(Sept 4): UK regulators have ordered HSBC Holdings Plc to review how it collects and monitors the vast reams of data that underpin the firm’s risk management systems within investment banking and trading.

The Bank of England’s Prudential Regulation Authority instructed the bank to commission a section 166 review of its data practices within commercial banking as well as global banking and markets, according to a person familiar with the matter. These reviews force a firm to bring in an outside expert to examine their practices and produce an independent report for the authorities.

A spokesperson for the PRA and a representative for HSBC declined to comment.

The latest review comes three years after regulators flagged shortcomings within nine areas of HSBC’s risk management capabilities, according to documents seen by Bloomberg. In response to that earlier action, HSBC developed a plan to fix those deficiencies by next year called “Risk 2025.”

But with just months to go, the PRA has found that HSBC still has weaknesses in four key areas — model risk, risk data quality, traded risk and credit risk. By ordering the newest skilled person review, the PRA is hoping the outside expert will deliver a report on HSBC’s plans to address deficiencies within its wholesale credit risk and traded risk practices specifically.

The regulator expects the report to assess how clearly HSBC has articulated its expectations on data practices to front office bankers and traders as well as their opinion on how adequate HSBC’s plans are for addressing those two areas.

It’s unclear what, if any, outcomes the review will have at this time. These inquiries can lead to reports recommending changes, which in some cases can prove large-scale and expensive.

This isn’t the first time this year that HSBC has been in the Prudential Regulation Authority’s crosshairs. In January, the watchdog saddled the bank with £57.4 million (US$75.3 million or RM327 million) in penalties for incorrectly excluding billions of pounds of its customers’ money from a depositor protection programme.

The fine was the second-biggest penalty the regulator had ever handed out and reflected “the seriousness of the failings” that occurred between 2015 and 2022, the PRA said at the time.

Uploaded by Magessan Varatharaja