Pillar 3 Disclosures at 31 December 2023

Introduction

Regulatory framework for disclosures

HSBC Bank Malta p.l.c. is regulated on a consolidated basis by the European Central Bank ('ECB') which sets and monitors capital adequacy requirements.

Throughout 2023 HSBC Bank Malta p.l.c. calculated capital on a consolidated basis for prudential regulatory reporting purposes using the Basel III framework of the Basel Committee on Banking Supervision ('BCBS') as implemented by the EU in the amended Capital Requirements Regulation and Directive, collectively known as CRR/CRD.

The Basel Committee's framework is structured around three 'pillars': the Pillar 1 minimum capital requirements and Pillar 2 supervisory review process are complemented by Pillar 3 market discipline. The aim of Pillar 3 is to produce disclosures that allow market participants to assess the scope of application by banks of the Basel Committee's framework and the rules in their jurisdiction, their capital condition, risk exposures and risk management processes, and hence their capital adequacy. Pillar 3 requires all material risks to be disclosed, enabling a comprehensive view of a bank's risk profile.

Pillar 3 disclosures

Purpose

The information contained in this document is for HSBC Bank Malta p.l.c. It should be read in conjunction with HSBC Bank Malta p.l.c.'s

Annual Report and Accounts 2023.

Basis of preparation

The financial information contained in these disclosures have been prepared on a consolidated basis.

In its disclosures, HSBC Bank Malta p.l.c. provides comparative figures to facilitate analysis. Key ratios and figures are reflected throughout the Pillar 3 2023 disclosures. Where disclosures have been enhanced or are new, prior-year comparatives are not generally restated or provided.

Information relating to the rationale for withholding certain disclosures is provided in Appendix I.

HSBC Bank Malta p.l.c. publishes these Pillar 3 disclosures on the HSBC websites, www.hsbc.com and www.hsbc.com.mt, concurrently with the release of its Annual Report and Accounts.

These Pillar 3 disclosures include regulatory information complementing the financial and risk information presented therein.

Pillar 3 requirements may be met by inclusion in other disclosure media. Where HSBC Bank Malta p.l.c. adopts this approach, references are provided to the relevant pages of the Annual Report and Accounts 2023 or other locations.

Governance arrangements are detailed in the report on Corporate governance on pages 54 to 61 of HSBC Bank Malta p.l.c.'s Annual

Report and Accounts 2023.

HSBC Bank Malta p.l.c.'s Pillar 3 disclosures are governed by HSBC Bank Malta p.l.c.'s financial reporting and governance processes and this Pillar 3 Disclosures Report at 31 December 2023 was approved by HSBC Bank Malta p.l.c.'s Board of Directors on 21 February 2024 and signed on its behalf by:

Charlotte Cilia

Chief Financial Officer

Key regulatory developments

Basel III Reforms

The Basel Committee on Banking Supervision ('Basel') finalised its Basel III Reforms in July 2020. The reforms make significant changes to the way firms calculate risk-weighted assets ('RWAs') across all risk types and include the implementation of an RWA floor for banks that use internal models to calculate RWAs. In Europe, after several rounds of negotiations between the co-legislators,near-final rules were published in December 2023. The final text is expected to be ratified during the course of 2024 and shall apply from 1 January 2025. It includes a transitional phase-in period of five years for the implementation of the output floor and a clause allowing the legislators to delay the application of the changes to market risk RWAs for up to two years.

In September 2023, the UK Prudential Regulation Authority confirmed its intention to delay the implementation of its rules by six months to July 2025. The new PRA rules will apply to HSBC Group at a consolidated level and may therefore affect HSBC Continental Europe and its subsidiaries indirectly which includes HSBC Bank Malta p.l.c.

Interest Rate Risk in the Banking Book ('IRRBB')

In 2022, the European Banking Authority ('EBA') published the Regulatory Technical Standards ('RTS') on the IRRBB Supervisory Outlier Test, which will be used to identify institutions that might be subject to excessive losses in their banking book due to interest rate movements. The RTS include a new definition of what constitutes a large decline of Net Interest Income ('NII') defined as NII one-year losses in excess of 5% of Tier 1 Capital. Following the publication of the RTS, the EBA published new Implementing Technical Standards on IRRBB supervisory reporting including the new indicators introduced by the RTS.

In December 2023, Basel issued a consultation on proposed adjustments to its IRRBB standard in which it proposed to make adjustments to the interest rate shocks. It also proposed methodology changes to address concerns with the calculation of the shocks when interest rates are close to zero. The consultation will close in March 2024.

Environmental, Social and Governance ('ESG') risk

Globally, regulators and standard setters continue to publish multiple proposals and discussion papers on ESG topics. In recent years, this included multiple consultations on sustainability-related disclosures across jurisdictions including the EU, and through the IFRS foundation and Basel.

The EU Corporate Sustainability Reporting Directive ('CSRD') entered into force in January 2023. CSRD broadens the scope of EU entities subject to threshold criteria and impacts non-EU headquartered entities with at least one subsidiary in scope of CSRD reporting. The European Sustainability Reporting Standards under the CSRD were enacted in December 2023 with an effective date of 1 January 2024. In December 2023, France became the first EU Member State to transpose the CSRD into French law with an effective date of

1 January 2024.

The EBA published a consultation in January 2024 on the management of ESG risks and set out guidelines for the identification, measurement, management and monitoring of such risks, including detailed plans aimed at addressing the risks arising from the transition towards a climate-neutral economy in the EU. The guidelines are due to be finalised by the end of 2024 and expected to apply from January 2025.

Total capital improved by 10.1% driven by increased profits and higher revaluation reserves on our Hold-to-Collect investment portfolio partly offset by higher capital deductions for non-performing loans as we continue to gradually implement the capital requirements. The bank maintained a strong capital base and is fully compliant with the regulatory capital requirements.

Table 2: Net value of exposures

The LCR ratio increased by 84.1% driven by an increase in High Quality Liquid Assets and a decrease in Net Cash outflows. The LCR remains in excess of both the regulatory minimum and the risk appetite thresholds set by the bank.

The following material movements are observed when comparing current reporting with December 2022:

• Exposures in default decreased by 22.2% as a result of the bank's continued efforts to recover its portfolio of NPEs, to improve asset quality by pro-actively being closer to its customers to detect and mitigate deteriorating trends in its customers' trading performance at an early stage, and due to a stable local economic environment which improved the performance of its customers. The decreases in retail non-performing loans were mainly driven by mortgage upgrades.

• Exposures with International Organisations increased by 325.5%, mainly driven by investments in International Organisations debt instruments.

Some figures (indicated with ^) within the table have been prepared on an IFRS 9 transitional basis. All other tables report numbers on the basis of full adoption of IFRS 9.

Basis of consolidation

The basis of consolidation for the purpose of financial accounting under IFRSs described in Note 2 on the Annual Report and Accounts differs from that used for regulatory purposes.

The following table provides a reconciliation of the financial accounting balance sheet to the regulatory scope of consolidation.

Subsidiaries engaged in insurance activities are excluded from the regulatory consolidation by excluding assets, liabilities, and post- acquisition reserves, leaving the investment of the insurance subsidiaries to be recorded at cost and deducted from CET1 capital (subject to thresholds).

Risk management

Our risk management framework

We use a comprehensive risk management approach across the organisation and across all risk types, underpinned by our culture and values. This is outlined in our risk management framework, including the key principles and practices that we employ in managing material risks, both financial and non-financial. Whilst the framework fosters continuous monitoring of the risk environment, it also promotes risk awareness, and a sound operational and strategic decision making and escalation process. It supports a consistent approach to identifying and assessing, defining and enabling, managing and reporting and governing the risks we accept and incur in our activities with clear accountabilities. We actively review and develop our risk management framework and enhance our approach to managing risk.

Culture

HSBC has long recognised the importance of a strong culture. Our culture refers to our shared attitudes, values and standards that shape behaviours related to risk awareness, risk taking and risk management. It is instrumental in aligning the behaviours of individuals with our attitude to assuming and managing risk, which helps to ensure that our risk profile remains in line with our risk appetite. All our people are responsible for the management of risk, with the ultimate accountability residing with the Board. The fostering of a strong culture is a key responsibility of our senior executives.

Our culture is also reinforced by our approach to remuneration. Individual awards including those for senior executives are based on compliance with our values and the achievement of financial and non- financial objectives, which are aligned to our risk appetite and global strategy. We seek to build our business for the long term by balancing social, environmental and economic considerations in the decisions we make. Our strategic priorities are underpinned by our endeavour to operate in a sustainable way. This helps us to carry out our social responsibility and manage the risk profile of the business. In addition to other risks, we are committed to managing and mitigating climate-related risks, both physical and transition risks and continue to incorporate consideration of these into how we manage and oversee risks internally and with our customers.

Risk governance

The Board has overall accountability for the effective risk management and control environment and approves our risk appetite. It is advised on risk-related matters by the Risk Committee. Executive accountability for the ongoing monitoring, assessment and management of the risk environment and the effectiveness of the risk management framework resides with the Chief Risk Officer who is supported by the Risk Management Meeting ('RMM') of the Executive Committee.

Day-to-day responsibility for risk management is delegated to senior managers with individual accountability for decision making. These senior managers are supported by global functions and all our people

have a role to play in risk management. These roles are defined using the three lines of defence model, which takes into account our business and functional structures. We use a defined executive risk governance structure to ensure appropriate oversight and accountability for risk, which facilitates the reporting and escalation to the RMM.

Risk appetite

Risk appetite is a key component of our management of risk. It describes the type and quantum of risk that HSBC Bank Malta p.l.c. is willing to accept in achieving its strategic goals. At HSBC, risk appetite is managed through a global risk appetite framework and articulated in a risk appetite statement ('RAS') which is reviewed and approved by the Board during the year to make sure it remains fit for purpose. Our risk appetite informs our strategic and financial planning process, defining the desired forward-looking risk profile of the bank.

Risk management and internal control systems

The Directors are responsible for maintaining and reviewing the effectiveness of risk management and internal control systems, and for determining the aggregate level and risk types they are willing to accept in achieving HSBC Bank Malta p.l.c.'s business objectives. On behalf of the Board, the Audit Committee has responsibility for oversight of risk management and internal controls over financial reporting, whereas the Risk Committee has responsibility for oversight of risk management and internal controls other than for financial reporting.

Risk measurement and reporting systems

Our risk measurement and reporting systems are designed to help ensure that risks are comprehensively captured with all the attributes necessary to support well-founded decisions, that those attributes are accurately assessed, and that information is delivered in a timely manner for those risks to be successfully managed and mitigated. We continue to invest significant resources in IT systems and processes in order to maintain and improve our risk management capabilities.

HSBC Bank Malta p.l.c. leverages on the risk measurement and reporting structures, which provide a common operating model for integrated risk management and control framework that is deployed at HSBC Group level. This model sets out the respective responsibilities of HSBC Group and HSBC Bank Malta p.l.c.'s risk and compliance functions in respect of risk governance and oversight, approval authorities and lending guidelines, scorecards, management information and reporting, and relations with third parties such as regulators and auditors.

Capital and Leverage

Capital management

Approach and policy

HSBC Bank Malta p.l.c.'s objective in managing its capital is to maintain appropriate levels of capital to support its business strategy and meet regulatory requirements at all times.

HSBC Bank Malta p.l.c. manages its capital to ensure that it exceeds current and expected future requirements. Throughout 2023 HSBC Bank Malta p.l.c. complied with the European Central Bank ('ECB') regulatory capital adequacy requirements. To achieve this, the bank manages its capital within the context of an annual capital plan which is approved by the Board of Directors of HSBC Bank Malta p.l.c. ('the Board') and which determines the appropriate amount and mix of capital.

The policy on capital management is underpinned by the HSBC Group capital management framework, which enables a consistent management of the capital.

The Internal Capital Adequacy Assessment Process ('ICAAP') aims at assessing the adequacy of the bank's capital resources with regards to its risk and requirements, incorporates different assessment methods of the capital needs. These capital measures include economic capital and regulatory capital defined as follows:

• Economic capital is the internally calculated capital requirement which is deemed necessary by HSBC Bank Malta p.l.c. to support the risks to which it is exposed to; and,
• Regulatory capital is the level of capital which HSBC Bank Malta p.l.c. is required to hold in accordance with the rules set by the legislation and the ECB.

The following risks are managed through the capital management framework:

• Credit risk;
• Operational risk;
• Market risk
• Interest rate risk in the banking book;
• Climate Risk;
• Liquidity Risk; and
• Insurance risk.

The Basel III framework introduces other capital buffers, such as the Capital Conservation Buffer ('CCB'), the Countercyclical Buffer ('CCyB'), the Sectoral Systemic Risk Buffer ('sSyRB'), the Pillar 2 Guidance ('P2G') and other systemic buffers such as the Globally/ Other Systematically Important Institutions ('G-SII'/'O-SII') buffer. CRR and CRD legislations implemented Basel III in the EU.

Stress testing

Stress testing is incorporated in the capital management framework and is an important component of understanding the resilience of HSBC Bank Malta p.l.c. to a given scenario based on a set of risk factors. The scenarios are extreme but plausible events. Stress testing allows senior management to assess the bank's vulnerabilities and to formulate its response including risk mitigating actions based on the conditions reflected in the identified stress scenarios.

The actual market stresses experienced by the financial system in recent years have been used to inform the capital planning process and further develop the stress scenarios employed within HSBC Bank Malta p.l.c.

Regulatory stress tests (carried out at the request of regulators using their prescribed assumptions), internal stress tests (using internally defined scenarios defined to capture the specific risks faced by HSBC Bank Malta p.l.c.), reverse stress tests and sensitivity analysis are performed. HSBC Bank Malta p.l.c. takes into account the results of

all regulatory and internal stress testing when assessing internal capital requirements.

Risks to capital

A list of risks with associated potential impact on HSBC Bank Malta p.l.c.'s capital ratios are reviewed regularly. These risks could potentially affect either the Risk-Weighted Assets ('RWAs') and/or the capital position. These risks are monitored regularly within the Asset and Liability Management Committee ('ALCO') and the Risk Management Meetings ('RMM'). Scenario analysis are performed for the relevant categories of risk. The downside scenario is assessed against our capital management objectives and embedded in the capital risk appetite.

HSBC Bank Malta p.l.c.'s approach to manage its capital position aims at ensuring that the bank complies with the current regulatory requirements and internal risk appetite, as well as to ensure that future regulatory requirements are considered.

Regulatory capital framework

For regulatory purposes, the capital base can be divided into three tiers; the Common Equity Tier 1, Additional Tier 1, and Tier 2 capital. These are classified based on the degree of permanence and loss absorbency exhibited. HSBC Bank Malta p.l.c.'s capital base is made up of the Common Equity Tier 1 and Tier 2 capital, as it holds no instruments under Additional Tier 1. The main features of capital issued by HSBC Bank Malta p.l.c. are described in Table 6 within this Pillar 3 disclosures report.

Common Equity Tier 1 ('CET1') capital is the highest quality form of capital, comprising shareholders' equity and related non-controlling interests (subject to limits). Under CRR/CRD various capital deductions and regulatory adjustments are made against these items; these include deductions for intangible assets, deferred tax assets that rely on future profitability as well as prudential recognition for non-performing exposures.

Tier 2 ('T2') capital comprises of eligible subordinated debt and any related share premiums.

T2 capital instruments are either perpetual subordinated instruments or dated instruments on which there is an obligation to pay coupons. These instruments or subordinated loans comprise dated loan capital repayable at par on maturity and must have an original maturity of at least five years. Some subordinated loan capital may be called and redeemed by the issuer subject to prior consent from the ECB. It is a regulatory requirement that Tier 2 instruments are amortised on a straight line basis in their final five years to maturity, thus reducing the amount of capital that is recognised for regulatory purposes.

Our T2 capital consists of subordinated debt with HSBC Continental Europe which is repayable at par on maturity. However, the borrower has the option for early repayment, subject to prior consent from the ECB.

As at 31 December 2022, the bank's Tier 2 capital consisted of €62,000,000 subordinated unsecured loan stock issued to HSBC Bank plc in December 2018 and maturing on 14 December 2028, having a floating rate linked to three-month Euribor. As at 31 December 2022, the interest rate was 4.11%.

The €62,000,000 subordinated unsecured loan stock was repaid in full on 14 December 2023 invoking the early redemption option included in the contractual agreement. On the same date HSBC Bank Malta p.l.c. entered into a new subordinated loan amounting to €65,000,000 with HSBC Continental Europe. The term of the subordinated loan is 10 years with a maturity date of 14 December 2033 and an option of early redemption after five years. It bears interest at a rate equal to three-month Euribor plus a margin of 237 basis points. As at 31 December 2023, the interest rate was 6.33%.