).

Page 3

The Group maintains a taxonomy of risks inherent to the strategy and business model, as well as a risk inventory which captures identified risks, including the Topical and Emerging Risks (TERs) to which the Group is or might be exposed to. Multiple identification and assessment techniques are used to ensure breadth and depth of understanding of the internal and external risk environment, as well as potential opportunities. A risk assessment of the corporate plan is undertaken annually, supplemented by risk assessments of new initiatives. Risk identification findings inform the related risk oversight process, and most importantly RA and controls setting, scenario selection and design, and model refinement and development.

The GCRO and the Group Risk Committee (GRC) regularly review reports on the risk profile for the PRTs, adherence to Group RA, stress test results and the Group risk inventory including TERs.

Risk Appetite and profile

The Group recognises the following constraints which determine the risks that we are willing to take in pursuit of our strategy and the development of a sustainable business:

• Risk capacity is the maximum level of risk the Group can assume, given its current capabilities and resources, before breaching constraints determined by capital and liquidity requirements or the internal operational environment, or otherwise failing to meet the expectations of regulator and law enforcement agencies.

• RA is defined by the Group and approved by the Board. It is the boundary for the risk that the Group is willing to undertake to achieve its strategic objectives and corporate plan. We set RA to enable us to grow sustainably while managing our risks, giving confidence to our stakeholders. The Group RA is supplemented by risk control tools such as granular level limits, policies, and standards to maintain the Group's risk profile within approved RA.

The Board is responsible for approving the RA Statements, which are underpinned by a set of financial and operational control parameters known as RA metrics and their associated thresholds. These set boundaries for the aggregate risk exposures that can be taken across the Group.

The Group RA is reviewed bi-annually to ensure that it is fit for purpose and aligned with strategy, with focus given to new or emerging risks.

Risk Appetite Statement

The Group's objective is to not compromise adherence with its RA in order to pursue revenue growth or higher returns.

See the table for the set of RA Statements.

Stress testing

The objective of stress testing is to support the Group in assessing that it:

• does not have exposure to excessive risk concentrations that could produce unacceptably high losses under severe but plausible scenarios

• has sufficient financial resources to withstand severe but plausible scenarios

• has the financial flexibility to respond to extreme but plausible scenarios

• understands key business model risks and considers what kind of event might crystallise those risks - even if extreme and with a low likelihood of occurring

• identifies, as required, actions to mitigate the likelihood or impact of those events

• has set RA metrics at appropriate levels.

Enterprise stress tests incorporate capital and liquidity adequacy stress tests, including recovery and resolution, as well as reverse stress tests.

Stress tests are performed at the Group, country, business, and portfolio level under a wide range of risks and at varying degrees of severity. Unless specifically set by the regulator, scenario design is a bespoke process that aims to explore risks that can adversely impact the Group.

The Board delegates approval of the Bank of England (BoE) stress test submissions to the Board Risk Committee (BRC), which reviews the recommendations from the GRC. Based on the stress test results, the Group Chief Financial Officer (GCFO) and GCRO can recommend strategic actions to the Board to ensure that the Group's strategy remains within RA.

Page 4

In addition, analysis is run at the PRT level to assess specific risks and concentrations that the Group may be exposed to. These include qualitative assessments such as stressing of credit sectors or portfolios, and quantitative assessments such as potential losses from severe but plausible market risk scenarios or internal stressed liquidity metrics.

Stress testing plays a critical role in assessing the potential impact on portfolio values of extreme but plausible scenarios, leading to potential losses typically much larger than those predicted by the Value at Risk (VaR) model. The Group uses historical and forward-looking scenarios. A common set of scenarios is used across all legal entities complemented in some cases with entity-specific scenarios. RA for market risk stress losses is set at the Group as well as legal entity level.

Non-financial risk types are also stressed to assess the necessary capital requirements under the Operational and Technology RTF.

The Group has also undertaken a number of Climate Risk stress tests, both those mandated by regulators as well as management scenarios.

Principal Risk Types

PRTs are those risks that are inherent in our strategy and business model and have been formally defined in the Group's ERMF. These risks are managed through distinct RTFs which are approved by the GCRO.

The PRTs and associated RA Statements are reviewed annually. The table below shows the Group's current PRTs, their definition and RA Statement.

4      Fraud forms part of the Financial Crime RA Statement but, in line with market practice, does not apply a zero-tolerance approach.

Page 5

As of November 2024, the Climate Risk RA Statement was integrated into the ESGR PRT.

ERMF effectiveness reviews

The GCRO is responsible for annually affirming the effectiveness of the ERMF to the BRC via an effectiveness review. This review is based on the principle of evidence-based self-assessments for all the RTFs and relevant policies. A top-down review and challenge of the results is conducted by the GCRO with all RFOs and an opinion on the internal control environment is provided by Internal Audit.

The ERMF effectiveness review measures year-on-year progress. The key outcomes of the 2024 review are:

• Continued focus on embedding the ERMF across the organisation.

• Financial risks continue to be effectively managed, and the Group is making good progress in embedding non-financial risk management.

• Self-assessments performed in branches and banking subsidiaries reflect the embeddedness of the ERMF. Country and cluster risk committees continue to play an active role in overseeing and managing risks across our footprint markets.

Ongoing effectiveness reviews allow for a structured approach to identify improvement opportunities and build plans to address them.

In 2025, the Group aims to further strengthen its risk management practices by improving the management of non-financial risks within its businesses, functions and across our footprint. As the regulatory environment continuously changes, the Group constantly monitors regulatory developments and take proactive actions for compliance.

Executive and Board risk oversight

Overview

The corporate governance and committee structure helps the Group to conduct our business. The Board has ultimate responsibility for risk management and approves the ERMF based on the recommendation of the BRC, which also recommends the Group RA Statement for all PRTs and other risks. In addition to the BRC and Audit Committee, the Culture and Sustainability Committee oversees the Group's culture and key sustainability priorities.

Group Risk Committee

The GRC, which derives its authority from the GCRO, is responsible for ensuring the effective management of risk throughout the Group in support of the Group's strategy. The GCRO chairs the GRC, whose members are drawn from the Group Management Team. The GRC oversees the effective implementation of the ERMF for the Group, including the delegation of any part of its authorities to appropriate individuals or sub-committees.

Page 6

Group Asset and Liability Committee

The Group Asset and Liability Committee (GALCO) is chaired by the GCFO. Its members are drawn principally from the Management Team. GALCO is responsible for determining the Group's balance sheet strategy and ensuring that, in executing the Group's strategy, the Group operates within RA and regulatory requirements relating to capital, loss-absorbing capacity, liquidity, leverage, Interest Rate Risk in the Banking Book (IRRBB), Banking Book Basis Risk and Structural Foreign Exchange Risk. It also monitors the structural impact of decisions around sustainable finance, net zero and climate risk. GALCO is also responsible for ensuring that internal and external recovery planning requirements are met.

Page 7

Principal risks

We manage and control our PRTs through distinct RTFs, policies and RA.

Changes impacting PRTs in 2024

In May 2024, to further align with our risk strategy and promote consistency and efficiency, the Operational and Technology Risk and Information and Cyber Security Risk teams were unified under the Operational, Technology and Cyber Risk (OTCR) function. The PRT disclosures and RA Statements for ICS Risk and Operational and Technology Risk remain separate.

Following Tracey McDermott's retirement as Group Head, Conduct, Financial Crime and Compliance at the end of 2024, David Howes has been appointed as Group Head, Compliance, Financial Crime and Conduct Risk (CFCR) from 1 January 2025 and will assume Senior Manager responsibilities for Financial Crime, including the Group Entity Senior Manager Function, Compliance Oversight Function (SMF16) and Money Laundering Reporting Officer (MLRO) role (SMF 17).

Credit Risk

Mitigation

Segment-specific policies are in place for Corporate & Investment Banking (CIB) and Wealth & Retail Banking (WRB) which set the principles that must be followed for the end-to-end credit process covering initiation, assessment, documentation, approval, monitoring and governance.

The Group also sets out standards for the eligibility, enforceability, and effectiveness of mitigation arrangements. Potential losses are mitigated using a range of tools, such as collateral, netting agreements, credit insurance, credit derivatives and guarantees.

Risk mitigants are carefully assessed for their market value, legal enforceability, correlation, and counterparty risk of the protection provider. Collateral is valued prior to drawdown and regularly thereafter as required, to reflect current market conditions, the probability of recovery and the period of time to realise the collateral in the event of liquidation. The Group also seeks to diversify its collateral holdings across asset classes and markets.

Where guarantees, credit insurance, standby letters of credit or credit derivatives are used as Credit Risk mitigation, the creditworthiness of the protection provider is assessed and monitored using the same credit process applied to the obligor.

Monitoring

The Group regularly monitors credit exposures, portfolio performance, external trends and emerging risks that may impact risk management outcomes. Internal risk management reports that are presented to risk committees contain information on key political and economic trends across major portfolios and countries, portfolio delinquency and loan impairment performance.

In CIB, clients and portfolios are subject to additional review when they display signs of actual or potential weakness; for example, where there is a decline in the client's position within their industry, financial deterioration, a breach of covenants, or non-performance of an obligation within the stipulated period. Such accounts are subject to a dedicated process overseen by the Credit Issues Committee in the relevant countries where client account strategies and credit grades are re-evaluated. In addition, remedial actions can be undertaken, such as placing accounts on early alert for exposure reduction, security enhancement or exiting the account. Credit-impaired accounts are managed by the Group's specialist recovery unit, Stressed Asset Group (SAG), which is independent of the Client Coverage/Relationship Managers. The Stressed Asset Risk (SAR) Group is the second line risk unit.

On an annual basis, senior members from the CIB business and Risk participate in a more extensive portfolio review (known as the 'industry portfolio review') for certain industry groups. In addition to a review of the portfolio information, this industry portfolio review incorporates industry outlook, key elements of the business strategy, RA, credit profile and emerging and horizon risks. A summary of these industry portfolio reviews is also shared with the CIB Financial Risk Committee.

Page 8

For WRB, exposures and collateral monitoring are performed at the counterparty and/or portfolio level across different client segments to ensure transactions and portfolio exposures remain within RA. Portfolio delinquency trends are also monitored. Accounts that are past due (or perceived as high risk but not yet past due) are subject to collections or recovery processes managed by a specialist independent function. In some countries, aspects of collections and recovery activities are outsourced. For discretionary lending portfolios, similar processes to those of CIB are followed.

Any material in-country developments that may impact sovereign ratings are monitored closely by Country Risk within the ERM function. The Country Risk Early Warning system, a triage-based risk identification system, categorises countries based on a forward-looking view of possible downgrades and the potential incremental risk-weighted assets (RWA) impact.

In addition, an independent Credit Risk review team within the ERM function performs assessments of the Credit Risk profiles at various portfolio levels. They focus on selected countries and segments through deep dives, comparative analysis, and review and challenge of the basis of credit approvals. The review aims to ensure that the evolving Credit Risk profiles of CIB and WRB are well managed within RA and policies. Results of the reviews are reported to the GRC and BRC.

Credit rating and measurement

All credit proposals are subject to a robust credit risk assessment. It includes a comprehensive evaluation of the client's credit quality, including willingness, ability, and capacity to repay. The primary lending consideration for counterparties is based on their credit quality and operating cash flows, while for individual borrowers it is based on personal income or wealth. The risk assessment gives due consideration to the client's liquidity and leverage position.

Where applicable, the assessment includes a detailed analysis of the Credit Risk mitigation arrangements to determine the level of reliance on such arrangements as the secondary source of repayment in the event of a significant deterioration in a client's credit quality leading to default. Client income, net worth, and the liquidity of asset by class are considered for overall risk assessment for wealth lending. Wealth lending credit limits are subject to the availability of qualified collateral.

A standard alphanumeric Credit Risk grade system is used for CIB, whereby credit grades 1 to 12 are assigned to performing customers, and credit grades 13 and 14 are assigned to non-performing or defaulted customers.

WRB internal ratings-based portfolios use application and behavioural credit scores that are calibrated to generate a probability of default. The Risk Decision Framework uses a credit rating system to define the portfolio/new booking segmentation, shape and decision criteria for the unsecured consumer business segment.

Advanced Internal Ratings-Based (AIRB) models cover the majority of our exposures and are used in assessing risks at a customer and portfolio level, setting strategy, and optimising our risk-return decisions. The Model Risk Committee (MRC) approves material internal ratings-based risk measurement models. Prior to review and approval, all internal ratings-based models are validated by an independent model validation team. Reviews are also triggered if the performance of a model deteriorates materially against predetermined thresholds, measured through the ongoing model performance monitoring process.

We adopt the AIRB approach under the Basel regulatory framework to calculate Credit Risk capital requirements for the majority of our exposures. The Group has also established a global programme to assess capital requirements necessary to be implemented to meet the latest revised Basel III regulation (referred to as Basel 3.1 or Basel IV).

Credit Concentration Risk

Credit Concentration Risk for CIB is managed through concentration limits covering large exposure limit to a single counterparty or a group of connected counterparties (based on control and economic dependence criteria), or at portfolio level for multiple exposures that are closely correlated. Portfolio RA metrics are set, where appropriate, by industry, products, tenor, collateralisation level, top clients, and exposure to holding companies.

For concentrations that are material at a Group level, breaches and potential breaches are monitored by the respective governance committees and reported to the GRC and BRC.

Page 9

Credit impairment

For CIB, in line with the regulatory guidelines, Stage 3 expected credit loss (ECL) is considered when an obligor is more than 90 days past due on any amount payable to the Group, or the obligor has symptoms of unlikeliness to pay its credit obligations in full as they fall due. These credit-impaired accounts are managed by SAG.

In WRB, loans to individuals and small businesses are considered credit-impaired as soon as any payment of interest or principal is 90 days overdue or they meet other objective evidence of impairment, such as bankruptcy, debt restructuring, fraud, or death, with unlikely continuation of contractual payments. Financial assets are written off, in the amount that is determined to be irrecoverable, when they meet conditions set such that empirical evidence suggests the client is unlikely to meet their contractual obligations, or a loss of principal is reasonably expected.

Estimating the amount and timing of future recoveries involves significant judgement and considers the assessment of matters such as future economic conditions and the value of collateral, for which there may not be a readily accessible market. The total amount of the Group's impairment provision is inherently uncertain, being sensitive to changes in economic and credit conditions across the markets in which the Group operates.

Underwriting

The underwriting of securities and loans is in scope of the CIB RA. Additional limits approved by the GCRO are set on sectoral concentration and maximum holding period. The Underwriting Committee, under the authority of the GCRO, approves individual proposals to underwrite new security issues and loans for our clients. In July 2024, oversight of the Underwriting Committee was transferred from Traded Risk to CIB Credit Risk.

Traded Risk

Mitigation

Traded Risk limits are defined at a level which aims to ensure that the Group remains within RA. The Traded Risk Policy sets the principles that must be followed for the end-to-end traded risk management process including limit setting, risk capture and measurement, limit monitoring and escalation, risk mitigation and stress testing. Policies are reviewed and approved by the Global Head, Traded Risk Management periodically to ensure their ongoing effectiveness.

Market Risk measurement

The Group uses a VaR model to measure the risk of losses arising from future potential adverse movements in market rates, prices, and volatilities. VaR is a quantitative measure of market risk that applies recent historical market conditions to estimate the potential future loss in market value that will not be exceeded in a set time period at a set statistical confidence level.

VaR provides a consistent measure that can be applied across trading businesses and products over time and can be set against actual daily trading profit and loss outcomes.

For day-to-day risk management, VaR is calculated as at the close of business, generally at UK time for expected market movements over one business day and to a confidence level of 97.5 per cent. Intra-day risk levels may vary from those reported at the end of the day.

The Group applies two VaR methodologies:

• Historical simulation: this involves the revaluation of all existing positions to reflect the effect of historically observed changes in Market Risk factors on the valuation of the current portfolio. This approach is applied for general Market Risk factors and the majority of specific (credit spread) risk factors. The enhanced Volatility Scaling VaR (VSV) model went live in January 2025, where risk factors' returns are scaled to reflect historical volatility. The VSV model is more responsive to volatility changes observed in the market.

• Monte Carlo simulation: this methodology is similar to historical simulation but with considerably more input risk factor observations. These are generated by random sampling techniques, but the results retain the essential variability and correlations of historically observed risk factor changes. This approach is applied for capturing the idiosyncratic credit spread risk factors.

Page 10

As an input to regulatory capital, trading book VaR is calculated for expected movements over 10 business days and to a confidence level of 99 per cent. Some types of market risk are not captured in the regulatory VaR measure and these risks not in VaR are subject to capital add-ons.

Counterparty Credit Risk measurement

A Potential Future Exposure (PFE) model is used to measure the credit exposure arising from the positive mark-to-market of traded products. The PFE model provides a quantitative estimate of future potential movements in market rates, prices, and volatilities at a certain confidence level over different time horizons based on the tenor of the transactions.

The Group applies two PFE methodologies: simulation based, which is predominantly used, and an add-on based PFE methodology.

Monitoring

Traded Risk Management monitors the overall portfolio risk and ensures that it is within specified limits and therefore RA. Limits are typically reviewed twice a year.

All material Traded Risks are monitored daily against approved limits. Traded Risk limits apply at all times unless separate intra-day limits have been set.

Treasury Risk

Mitigation

The Group develops policies to address material Treasury Risks and aims to maintain its risk profile within RA. In order to do this, metrics are set against Capital Risk, Liquidity and Funding Risk and IRRBB. Where appropriate, RA metrics are cascaded down to clusters and countries in the form of limits and management action triggers.

Capital Risk

In order to manage Capital Risk, strategic business and capital plans (Corporate Plan) are drawn up covering a five-year horizon and are approved by the Board annually. The plan ensures that adequate levels of capital, including loss-absorbing capacity, and an efficient mix of the different components of capital are maintained to support our strategy and business plans.

Treasury is responsible for the ongoing assessment of the demand for capital and the updating of the Group's capital plan.

RA metrics including capital, leverage, minimum requirement for own funds and eligible liability (MREL) and double leverage are assessed within the Corporate Plan to ensure that the strategy can be achieved within risk tolerances.

Structural Foreign Exchange (FX) Risk

The Group's structural FX position results from the Group's non-US dollar investment in the share capital and reserves of subsidiaries and branches. The FX translation gains or losses are recorded in the Group's translation reserves with a direct impact on the Group's Common Equity Tier 1 ratio.

The Group contracts hedges to manage its structural FX position in accordance with the RA, and as a result the Group has taken net investment hedges to partially cover its exposure to certain non-US dollar currencies to mitigate the FX impact of such positions on its capital ratios.

Liquidity and Funding Risk

At Group, cluster and country level we implement various business-as-usual and stress risk metrics to monitor and manage Liquidity and Funding risk. This ensures that the Group maintains an adequate and well-diversified liquidity buffer, as well as a stable funding base, to meet its liquidity and funding regulatory requirements.

The risk management approach and RA are assessed annually through the Internal Liquidity Adequacy Assessment Process. A funding plan is also developed for efficient liquidity projections to ensure that the Group is adequately funded in the required currencies, to meet its obligations and client funding needs. The funding plan is part of the overall Corporate Plan process aligning to the capital requirements.

Page 11

Interest Rate Risk in the Banking Book

This risk arises from differences in the repricing profile, interest rate basis, and optionality of banking book assets, liabilities and off-balance sheet items. IRRBB represents an economic and commercial risk to the Group and its capital adequacy. The Group monitors IRRBB against the RA.

Pension Risk

Pension Risk is the potential for loss due to having to meet an actuarially assessed shortfall in the Group's pension plans. Pension Risk arises from the Group's contractual or other liabilities with respect to its occupational pension plans or other long-term benefit obligation. For a funded plan, it represents the risk that additional contributions will need to be made because of a future funding shortfall. For unfunded obligations, it represents the risk that the cost of meeting future benefit payments is greater than currently anticipated.

The Pension Risk is monitored against the RA and reported to the GRC. The RA metric is calculated as the total capital requirement (including both Pillar 1 and Pillar 2A capital) in respect of Pension Risk, expressed as a number of basis points of RWA.

Recovery and resolution planning

In line with PRA requirements, the Group maintains a Recovery Plan, which is a live document to be used by management in the event of stress in order to restore the Group to a stable and sustainable position. The Recovery Plan includes a set of recovery indicators, an escalation framework, and a set of management actions capable of being implemented during a stress. A Recovery Plan is also maintained within each major entity, and all Recovery Plans are subject to periodic fire-drill testing.

As the UK resolution authority, the BoE set a single point of entry bail-in at the ultimate holding company level (Standard Chartered PLC) as the preferred resolution strategy for the Group. In support of this strategy, the Group has a set of capabilities, arrangements, and resources in place to maintain, test and improve resolution capabilities, and continue to meet the required resolvability outcomes on an ongoing basis.

Following the BoE's first resolvability assessment and public disclosure for major UK firms in 2022, the Group submitted its Resolvability Self-Assessment Report to the BoE and PRA, and subsequently published its resolvability public disclosure in August 2024 as part of the second Resolvability Assessment Framework cycle.

Monitoring

On a day-to-day basis, Treasury Risk is managed by Treasury, Finance and country CEOs. The Group regularly reports and monitors Treasury Risk inherent in its business activities and those that arise from internal and external events.

Internal risk management reports covering the balance sheet and the capital and liquidity position are presented to the relevant country Asset and Liability Committee. The reports contain key information on balance sheet trends, exposures against RA and supporting risk measures which enable members to make informed decisions around the overall management of the balance sheet. In addition, an independent Treasury CRO within ERM reviews the prudency and effectiveness of Treasury Risk management.

Pension Risk is managed by the Head of Pensions and Reward Analytics, and monitored by the Global Head, ERM on a periodic basis.

Operational and Technology Risk

Mitigation

The Operational and Technology RTF sets out the Group's overall approach to the management of Operational and Technology Risk in line with the Group's Operational and Technology RA. This is supported by the Risk and Control Self-Assessment (RCSA), which provides a systematic approach for identification and assessment of operational risks, including design and operation of mitigating controls (applicable to all risks as per the Non-Financial Risk Taxonomy).

The RCSA is used to determine the design and operating effectiveness of each process, and requires:

• the recording of end-to-end processes which deliver our key client journey and business outcomes

Page 12

• the identification of risks to support the achievement of client and business outcomes

• the assessment of inherent risk on the impact to client and business outcomes, and likelihood of occurrence

• the design and monitoring of key controls to effectively and efficiently mitigate prioritised risks within acceptable levels and

• the assessment of residual risk and timely treatment of elevated risks.

Elevated Residual Risks require treatment plans to address the underlying causes and reduce the risks to within the RA.

Monitoring

To deliver services to clients and to participate in the financial services sector, the Group runs processes which are exposed to Operational and Technology risks. The Group prioritises and manages risks which are significant to our clients and to the financial services sectors. The control indicators are regularly monitored to determine the Group's exposure to residual risk.

The residual risk assessments and reporting of events form the Group's Operational and Technology Risk profile. The completeness of the Operational and Technology Risk profile ensures appropriate prioritisation and timeliness of risk decisions, including risk acceptances with treatment plans for risks that exceed acceptable thresholds.

The BRC is informed on adherence to Operational and Technology RA through metrics reported for selected risks. These metrics are monitored, and escalation thresholds are devised based on the materiality and significance of the risk. These Operational and Technology RA metrics are consolidated on a regular basis and reported at the relevant Group committees, providing senior management with the relevant information to inform their risk decisions.

Information and Cyber Security (ICS) Risk

Mitigation

ICS Risk is managed through the ICS RTF, comprising a risk assessment methodology and supporting policy, standards, and methodologies. The ICS Policy and standards are aligned to industry best practice models including the National Institute of Standards and Technology Cyber Security Framework and ISO 27001. We undertake an annual ICS Effectiveness Review to evaluate ICS Risk management practices in alignment with the ERMF.

Monitoring

The Group Chief Information Security Officer (CISO) function monitors the evolving threat landscape covering cyber threats, attack vectors and threat actors that could target the Group. This includes performing a threat-led risk assessment to identify key threats, in-scope applications and key controls required to ensure the Group remains within RA.

The ICS Risk profiles of all businesses, functions and countries are consolidated to present a holistic Group-level ICS Risk profile for ongoing monitoring. Mandatory ICS learning, phishing exercises and role-specific training support colleagues to monitor and manage this risk.

During these reviews, the status of each risk is assessed against the Group's controls to identify any changes to impact and likelihood, which affects the overall risk rating.

The Group stress tests its cyber posture through extensive control testing and by executing offensive security testing exercises, including vulnerability testing, code reviews, penetration tests and Red Team attack simulation testing. This testing approach constantly stress tests the Group's defence and approach to cyber security. These show a wider picture of the Group's risk profile, leading to better visibility on potential 'in flight' risks. The Group also tracks remediation of security matters identified by external reviews, such as the BoE CBEST Threat Intelligence-Led Assessment and the Hong Kong Monetary Authority's (HKMA) Intelligence-led Cyber Attack Simulation Testing (iCAST).

The CISO and OTCR functions monitor the ICS Risk profile and ensure that breaches of RA are escalated to the appropriate governance committee or authority levels for remediation and tracking.

Page 13

Financial Crime Risk

Roles and responsibilities

The Group Head, CFCR is the Group's Compliance and Money-Laundering Reporting Officer and performs the Financial Conduct Authority (FCA) controlled function and senior management function in accordance with requirements set out by the FCA, including those set out in their handbook on systems and controls.

Mitigation

The CFCR function is responsible for the establishment and maintenance of policies, standards, and oversight of first line of defence controls to ensure continued compliance with financial crime laws and regulations, and the mitigation of Financial Crime Risk. In this, the requirements of the Operational and Technology RTF are followed to ensure a consistent approach to the management of processes and controls.

Financial Crime Risk management is built on a risk-based approach, meaning the risk management plans, processes, activities, and resource allocations are determined according to the level of risk.

Risk mitigation takes place through the process of identification of new and amended regulations and the implementation of necessary process and control changes to address these.

Monitoring

The Group monitors enterprise-wide financial crime risks through the Financial Crime Risk Assessment. This is undertaken annually to assess the inherent financial crime risk exposures and the associated processes and controls by which these exposures are mitigated.

Financial Crime Risk controls are governed in line with the Operational and Technology RTF. The Group has a monitoring and reporting process in place for Financial Crime Risk, which includes escalation and reporting to the CFCR and relevant risk committees.

While not a formal governance committee, the CFCR Oversight Group provides oversight of CFCR risks including the effective implementation of the Financial Crime RTF. It also provides oversight, challenge and direction to CFCR policy owners on material changes and positions taken in CFCR-owned policies, including issues relating to regulatory interpretation and Group's CFCR RA. The Regulatory Change Oversight Forum provides visibility and oversight of material and/or complex large-scale regulatory change emanating from financial services regulators impacting non-financial risks.

Compliance Risk

Roles and responsibilities

All activities that the Group engages in must comply with the relevant country/local specific and extraterritorial regulations.

Compliance Risk includes the risks associated with a failure to comply with all regulations that are applicable to the Group regardless of the issuing regulatory authority. Where Compliance Risk arises, or could arise, from failure to manage another PRT, the oversight and management processes for that specific PRT must be followed, to ensure that effective oversight and challenge of the first line of defence can be provided by the appropriate second line of defence function.

Areas of regulation can be broadly divided into two distinct categories: those issued by financial service regulatory authorities and those issued by non-financial service regulators. The Group is exposed to both categories of regulation, and roles and responsibilities differ depending on the category. For regulations issued by financial services regulatory authorities and other regulators that may issue regulations pertaining to Compliance Risk, CFCR identifies new and amended regulations as and when issued and communicates the relevant regulatory obligations to the country RFO delegate. The areas where CFCR does not act in a second line of defence capacity are specified in the respective RTF with appropriate ownership.

Each of the assigned second line of defence functions have responsibilities, including monitoring relevant regulatory developments from non-financial services regulators at both Group and country levels, policy development, implementation, and validation as well as oversight and challenge of first line of defence processes and controls.

Page 14

Mitigation

The CFCR function is responsible for the establishment and maintenance of policies, standards, and oversight of the first line of defence controls to ensure compliance with laws and regulations, and the mitigation of Compliance Risk. In this, the requirements of the Operational and Technology RTF are followed to ensure a consistent approach to the management of processes and controls.

Monitoring

The monitoring of controls designed to mitigate the risk of regulatory non-compliance in processes is governed in line with the Operational and Technology RTF. Compliance Risk reporting includes escalation and reporting to the CFCR and relevant risk committees.

While not a formal governance committee, the CFCR Oversight Group provides oversight of CFCR, risks including the effective implementation of the Compliance RTF, and oversight, challenge and direction to CFCR policy owners on material changes and positions taken in CFCR-owned policies, including issues relating to regulatory interpretation and the Group's CFCR RA. The Regulatory Change Oversight Forum provides visibility and oversight of material and/or complex large-scale regulatory change emanating from financial services regulators impacting non-financial risks.

Environmental, Social and Governance and Reputational (ESGR) Risk

Mitigation

The ESGR RTF provides the overall risk management approach for Environmental, Social and Governance (ESG) and Reputational risks.

The ESG Risk policy outlines the Group's commitment to integrating ESG considerations into its business, operations, and decision-making process. The policy sets out the requirements for identifying, assessing, and managing ESG risks, including Climate Risk.

The Reputational Risk policy sets out the principal sources of reputational risk driven by negative shifts in stakeholder perceptions, as well as the responsibilities for managing Reputational Risk arising out of client onboarding and due diligence, from transactions, product design and product features, or strategic coverages such as exposure to sensitive industries, markets, or investments. Whenever potential for stakeholder concerns is identified, issues are subject to review and decision by both the first and second lines of defence. The Reputational Risk policy also sets out the key considerations for mitigating greenwashing risk that can arise during product and/or deal lifecycle, sustainability reporting and disclosures, and external campaigns related to sustainability themes.

Monitoring

Exposure to reputational risks arising from transactions, clients, products and strategic coverage is monitored through established triggers to prompt the appropriate risk-based considerations and assessment by the first line of defence and escalations to the second line of defence. Risk acceptance decisions and thematic trends are also reviewed on a periodic basis.

Exposure to ESG Risks is monitored through triggers embedded within the first line of defence processes. The environmental and social risks are considered for clients and transactions via Environmental and Social Risk Assessments and/or Climate Risk Assessments (CRAs). Vendors that are presenting as high risk are assessed for modern slavery risk. Based on responses provided by the supplier at onboarding, those that meet the high-risk category-country combinations are subjected to further risk assessment.

Exposure to Climate Risk is monitored in conjunction with other PRTs. We have embedded qualitative and quantitative climate considerations into the Group's Credit Underwriting Principles for Oil and Gas, Mining, Shipping, Commercial Real Estate and Project Finance portfolio. We have expanded coverage of Climate and Credit Risk considerations to physical collateral, as they serve as key risk mitigants, especially in default events. We assess physical risk concentrations for our WRB portfolio on a quarterly basis and assess the physical risk vulnerabilities of our sites periodically and when new sites are onboarded.

Page 15

Our Net Zero Climate Risk Working Forum meets quarterly to discuss account plans for high climate risk and net zero divergent clients. Stress testing and scenario analysis are used to assess the impact of ESGR-related risks. The impact on capital requirements has been included in the PLC Group Internal Capital Adequacy Assessment Process. Management information is reviewed at a quarterly frequency and any breaches in RA are reported to the GRC and BRC.

Model Risk

Mitigation

The Model Risk Policy and Standards define requirements for model development, validation, implementation and use, including regular model performance monitoring and, where required, model risk mitigants.

Model deficiencies identified through the development or validation process, or model performance issues identified through ongoing monitoring, are mitigated through respective model risk mitigants. Mitigants include model overlays as either post-model adjustments (PMAs) or management adjustments, model restrictions and potentially a model recalibration or redevelopment, all of which undergo independent review, challenge, and approval. PMAs are used to address observed deficiencies caused from within the model, by adjusting the model output either directly or indirectly (e.g. adjusting parameters). Where a PMA is applied as a mitigant for a model used in Pillar 1 or Pillar 2 calculations or models with material impact on financial accounting disclosures (e.g. IFRS 9), the independent review must be performed by Group Model Validation (GMV) with sign-off from the Model Approver prior to implementation. Management adjustments are used to address issues by applying management decisions without adjusting a direct modelling component.

As with all PRTs, operational controls are used to govern all Model Risk-related processes, with regular risk assessments performed to assess appropriateness and effectiveness of those controls, in line with the Operational and Technology RTF, with remediation plans implemented where necessary. Group Model Risk Policy and Standards also define requirements for deterministic quantitative methods (DQMs) that are used as part of an end-to-end modelled process. DQMs are similar in nature to a model, however the processing component is either purely deterministic or has an element of expert judgement. Unlike a model, there is no use of statistical, economic financial or mathematical theories.

The regulatory framework around Model Risk is continuously evolving, the PRA's Supervisory Statement 1/23 (SS1/23) is an example. The Group proactively monitors regulatory changes to take the required actions timely for compliance. Regarding SS1/23, the Group is currently delivering to a roadmap to compliance, which commenced in 2024 and will continue over the next two years.

Monitoring

The Group monitors Model Risk via a set of RA metrics. Adherence to Model RA and any threshold breaches are reported to the BRC, GRC and MRC. These metrics and thresholds are reviewed twice per year to ensure that threshold calibration remains appropriate, and the themes adequately cover the current risks.

Models undergo regular performance monitoring based on their level of perceived Model Risk, with monitoring results presented, and breaches escalated to the Model Sponsor, Model Owner, GMV and respective MRC or Individual Delegated Model Approvers.

Model Risk management produces Model Risk reports covering the model landscape, which include performance metrics, identified model issues and remediation plans. These are presented for discussion at the Model Risk governance committees on a regular basis.

Page 16

Risk profile

Credit Risk (audited)

Basis of preparation

Unless otherwise stated, the balance sheet and income statement information presented within this section is based on the Group's management view. This is principally the location from which a client relationship is managed, which may differ from where it is financially booked and may be shared between businesses and/or regions. This view reflects how the client segments and regions are managed internally.

Loans and advances to customers and banks held at amortised cost in this 'Risk profile' section include reverse repurchase agreement balances held at amortised cost, per Note 16 Reverse repurchase and repurchase agreements including other similar secured lending and borrowing.

Credit Risk overview

Credit Risk is the potential for loss due to the failure of a counterparty to meet its contractual obligations to pay the Group. Credit exposures arise from both the banking and trading books.

Impairment model

IFRS 9 mandates an impairment model that requires the recognition of expected credit losses (ECL) on all financial debt instruments held at amortised cost, Fair Value through Other Comprehensive Income (FVOCI), undrawn loan commitments and financial guarantees.

Staging of financial instruments

Financial instruments that are not already credit-impaired are originated into stage 1 and a 12-month ECL provision is recognised.

Instruments will remain in stage 1 until they are repaid, unless they experience significant credit deterioration (stage 2) or they become credit-impaired (stage 3).

Instruments will transfer to stage 2 and a lifetime ECL provision is recognised when there has been a significant change in the Credit Risk compared to what was expected at origination.

The framework used to determine a Significant Increase in Credit Risk (SICR) is set out below.

Stage 1

•    12-month ECL

•    Performing

Stage 2

·    Lifetime expected credit loss

·    Performing but has exhibited SICR

Stage 3

•    Credit-impaired

•    Non-performing

Page 17

IFRS 9 ECL principles and approaches

The main methodology principles and approach adopted by the Group are set out in the following table.

Summary of Credit Risk performance

Maximum exposure

The Group's on-balance sheet maximum exposure to Credit Risk increased by $25 billion to $823 billion (31 December 2023: $798 billion). Cash and balances at Central banks decreased by $6.5 billion to $63 billion (31 December 2023: $70 billion) due to reduced placements. Loans to banks held at amortised cost decreased by $1.4 billion to $44 billion (31 December 2023: $45 billion). Fair value through profit and loss increased by $27.8 billion to $172 billion (31 December 2023: $144 billion), largely due to increases in debt securities and reverse repos, but this was partially offset by a $16.7 billion reduction in debt securities not held at fair value through profit and loss. Loans and advances to customers decreased by $5.9 billion to $281 billion (31 December 2023: $287 billion), due to a reduction in mortgages in Korea, Singapore and Hong Kong, given continued headwinds, including foreign currency movements. Loans and advances to customers in the CIB segment increased by $7.6 billion, mainly due to the execution of pipeline deals in Global Banking, but this was offset by a $7.4 billion decrease in Central and other items. Derivative financial instruments increased by $31 billion to $81 billion (31 December 2023: $50 billion). Off-balance sheet instruments increased by $16 billion to $273 billion (31 December 2023: $257 billion), due to an increase in financial guarantees and other equivalents, which was driven by new business.

Loans and advances

94 per cent (31 December 2023: 94 per cent) of the Group's gross loans and advances to customers remain in stage 1 at $269 billion (31 December 2023: $274 billion), reflecting our continued focus on high-quality origination. For WRB, stage 1 balances decreased by $6.5 billion to $117 billion (31 December 2023: $123 billion), of which $5.9 billion was mainly due to a reduction in the mortgage portfolios in Korea, Singapore and Hong Kong, mainly driven by slower booking momentum and higher attrition as a result of intense interest rate competition. For CIB, stage 1 balances increased by $8 billion to $129 billion (31 December 2023: $121 billion) mainly driven by the Energy, Financing, Insurance and Transport sectors. For Central and other items, stage 1 balances decreased by 6.3 billion to $22 billion (31 December 2023: $28 billion) due to a reduction in exposures to the Government sector, across a number of our markets.

Stage 2 loans and advances to customers decreased by $0.6 billion to $11 billion (31 December 2023: $11 billion). For WRB, stage 2 balances decreased by $0.4 billion to $1.9 billion (31 December 2023: $2.3 billion), due to decrease in the mortgage portfolio. For Central and other items, higher risk exposures decreased by $0.9 billion to $0.1 billion (31 December 2023: $1 billion), was due to the maturity of short-term loan exposures that were replaced with debt securities in Pakistan.

Page 18

Stage 3 loans and advances decreased by $1 billion to $6.2 billion (31 December 2023: $7.2 billion) due to debt sales, repayments, write-offs and upgrades to Stage 2 loans in CIB. WRB stage 3 balances remained broadly stable at $1.6 billion (31 December 2023: $1.5 billion). For Central and other items, stage 3 balances decreased by $0.1 billion to $0.1 billion (31 December 2023: $0.2 billion).

Analysis of Stage 2

The key SICR driver which caused exposures to be classified as stage 2 remains an increase in probability of default (PD). The proportion of CIB exposures in stage 2 decreased due to a reduction in clients placed on non-purely precautionary early alert that have not breached PD thresholds. In WRB, the exposures in stage 2 loans with more than 30 days past due remained stable at $0.3 billion (31 December 2023: $0.3 billion). In Central and other items, the $0.5 billion decrease in CG12 balances to $1.5 billion (31 December 2023: $2 billion) was due to the maturity of short-term loan exposures that were replaced with debt securities in Pakistan. 'Others' category includes exposures where origination data is incomplete and the exposures are allocated into stage 2.

Credit impairment charges

The Group's ongoing credit impairment was a net charge of $547 million (31 December 2023: $508 million).

WRB contributed a net charge of $644 million (31 December 2023: $354 million), driven by a higher interest rate environment impacting repayments on credit cards and personal loans and to a few non-repeating ECL releases recorded in 2023. The increase in impairments was also due to the maturity and portfolio growth of digital partnerships in China and Indonesia, as well as a $21 million overlay arising from the settlement failure of two e-commerce platforms in Korea.

CIB contributed a net release of $106 million (31 December 2023: $123 million charge) due to a number of stage 3 releases and repayments.

Commercial Real Estate (CRE)

The Group provides loans to CRE counterparties of which $8.8 billion is to counterparties in the CIB segment where the source of repayment is substantially derived from rental or sale of real estate and is secured by real estate collateral. The remaining CRE loans comprise working capital loans to real estate corporates, loans with non-property collateral, unsecured loans and loans to real estate entities of diversified conglomerates. The average LTV ratio of the performing book CRE portfolio has increased to 54 per cent (31 December 2023: 52 per cent). The proportion of loans with an LTV greater than 80 per cent has increased to 4 per cent (31 December 2023: 3 per cent).

China CRE

Total exposure to China CRE decreased by $0.6 billion to $2 billion (31 December 2023: $2.6 billion) mainly from exposure reductions. The proportion of credit impaired exposures increased to 70 per cent (31 December 2023: 58 per cent) due to repayments within the non-credit impaired portfolio. The overall provision coverage increased to 87 per cent (31 December 2023: 72 per cent), reflecting increased provision charges during the year. The proportion of the loan book rated as Higher Risk increased to 3 per cent (31 December 2023: 0.3 per cent) primarily due to downgrades during the year.

The Group continues to hold a judgemental management overlay, which decreased by $71 million to $70 million (31 December 2023: $141 million), reflecting repayments and utilisations during the year.

The Group is further indirectly exposed to China CRE through its associate investment in China Bohai Bank.

High carbon sectors

With the Group's expansion in the asset-backed lending business, the total on-and-off balance sheet exposure for the Aviation sector increased to $2.6 billion (31 December 2023: $1.9 billion), while the Shipping sector decreased to $4.6 billion (31 December 2023: $5 billion). The Group's position statements mandates that for newer vessels and aircraft, only carbon efficient ones can be financed.

While exposures to the Oil and Gas sector increased to $21 billion (31 December 2023: $20 billion) due to increased funding towards more emissions-efficient counterparties, exposures to the Power sector increased to $11 billion (31 December 2023: $9 billion) due to increased lending to renewables and efficient gas generation counterparties.

Page 19

Maximum exposure to Credit Risk (audited)

The table below presents the Group's maximum exposure to Credit Risk for its on-balance sheet and off-balance sheet financial instruments as at 31 December 2024, before and after taking into account any collateral held or other Credit Risk mitigation.

1      Amounts are net of ECL provisions. An analysis of credit quality is set out in the credit quality analysis section. Further details of collateral held by client segment and stage are set out in the collateral analysis section. The Group also has credit mitigation through Credit Linked Notes as set out below

2      Excludes equity and other investments of $994 million (31 December 2023: $992 million). Further details are set out in Note 13 financial instruments

3      Excludes equity and other investments of $5,486 million (31 December 2023: $2,940 million). Further details are set out in Note 13 financial instruments

4   The Group enters into master netting agreements, which in the event of default result in a single amount owed by or to the counterparty through netting the sum of the positive and negative mark-to-market values of applicable derivative transactions

5      Other assets include Hong Kong certificates of indebtedness, cash collateral, and acceptances, in addition to unsettled trades and other financial assets

6      Excludes ECL provisions of $255 million (31 December 2023: $227 million) which are reported under Provisions for liabilities and charges

7      Collateral capped at maximum exposure (over-collateralised)

8      Adjusted for over-collateralisation, which has been determined with reference to the drawn and undrawn component as this best reflects the effect on the amount arising from expected credit losses

9   The amount is after ECL. provisions. Further details are set out in Note 21 Assets held for sale and associated liabilities

Page 20

Analysis of financial instruments by stage (audited)

The table below presents the gross and credit impairment balances by stage for the Group's amortised cost and FVOCI financial instruments as at 31 December 2024.

1      Gross carrying amount for off-balance sheet refers to notional values

2      These instruments are held at fair value on the balance sheet. The ECL provision in respect of debt securities measured at FVOCI is held within the OCI reserve

3      These are off-balance sheet instruments. Only the ECL is recorded on-balance sheet as a financial liability and therefore there is no "net carrying amount". ECL allowances on off-balance sheet instruments are held as liability provisions to the extent that the drawn and undrawn components of loan exposures can be separately identified. Otherwise they will be reported against the drawn component

4      Stage 1 ECL is not material

5      Stage 3 gross includes $59 million (31 December 2023: $80 million) originated credit-impaired debt securities with impairment of $Nil million (31 December 2023: $14 million)

Page 21

1      Gross carrying amount for off-balance sheet refers to notional values

2      These instruments are held at fair value on the balance sheet. The ECL provision in respect of debt securities measured at FVOCI is held within the OCI reserve

3      These are off-balance sheet instruments. Only the ECL is recorded on-balance sheet as a financial liability and therefore there is no "net carrying amount". ECL allowances on off-balance sheet instruments are held as liability provisions to the extent that the drawn and undrawn components of loan exposures can be separately identified. Otherwise they will be reported against the drawn component

4      Stage 1 ECL is not material

5      Stage 3 gross includes $80 million originated credit-impaired debt securities with impairment of $14 million

Credit quality analysis (audited)

Credit quality by client segment

For CIB, exposures are analysed by credit grade (CG), which plays a central role in the quality assessment and monitoring of risk. All loans are assigned a CG, which is reviewed periodically and amended in light of changes in the borrower's circumstances or behaviour. CGs 1 to 12 are assigned to stage 1 and stage 2 (performing) clients or accounts, while CGs 13 and 14 are assigned to stage 3 (credit-impaired) clients. Consumer and Business Banking portfolios are analysed by days past due and Private Banking by the type of collateral held.

Mapping of credit quality

The Group uses the following internal risk mapping to determine the credit quality for loans.

1      For Private Banking, classes of risk represent the type of collateral held. Class I represents facilities with liquid collateral, such as cash and marketable securities. Class II represents unsecured/partially secured facilities and those with illiquid collateral, such as equity in private enterprises. Class III represents facilities with residential or commercial real estate collateral. Class IV covers margin trading facilities

2      Banks' rating: AAA/AA+ to BB+/BB. Sovereigns' rating: AAA to BB+

3      Banks' rating: BB to "CCC+ to C". Sovereigns' rating: BB+/BB to B-/CCC+

4      Wealth & Retail Banking excludes Private Banking. Medium enterprise clients within Business Banking are managed using the same internal credit grades as CIB