Model Risk Management

1. Definition and scope

A model is any method that applies statistical, mathematical or algorithmic techniques to input data to produce a quantitative estimate or a ranked output on which the group may act. Pricing libraries, valuation approaches for unlisted positions, trading signals, risk aggregation engines, screening prioritisation tools, liquidity forecasts and capital allocation routines are all models. A spreadsheet that performs the same function is a model and is not exempt because of its form.

A deterministic calculation that applies a fixed rule with no estimation, such as a fee schedule or an interest accrual, is not a model but is subject to the change control in the Information Security policy. Machine-learning systems and generative tools are models for the purposes of this policy and are additionally governed by the Artificial Intelligence Governance policy, which applies the Ethical Technology Charter to them in full.

The policy applies to every model developed inside the group, every model licensed from a vendor and every model embedded in a service the group uses, where the group acts on its output. A vendor model that cannot be validated to the standard its tier requires is not used for that tier of decision. The Chief Risk Officer owns the policy; the Head of Technology and Ethics owns the platforms on which models run.

2. The model inventory and ownership

Every model is entered in the group model inventory before it is used for any decision. The inventory held 71 models at 30 June 2026. Each entry records the purpose, the tier, the owner, the developer, the validator, the input datasets and their provenance under the Data Protection and Privacy policy, the systems on which the model runs, the divisions that use it, the date of the last validation and the date the next is due. The inventory is held in the George Town archive and retained for ten years after a model is retired.

Each model has one owner, who is a named individual and not a team. The owner answers for the model being fit for its purpose, for its inputs being current and lawfully held, for its outputs being used only within its approved scope and for stopping it when it fails. This is the first Charter principle, human accountability, applied to every automated estimate the group makes. When an owner leaves or changes role, a successor is named before the change takes effect or the model is suspended.

A model used outside its approved scope, for a purpose or a market or an asset class its validation did not cover, is treated as a new model and cannot be used until the extension is validated. Model users are told the approved scope in the model's user documentation and confirm annually that they have read it.

3. Model tiers

Models are tiered by the cost of their being wrong, not by their complexity. Tier 1 models are those whose output directly determines an order, a valuation reported to a client or an investor, a capital or liquidity figure reported to the Board or a regulator, or a screening outcome for a client. Twelve models were Tier 1 at 30 June 2026, including the four signal families run by Quantitative Strategies, the unlisted valuation approaches used by Private Equity, the group risk aggregation engine and the liquidity forecast.

Tier 2 models inform a human decision without determining it: research rankings, deal screening in Investment Banking, sector exposure estimates in Information & Data and counterparty exposure projections. There were 26. Tier 3 models produce internal management information with no external effect and no direct effect on a position: cost forecasts, capacity planning and internal reporting analytics. There were 33.

The tier is proposed by the owner and set by the Chief Risk Officer. Where a model's use changes so that its output would have a greater effect, the tier is raised before the new use begins. This is the second Charter principle, proportionate automation: automation is permitted only where the cost of error is understood, and the tier is the group's statement of that understanding.

• Tier 1: output directly determines an order, a reported valuation, a capital or liquidity figure or a screening outcome. Twelve models.
• Tier 2: output informs a human decision without determining it. Twenty-six models.
• Tier 3: internal management information with no external or position effect. Thirty-three models.

4. Validation

Validation is performed by the model validation unit within the Risk function, which reports to the Chief Risk Officer and has no reporting line to any model developer or user. The unit had six people at 30 June 2026, based in Zürich and Singapore. Validation tests the conceptual soundness of the approach, the quality and provenance of the inputs, the implementation against the documented design, the behaviour of the model at the limits of its inputs and the accuracy of its outputs against realised outcomes.

Tier 1 models are validated before first use and revalidated every year. Tier 2 models are validated before first use and revalidated every two years. Tier 3 models are self-assessed by their owner each year against a standard template and are validated by the unit every three years or on a material change. A material change to any model, meaning a change to its method, its inputs or its scope, triggers revalidation before the changed model is used.

Validation findings are graded. A grade one finding means the model may not be used until the finding is closed. A grade two finding permits use under a documented restriction with a closure date not more than 90 days out. A grade three finding is an improvement point closed at the next revalidation. The 2025 validation cycle raised 44 findings; nine were open at 30 June 2026, all grade two or three, and none older than 90 days.

5. Monitoring, limits and the stop rule

Every Tier 1 model is monitored against performance thresholds set at validation. The thresholds cover prediction error, input data quality, output stability and, for trading signals, realised return against expectation. Monitoring results are reviewed monthly by the owner and the validation unit, and quarterly by the Risk & Valuation Committee. Tier 2 models are monitored quarterly. A breach of threshold is a finding and follows the finding timetable.

Any Tier 1 model can be stopped within fifteen minutes by its owner, by the Chief Risk Officer or by the head of the desk that uses it, without any further approval. Each Tier 1 model has a documented fallback, which is either an earlier validated version or a manual process, and the fallback is tested at each revalidation. Restarting a stopped model requires the written approval of the Chief Risk Officer.

A model output is never itself a decision. For Tier 1 trading signals, a named person authorises transmission of the orders the signal proposes, as the Order Handling and Allocation policy requires. For valuations, the Risk & Valuation Committee adopts the figure. For screening, a compliance officer reviews every match the model surfaces. The group makes no automated decision about a client, and any client may require a human review of any model-assisted decision under the Data Protection and Privacy policy.

6. Transparency and reporting

Client reports state which figures and which decisions were produced with the assistance of a model, using the assistance statement defined in the Artificial Intelligence Governance policy. The statement names the model class and the person accountable for the decision. This is the sixth Charter principle, transparency to clients, and it applies equally to statistical models and to machine-learning systems.

The Chief Risk Officer reports to the Risk & Valuation Committee each quarter on the inventory, the validation calendar, open findings, threshold breaches and any model stopped during the period. The Board receives an annual model risk report and approves the list of Tier 1 models. Internal Audit reviews the validation unit's work on a three-year cycle so that the validators are themselves validated.