How HSBC approaches Model Risk Management

For large global financial institutions, credit risk modeling is a critical but notoriously labor-intensive task. Models that estimate Probability of Default (PD), Loss Given Default (LGD), and Exposure at Default (EAD) form the backbone of capital reporting and internal risk management. At Yields Innovate 2026, Philip Preuss offered a rare glimpse into how HSBC handles the immense regulatory burden associated with Wholesale Internal Ratings-Based (IRB) models and how a structured automation initiative drastically cut validation times while simultaneously elevating report quality.

The Weight of Regulatory Scrutiny

Wholesale IRB models, those dealing with corporate clients rather than retail customers, face some of the highest regulatory scrutiny in the banking sector. Regulators across the globe, such as the PRA in the UK, the ECB in Europe, and the HKMA in Hong Kong, enforce prescriptive and extensive requirements for these models. Institutions must produce exhaustive annual validation reports that meticulously review a model's discriminatory power, calibration accuracy, and stability.

Operating in multiple markets means that a single global model at HSBC may require separate validations for different regional regulators. Consequently, HSBC's Model Risk Management (MRM) function found itself executing over 100 IRB model revalidations each year. With validators routinely starting from blank Word templates and manually preparing distinct sets of complex tests, an end-to-end validation historically took between two and three months per model.

The Journey to Automation

To address this massive resource drain, HSBC embarked on a comprehensive automation project three years ago. The goal was straightforward but ambitious: automate the calculation of quantitative metrics and the drafting of the reports, thereby freeing up senior validators to focus on high-level analysis and
critical review.

The transformation was carried out in four key phases:

1. Translating Regulatory Requirements: The most challenging hurdle was standardizing the validation process. Regulators might mandate the assessment of "discriminatory power," but validators had flexibility in how to measure and present it. By putting their most senior personnel on the task for two
months, HSBC translated abstract regulatory requirements into strict, structured functional IT requirements.

‍2. Proper IT Architecture: To prevent the creation of unmaintainable "spaghetti code," the MRM team partnered with internal IT specialists (MRM Strats). They established coding standards, utilized GitHub repositories, and built Jenkins pipelines for testing, ensuring an enterprise-grade Python library.

‍3. GUI Integration: Recognizing that not all validators are software engineers, HSBC integrated the Python codebase with Yields, a graphical user interface. This allowed users to easily configure inputs and execute the validation logic without touching the underlying code.

‍4. Deployment and BAU: After rigorous side-by-side testing during a validation cycle, the tool was deployed globally for all BAU (Business As Usual) validations.

A Paradigm Shift in Efficiency

The impact of this automated framework has been transformative. Today, an HSBC validator simply prepares the raw data, fills out an Excel-based configuration file mapping technical variables, and uploads it via Yields. Within one to two minutes, the system outputs a 50-to-100-page comprehensive Word document, alongside pre-filled ECB Excel templates.

‍

The report utilizes a smart RAG (Red, Amber, Green) system. If metrics like the GINI coefficient or Population Stability Index (PSI) fall within acceptable thresholds, the tool generates standardized, affirmative text. If a metric triggers an amber or red warning, the tool leaves a placeholder prompting the
human validator to investigate root causes, raise internal findings (MRIs), and insert qualitative explanations.

As a result, the end-to-end timeline for a validation has shrunk from 2–3 months down to just 3–4 weeks. The actual human review of the generated draft now takes a mere 2 to 3 days, reducing overall validation effort by an impressive 57%.

Beyond Speed: Elevating Quality

While the efficiency gains are immediately apparent, Preuss highlighted an equally critical benefit: globally consistent quality. Because the logic and narrative structures were designed by HSBC’s top experts, every validation report generated by the tool reads as if it were authored by a senior validator.

This standardization has not gone unnoticed. Preuss noted that the ECB explicitly commended HSBC in writing on the significantly improved quality of their revalidation submissions. Additionally, running the pipeline through Yields creates an immutable, centralized audit trail, recording exactly who ran which
version of the code on which dataset, thereby satisfying strict internal governance requirements.

Next Milestones and the AI Frontier

With the success in the Wholesale IRB portfolio, HSBC is now scaling the philosophy. The MRM team is working on adapting the library for new model validations and other domains like Retail IRB and IFRS 9 models.

More excitingly, HSBC is beginning to explore the integration of Artificial Intelligence. While they consciously avoid using Large Language Models (LLMs) to write critical regulatory conclusions due to hallucination risks, they are exploring AI for comparative analysis. For new model validations, validators must build independent "challenger models" and compare their performance against the first-line development team’s models. HSBC is testing AI's ability to ingest disparate documentation formats from global development teams and automatically benchmark them against the independent challenger models.

HSBC’s approach demonstrates that with rigorous upfront structuring and smart cross-functional collaboration, even the most daunting regulatory compliance tasks can be transformed from a slow, manual grind into a strategic, automated asset.

‍