HSBC Continental Europe SA

Governance roles

Reference: pages 58-59. The ESRS content index lists GOV-1 under "Governance of sustainability matters".

At 31 December 2025 the Board of Directors had 11 members, one executive and ten non-executive; six were women (55 per cent) and five men (page 58). General Management is three Effective Managers, the CEO and two Deputy CEOs, all men. The CEO stepped down on 31 December 2025 and a Deputy CEO became CEO ad interim from 1 January 2026 (page 58).

• The Board "holds collective responsibility for overseeing sustainability matters", set out in its terms of reference, and is updated at its quarterly meetings (page 59).
• The CEO delegates sustainability responsibilities to three functions: the Head of ESG Execution (ESG strategy and transformation), the CFO (sustainability reporting) and the CRO (sustainability risks) (page 59).
• Two executive forums carry the work: the Sustainability Execution Group, chaired by the CEO and the Head of ESG Execution, and the ESG Disclosures Steering Committee, chaired by the CFO (page 59).
• Expertise: a non-executive director appointed in October 2024 brings sustainability reporting experience, including with EFRAG, and sits on the Audit Committee (page 59). Board independence is cross-referred to the Corporate Governance Report (page 58).

Information provided to the governance bodies

Reference: pages 50, 59.

The Board, General Management and Operating Committee (OpCo) members "receive updates on sustainability-related topics from the relevant business owners and functions formally during their regular meetings", and where relevant these include the views and interests of affected stakeholders (page 50).

• Key Management Information on climate and nature risks is reported quarterly to the Sustainability Execution Group and semi-annually to the Risk Management Meeting (page 59).
• Sustainability-related risk indicators, each with an appetite and tolerance threshold, are reported quarterly to the Sustainability Execution Group, the Risk Management Meeting and the Risk Committee (page 59).
• General Management followed the double materiality assessment through workshops, the ESG Disclosures Steering Committee, the Sustainability Execution Group and the OpCo, informed the Board of the process, and submitted the final list of material IROs, which the Board approved (page 59).
• Board members receive mandatory training and nature-related upskilling (pages 59, 77).

Sustainability in incentive schemes

Reference: page 60 (the index lists GOV-3 under "Integrating sustainability criteria into compensation"). Related: pages 85, 88.

All OpCo members, including General Management, are assigned collective or individual objectives in their annual scorecards (page 60):

• A goal on clients and people, weighted 10 per cent, covering employee engagement, an inclusion index outcome, attrition of high performers and talent development.
• A goal on financial performance, weighted 10 per cent, that includes supporting the HSBC Group net zero ambition through energy consumption reduction, business travel emissions reduction and completing environmental training.

The statement says "There is no fixed percentage of remuneration tied to these targets", which are among the criteria in an overall performance assessment (page 60). For staff in France, the 2025 profit-sharing agreement has an environmental component for the fourth consecutive year (page 60). All staff were assigned an objective to complete at least three of 11 climate-related training modules on nature and biodiversity, which feeds the performance rating that affects pay decisions (page 60). Inclusion and engagement objectives sit in OpCo scorecards (page 88).

Statement on due diligence

Reference: page 65.

HSBC Continental Europe states that it "has conducted thorough due diligence process for all the disclosures presented in the Sustainability Statement" and maps the core elements of due diligence to sections of the statement (page 65):

• Embedding due diligence in strategy and business model: page 46.
• Engaging with affected stakeholders: page 49.
• Identifying and assessing adverse impacts: page 50.
• Taking actions and tracking effectiveness: pages 69, 71, 86, 88, 93 and 98.

The statement opens by saying due diligence "is integral to HSBC Continental Europe operations" (page 65). The table is a map to other sections, not a separate process description.

Risk management and internal controls over sustainability reporting

Reference: pages 57-58. The text points to the Risk Management Framework section on page 125.

Sustainability reporting has been placed in the risk taxonomy under financial and regulatory reporting risk, to manage the risk of misstatement from errors in interpretation and judgement (page 57). Risk is assessed on an inherent basis (the most significant scenario in the next 12 months, ignoring controls) and a residual basis, using the HSBC Risk Prioritisation Matrix (pages 57-58).

The Bank is open about the weaknesses (page 58). Its internal processes for ESG disclosure "are in the process of being developed and currently rely on manual sourcing and categorisation of data". The main risks it names are data availability, quality and accuracy, and interpretation of new requirements.

Oversight forums named: the Audit Committee, the Risk Management Meeting, the ESG Disclosure Steering Committee, the Sustainability Execution Group and the Prudential Policy Interpretation Working Group, with the CFO and CRO attending (page 58). Enhanced verification covers the first, second and third lines of defense (page 58).

Strategy, business model and value chain

Reference: pages 46-50.

HSBC Continental Europe is the HSBC Group's Intermediate Parent Undertaking for the European Union and describes itself as a 99.9 per cent owned subsidiary of the Group (pages 46, 48). It is transforming to be "the leading corporate and institutional bank for international clients in Europe" (page 46).

• Business lines: Corporate and Institutional Banking, and International Wealth and Premier Banking (asset management and private banking, plus insurance and retail banking in Malta), with a Corporate Centre (page 47).
• Footprint: the Paris hub, branches in Belgium, Czech Republic, Germany, Ireland, Italy, Luxembourg, Netherlands, Poland, Spain and Sweden, and banking subsidiaries in Malta and Luxembourg (page 47).
• Products: deposit accounts, loans, payment solutions, trade finance, asset management, insurance, and green, social and sustainability-linked loans and bonds (page 47).
• Scope: businesses sold in 2025, including the life insurance business in France and the retained retail mortgage portfolio, are excluded from the double materiality assessment and this statement (pages 46, 52).
• Value chain inputs, outputs and stakeholders are tabulated on pages 48-49. It states it has no entity-level transition plan under the ESRS (page 47).

Interests and views of stakeholders

Reference: pages 49-52 (the index lists SBM-2 under "Engaging with stakeholders to inform our strategy", page 49).

The statement lists upstream stakeholders (investors, funding providers, rating agencies, industry associations, suppliers, regulators), own-operations stakeholders (workforce, social partners, Board) and downstream stakeholders (customers, distributors, intermediaries, communities) on pages 48-49. A table on pages 49-50 gives each group's interests, engagement channels and purpose, for example the annual Snapshot survey for employees and Transition Engagement Questionnaires for wholesale customers.

For the 2025 double materiality assessment the Bank "engaged with internal SMEs as proxies for the stakeholder groups", and added two groups: financial industry associations and ESG rating agencies (pages 51-52). Engagement was indirect, through interviews or questionnaires with the relationship management, procurement, people, corporate sustainability, compliance and investor relations teams (page 52). Shareholder conversations "inform the approach to disclosures" (page 50).

Material impacts, risks and opportunities

Reference: pages 53-57, 50, 66-67, 75, 83, 93.

HSBC Continental Europe "identified 26 material IROs through the DMA, which include 6 entity specific IROs" (page 53). By standard (pages 53, 66-67, 75, 83, 93):

• E1 climate change: 6 (two negative impacts, three risks, one opportunity).
• E4 biodiversity and ecosystems: 2, both negative impacts.
• S1 own workforce: 7, including inclusion, skills development, adequate wages and active social dialogue as positive impacts, and secure employment and work-life balance as negative impacts.
• G1 business conduct: 5, plus entity-specific rows on sanctions, anti-money laundering and cybersecurity.
• Entity-specific data privacy: consolidated from S1 and S4 (page 53).

Following analysis of current effects, "none of the material risks or opportunities had a material financial effect in the current reporting period" (page 53). Resilience of strategy to climate and nature is covered through scenario analysis and stress testing on pages 54-57. Most climate and nature IROs sit in the downstream value chain, through lending and investing (pages 66, 75).

Process to identify and assess material IROs

Reference: pages 50-52, 65, 66-68, 75-76.

The first double materiality assessment was done in 2024 and updated in 2025, using the 2024 IRO list as a baseline (pages 50-51). Five steps (pages 51-52):

1. Understand the business context and value chain.
2. Identify potentially material matters from ESRS 1 AR 16, SASB, GRI, TCFD, TNFD and the UNEP-FI Impact Radar, benchmarked against peers.
3. Update impacts, risks and opportunities.
4. Assess them in two independent exercises, with internal subject matter experts at IRO level and stakeholder proxies at topic level. Impact is scored on how grave it is, its scope, irremediability and likelihood; financial effect on magnitude and likelihood. Impacts were assessed gross, without mitigating actions, except that likelihood of potential social and business conduct impacts took mitigation into account (page 51).
5. Validate in workshops, then OpCo and Board approval (page 52).

Limits it states: the assessment "focused on direct contractual relationships and did not include the value chain of HSBC Continental Europe's clients and suppliers", with indirect relationships considered only for investments (page 52). Climate and nature use short (to 2026), medium (2027-2035) and long (2036-2050) horizons (page 65). Nature uses the ENCORE tool (page 75).

Disclosure requirements covered by the statement

Reference: pages 60-64.

The Bank "mapped the mandatory disclosure requirements and data points within the ESRS to its material IROs" and states that where no link to a material IRO was found, the information "has not been disclosed" (page 60).

ESRS content index (pages 61-62): ESRS 2 (BP-1 and BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2, MDR-PAT) and four topical standards:

• E1 climate change: E1-1 to E1-6.
• E4 biodiversity and ecosystems: E4-1 to E4-4.
• S1 own workforce: S1-1 to S1-6, S1-8, S1-9, S1-10, S1-14 and S1-16, plus a minimum disclosure on data privacy (entity specific).
• G1 business conduct: G1-1, G1-3 and G1-4, plus minimum disclosures on financial crime and cybersecurity (entity specific).

Pages 63-64 list the data points derived from other EU legislation (ESRS 2 Appendix B) with section and page, using footnotes for "Not applicable for Financial Institutions", "Not applicable during the reporting year", "Adopting phase-in provision" and "Not material as per DMA".

The text says the tables cover "ESRS 2 and the five topical standards", but the index tables show four (E1, E4, S1, G1) and the report does not say which is the fifth. Flagged for review.

Transition plan for climate change mitigation

Reference: pages 66, 47, 69-71.

HSBC Continental Europe has no entity-level transition plan. The statement says it "does not have an entity-level transition plan under the relevant ESRS and continues to review its approach to transition planning" (pages 47, 66).

It instead points to the HSBC Group's Net Zero Transition Plan, updated in November 2025, with the ambition to become a net zero bank by 2050 (page 66). As a material subsidiary it says it contributes through "entity-level actions", listed as customer support and financing (page 69), risk management (page 124), policies (page 69), own operations (page 71) and external partnerships (page 69).

Examples of what sits behind those pointers:

• The Thermal Coal Phase-Out policy: end financing of thermal coal power and mining by 2030 in EU and OECD markets and by 2040 elsewhere (page 69).
• A cumulative USD 152.5 bn contribution to the Group's sustainable finance and investment ambition by 31 December 2025, 31 per cent of the Group's progress (page 70).

No entity-level GHG targets, climate CapEx or locked-in emissions assessment appear in the climate chapter.

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 and SBM-3, where this content is disclosed in the FY2025 report (pages 54-57, 66-68). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Reference: pages 54-57, 66-68.

Climate risks are identified by qualitative and quantitative methods, "including climate scenario analysis and stress testing" (page 67). Material risks: creditworthiness deterioration from transition and physical risk, greenwashing and reputation, and regulatory compliance (pages 66-67).

Scenarios (pages 54-55): five, "internally created using external publicly available scenarios as a reference", including NGFS, IPCC and IEA: Below 2 Degrees, Current Commitments, Net Zero (limiting warming to 1.5°C by 2100), Downside Physical Risk, and Severe Climate Stress (1-in-200 year events to 2030). Warming by 2100 is 4.2°C (Downside Physical Risk), 2.4°C (Current Commitments), 1.7°C (Below 2 Degrees) and 1.5°C (Net Zero); N/A for Severe Climate Stress (page 55).

Scope: focused on downstream financed emissions, mainly credit risk in the wholesale (CIB) lending book, with physical risk modelled for commercial real estate (pages 54-55). Horizons: short to 2027, medium 2028-2030, long 2031-2040 (page 54).

Assumptions and limits: the wholesale non-real-estate methodology "did not consider the potential impacts from climate-related physical risk" (page 57).

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3, where this content is disclosed in the FY2025 report (pages 54-57). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Reference: pages 54-57.

The index places "Testing the resilience of the strategy and business model in relation to climate change" under SBM-3 (page 54).

Results (pages 55-56): modelled outputs suggest the CIB lending portfolio "could see increases in credit losses due to climate change". Impacts stay "relatively muted" in the short and medium term and rise in the long term, most under the Below 2 Degrees scenario. The most affected sectors are power and utilities, oil and gas, and metals and mining, with automotive also hit.

Conclusion (page 56): climate and nature impacts "on their own do not reveal material risks to HSBC Continental Europe's resilience and strategy in the short to medium term", though they could worsen a wider macroeconomic shock.

Uncertainty (page 57): data availability, scenario design and modelling limits, and no standard nature scenario data.

Adaptive capacity (page 56): losses can be mitigated by pursuing new climate-related business and adapting lending portfolios. Stress tests are reported to the Risk Committee (page 54).

Policies related to climate change mitigation and adaptation

Reference: pages 69-71.

The index lists E1-2 under "Addressing climate-related impacts, risks and opportunities through policies and actions" (page 69). HSBC Continental Europe applies HSBC Group sustainability risk policies "where relevant" (page 69):

• Thermal Coal Phase-Out policy: phase out financing of thermal coal power and mining by 2030 in EU and OECD markets and 2040 elsewhere (page 69).
• Energy policy: covers upstream oil and gas, fossil power, hydrogen, renewables, nuclear, biomass and waste-to-energy, with the aim of a net zero portfolio and managing energy-asset risk (page 69).
• Reputational risk, financial reporting risk and wholesale credit risk policies, which carry climate considerations (pages 70-71).
• Asset management: Energy and Thermal Coal policies, and INKA fund exclusion rules on coal and other fossil energy (pages 69-70).

The policies were first published in 2021 and 2022, are reviewed annually and were last updated in November 2025, overseen by senior Group and entity Risk function members (page 69).

Actions and resources in relation to climate change policies

Reference: pages 69-71.

• Customer engagement: Corporate and Institutional Banking ran the annual Transition Engagement Questionnaire with its higher transition risk and largest corporate customers, and uses the answers to engage and find business (page 69). Front-line bankers have insights dashboards (page 69).
• Partnerships: a collaboration with EcoVadis in France to help wholesale customers address Scope 3 emissions, and an expanded ESG Directory of third-party providers (page 69).
• Sustainable finance: significant volumes in ESG bond and sustainable lending mandates (page 69). Cumulative contribution to the Group ambition was USD 152.5 bn at 31 December 2025 (page 70).
• Own operations: a LEED gold target for the new Malta operations center, office space reductions at Coeur Défense (France) and Hansaallee (Germany), and a 2025 travel policy favoring train over air in Germany and France (page 71).
• Suppliers: carbon data gathered through CDP and a second data source for Scope 3 (page 71).

On resources, the statement says actions "are not reliant on specific resources and not attributed to financed emissions reductions" (page 69, note 3). No CapEx or OpEx amounts are given.

Targets related to climate change mitigation and adaptation

Reference: pages 71, 66, 70.

No entity-level climate targets are set. HSBC Continental Europe "continues to review its approach to entity-level targets in line with regulatory expectations or requirements, available guidance, and industry practice" (page 71).

What the statement offers instead:

• The Group's ambition to be net zero by 2050, "which includes its operations", to which the Bank says it contributes (page 71). The Group's updated plan also covers a review of "interim 2030 financed emissions targets" (page 66), which are Group-level.
• Group financed emissions are tracked through risk appetite statements and Key Management Information (page 71).
• The Group's sustainable finance and investment ambition of USD 750 bn to USD 1 trillion by 2030, with a USD 152.5 bn Bank contribution since 2020 (page 70).
• The Bank's own financed emissions method "is not aligned with the HSBC Group methodology", because it widens sector coverage for disclosure rather than for target setting (page 72).

The data-points table marks "GHG emission reduction targets" and "Transition plan to reach climate neutrality by 2050" as "Not applicable during the reporting year" (page 63).

Energy consumption and mix

Reference: page 74.

No nuclear consumption is reported. Data covers France, Germany, Malta and Poland (Poland from 2025) for the 12 months to 30 September, and includes non-consolidated entities that share premises (page 74).

2024 was restated for methodology changes, more data and error corrections: total energy fell by 3,256 MWh, 16 per cent of the figure first reported (page 74). Metered data is used where possible, with estimates from floor area or comparable sites otherwise (page 74). Exposure to sectors that highly contribute to climate change: EUR 20,057 million gross carrying amount (2024: EUR 21,213 million) (page 74).

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 71-73.

Only categories 1, 2, 6 and 15 are reported (page 71). Financed emissions cover the wholesale book, EUR 30.1 billion of drawn balances (page 72), and use industry-average proxies, with 0 per cent primary data (page 73). 2024 financed emissions were restated up by 723,275 tCO2e after method and data updates; 2025 is 4 per cent below the restated figure (page 73).

The auditor draws attention, without qualifying its conclusion, to the financed emissions scope, method changes and data limits (page 101).

Transition plan on biodiversity and ecosystems

Reference: pages 56, 46-47, 74, 77.

The index lists E4-1 under "Strategy, business model and value creation" (page 46) and "Testing the resilience of the strategy and business model in relation to nature risk" (page 56). The statement does not present a stand-alone biodiversity transition plan. It describes the HSBC Group as embedding nature "alongside delivery of its net zero implementation plans" (page 47), and says it "still considers itself at an early stage of understanding and taking actions to address its nature-related impacts" (page 75).

Nature scenario analysis (page 56): three scenarios (Nature Positive, Nature Baseline, Nature Destruction) applied to the wholesale lending portfolio to 2040. Results show limited financial impacts and "do not currently indicate that the current business model and strategy will not remain resilient in respect of nature-related risks". The most exposed sectors are agriculture, power and utilities, and food, beverage and tobacco. The Bank calls the analysis "nascent" because of limited external data (page 56).

Two material nature impacts connect to wholesale lending (page 74).

Policies related to biodiversity and ecosystems

Reference: page 76.

HSBC Continental Europe applies the HSBC Group sustainability risk policies to relevant financing. A new sustainability risk policies framework was developed in 2025. The policies "impose restrictions on certain financing activities that may have material negative impacts on nature" (page 76).

• The Group's forestry and agricultural commodity policies target upstream impacts of palm oil, timber, soy and cattle (page 76).
• Palm oil customers must hold certification under the Roundtable on Sustainable Palm Oil (page 76).
• Financing is restricted in environmentally and socially critical areas: the Amazon Biome, Antarctic, Arctic, Ramsar Wetlands and UNESCO World Heritage Sites (page 76).
• The Bank has guidance for CIB lending on how nature-related physical and transition risks affect credit risk, plus a monitoring process (page 76).

For its own offices, none of the sites has a material negative impact on nature, so no biodiversity mitigation measures were needed (page 76). The Bank says further policy development "may be necessary" (page 76).

Actions and resources related to biodiversity and ecosystems

Reference: page 77.

• Governance: in 2025 the HSBC Group set up a Nature Programme across Group Sustainability, Risk, the business lines and Finance, including the Bank's Sustainability, Business and Risk teams (page 77).
• Client engagement: the Transition Engagement Questionnaire now covers nature and biodiversity alongside climate (page 77).
• Partnerships: funded through the Bank's philanthropic spending, including work with the ONF - Agir pour la Forêt fund on biodiversity conservation programs, employee volunteering and research on forest resilience (page 77).
• Own operations and suppliers: sustainable sourcing roadmaps for support services, IT services and corporate real estate (page 77).
• Training: nature-related risk training for CIB relationship managers and credit advisers, Board upskilling, and a water awareness session for the Board, OpCo and ESG risk staff (page 77).
• Risk management: a nature-related risks approach and scenario capability, though no material nature-related financial risk was identified (page 77).

No monetary resource amounts are stated.

Targets related to biodiversity and ecosystems

Reference: page 77.

No entity-level nature targets are set. The statement says: "At present, HSBC Continental Europe does not have entity-level nature-related targets." It gives the reason as "the nascent nature of this topic for the Bank and the limitations in the quality and availability of nature-related data" (page 77).

The Bank expects to "consider how to set nature-related targets once it has sufficient confidence in the outputs of the analysis" (page 77). In the meantime it "has however implemented Risk Indicators to support the monitoring of any risk associated to the nature" (page 77).

The index still lists E4-4, under the heading "Targets" (page 62), so the entry reports a nil position rather than a numerical target.

Policies related to own workforce

Reference: pages 85-88, 90.

HSBC Continental Europe applies HSBC Group policies, adapted for local law, and the Head of People is accountable for local implementation (pages 85-86). Policies named:

• People Management Policy: standards for managers on inclusion, learning and development; overseen by the Group Chief People and Governance Officer (page 85).
• HSBC Human Rights Statement: guided by the UN Guiding Principles and OECD Guidelines, with "zero tolerance for harassment or unlawful discrimination" (pages 85-86).
• Employment Practices and Relations Policy: minimum standards on inclusion, minimum pay, employee behavior and freedom of association (page 86).
• Health and Safety Policy, built on ISO 45001 (page 86), and a mental health position (page 86).
• Vulnerable Employees Policy (equal treatment for staff with disabilities, Directive 2000/78/EC) and Digital Accessibility Policy (page 88).
• Supplier Code of Conduct, refreshed in 2025 with principles on responsible AI use; 98.4 per cent of suppliers had approved it or given an accepted alternative at end of 2025 (2024: 97.8 per cent) (page 86).
• Parental leave, working hours and flexible working policies (page 90).

Taking action on material impacts on own workforce

Reference: pages 90, 89, 84, 86, 88.

• Business transformation (secure employment): the Bank follows the Employment Practices and Relations Policy, consults staff representatives before redundancy decisions under EU Directives 98/59/EC and 2001/23/EC, and supports staff with proactive communication and help to find redeployment or outside opportunities, with a focus on France and Germany in 2025 (page 90). The turnover that follows from sales and outsourcing is described on page 84.
• Skills and careers: a Future Skills curriculum, the People Manager Excellence Programme, the How we Lead Programme launched in 2025 for top leaders, a mentoring platform running since 2020, and the HSBC University, Degreed and Talent Marketplace platforms (page 89).
• Work-life balance: hybrid working, a Care Ambassador Network started in 2025, and parental leave of at least four months per employee (page 90). The Bank notes it has no dedicated measures for civic engagement in local democratic activities (page 90).
• Inclusion and wages: eight Employee Resource Groups, inclusion training, and a living-wage certification (pages 87-88).

The Bank was certified as a Top Employer in 2025 for the entity and eight markets (page 84).

Targets related to own workforce

Reference: pages 88, 60.

The statement gives no numerical workforce target with a baseline and target year in the S1 chapter (pages 83-92).

What it describes instead are objectives built into incentives:

• Inclusion objectives are "embedded in members of the management body remuneration scorecards" at HSBC Group level. At Bank level the same approach puts objectives on engagement and inclusion rates in the Snapshot survey into the scorecards of Operating Committee members (page 88).
• Operating Committee scorecards carry a goal on clients and people, weighted 10 per cent, covering employee engagement, an inclusion index outcome, attrition of high performers and talent development (page 60).
• Every employee was assigned an objective to complete at least three climate-related training modules (page 60).

Progress on engagement is tracked through the Snapshot survey, where participation was 64 per cent in 2025 (page 85). The index lists S1-5 for S1 (page 62).

Characteristics of the company's employees

Reference: page 84.

Voluntary turnover was 5.3 per cent in 2025 (2024: 4.6 per cent). In 2025, 1,480 employees left (2024: 3,854), a turnover rate of 14.3 per cent (2024: 53 per cent), which the Bank ties to the sale of HSBC Epargne Entreprise, the sale of HSBC Assurances Vie (France), outsourcing of IT and infrastructure activities in France and the sale of Private Banking in Germany (page 84).

Employees who did not report a gender are counted as male. 2024 was restated to exclude non-employees (page 84).

Collective bargaining coverage and social dialogue

Reference: pages 87-88.

In 2025, 84 per cent of employees were covered by local collective bargaining agreements (2024: 76 per cent) and 88 per cent were represented by local staff representatives (2024: 81 per cent) (page 87).

Collective bargaining coverage by country, 2025 (page 87): France 100 per cent, Germany 71 per cent, Malta 99 per cent, other countries 48 per cent. Germany was 44 per cent in 2024.

The Bank says that in Germany, "negotiations are conducted with national banking industry representatives", and that such sector-level agreements can apply without being "accounted for in the collective bargaining reported metrics" (page 87). A European Works Council gives extra representation on transnational matters, such as the Bank's economic and financial situation within EEA Member States, and does not replace local bodies (page 87).

Diversity metrics

Reference: page 88.

Gender in senior leadership (Global Career Band 3 and above, page 88):

• 2025: 408 men (70.6 per cent) and 170 women (29.4 per cent).
• 2024: 451 men (71.2 per cent) and 182 women (28.8 per cent).

Age distribution of employees, 2025 (permanent and temporary, page 88):

• 29 and under: 947 (13.9 per cent)
• 30 to 49: 3,577 (52.4 per cent)
• 50 and over: 2,302 (33.7 per cent)

Employees who have not declared a gender are counted in the male category (page 88). The Board had six women of 11 directors (55 per cent) at 31 December 2025 (page 58). Employee numbers by gender and country are on page 84.

Adequate wages

Reference: pages 87, 83.

Adequate wages was added as a material positive impact in 2025 (page 83). The Bank says the HSBC Group "has been certified by the Fair Wage Network from 31 December 2024 to 31 December 2026", and that in 2025 the Network "confirmed that pay in all HSBC Continental Europe countries meets or exceeds local living wage standards" (page 87).

The remuneration policy has three parts: fixed pay, variable pay and benefits (medical schemes, life insurance, retirement plans, profit sharing, savings plans, time savings accounts and family leave) (page 87). Fair compensation reflects local living costs and regulation, including Directive (EU) 2022/2041 on adequate minimum wages, and packages are benchmarked against peers (page 87).

The Head of People is accountable for policy implementation (page 87). The statement reports no percentage of employees paid below an adequate wage benchmark, only the certification result.

Health and safety metrics

Reference: page 86.

The index lists S1-14 under "Health and Safety Policy" (page 86). That section says the Bank is "devoted to providing a safe and healthy working environment for all its workforce". The system is "structured in accordance with" ISO 45001. All employees, contractors, consultants and service providers must follow it, and its performance is "subject to ongoing monitoring and assurance" (page 86).

No quantitative health and safety metrics are given in the S1 chapter (pages 83-92): no number of fatalities, work-related accidents or days lost. Mental health support is described: a Head of People oversees workplace mental health, wellbeing content in mandatory training was updated in 2025, and a voluntary mental health e-learning module was added (page 86). The Technologia survey measures health and quality of life at work in France (page 85).

The data-points table marks the fatalities, work-related accidents and days lost data points as "Not material as per DMA", and "Workplace accident prevention policy or management system" as "Not applicable during the reporting year" (page 64).

Compensation metrics (pay gap and total compensation)

Reference: pages 88-89.

On the population covered by the annual pay review (headcount 6,616), the Bank reports (page 88):

It attributes the gap to "the higher proportion of men in senior roles (MD and GCB3)" in Corporate and Institutional Banking, Asset Management and Private Bank (page 88). Page 89 gives the gap by Global Career Band for 2025 and 2024.

The annual remuneration ratio of the highest compensation package to median is 15 at fixed pay (2024: 14) and 27 at total compensation (2024: 30) (page 89).

Employees on permanent or temporary contracts eligible for the 2025 pay review are included; apprentices, interns and staff who had not disclosed gender are excluded (page 89). The data-points table maps the unadjusted gender pay gap and the CEO pay ratio to the "Gender pay gap and remuneration ratio" section (page 64).

Business conduct policies and corporate culture

Reference: pages 94, 93, 95-96, 59. The index lists G1-1 under "Corporate culture and Business conduct policies".

The Board "sets HSBC Continental Europe's values and principles and oversees the implementation and maintenance of a code of conduct" (page 59). Policies and actions are "largely centralised at HSBC Group level and implemented by HSBC Continental Europe", with local additions (page 94).

• Code of Conduct: the Group Code applies to all employees; in France staff follow the local Code of Conduct, which is an internal regulation. The CEO is responsible for compliance (page 95).
• Our Conduct Approach, refreshed in 2025, with five customer and market outcomes (pages 94-95).
• Global Mandatory Training, with 2025 completion rates of 99.74 per cent (Trimester One), 99.52 per cent (Trimester Two, 2024: 96.8 per cent) and 98.28 per cent (Trimester Three) (page 94).
• A quarterly Conduct and Values Committee chaired by the CEO (page 95).
• Speak-up and whistleblowing: the Whistleblowing Policy and HSBC Confidential channel, with protection against retaliation (pages 95-96).

Pay and ratings are adjusted for poor behavior through the People function (page 95).

Targets related to business conduct

Back-filled from the business conduct chapter, where targets fall under MDR-T rather than a numbered disclosure requirement. G1-3 became a standalone DR only in the 2025/2026 ESRS; this statement was prepared under the 2023 ESRS.

Reference: pages 96-98, 89.

No measurable business conduct targets are stated in the chapter (pages 93-98). Effectiveness is tracked instead, as MDR-T allows (page 96):

• The Bank "tracks the efficiency of its policies and actions with respect to corporate culture, conduct risk and speak-up channels" through the volume of cases and anonymity rate, alerts fully processed, open cases and their risk level, and allegation and substantiation risk themes.
• Financial crime controls "are assessed through key performance indicators using automated management information and analytics", and key metrics go to the Risk Management Meeting (page 97).
• Cybersecurity has metrics for compliance objectives and control performance, with escalation to the Risk Management Meeting, Risk Committee and Board where results are unsatisfactory (page 98).
• Mandatory training completion is monitored on a dashboard with manager escalation (page 89).

No significant cybersecurity incident was recorded in 2025, as in 2024 (page 98).

Incidents of corruption or bribery

Reference: pages 97-98.

The index lists G1-4 as "Confirmed incidents of corruption or bribery". The statement reports: "During 2025, there was no instance of a conviction or fine for violation of anti-corruption and anti-bribery laws (2024: no fines or convictions)" (page 98).

It gives no count of confirmed corruption or bribery incidents beyond that, no number of employees dismissed or disciplined, and no number of contracts terminated.

The response framework is described: independent teams investigate credible allegations of bribery and corruption, and outcomes go to the Head of Financial Crime (page 97). Compliance may act on a policy breach by reminder, a breach notice recorded in the performance evaluation, a corrective action plan and, in rare severe cases, termination of employment (page 98).

The chapter also reports that no significant cybersecurity incident was recorded in 2025 or 2024 (page 98).