DEFERRED PROSECUTION AGREEMENT

Defendant HSBC Bank USA, N.A., a federally chartered banking institution and subsidiary of HSBC North America Holdings, Inc., and defendant HSBC Holdings plc, a financial institution holding company organized under the laws of England and Wales (collectively, “the HSBC Parties”), by their undersigned representatives, pursuant to authority granted by the HSBC Parties’ Boards of Directors, and the United States Department of Justice, Criminal Division, Asset Forfeiture and Money Laundering Section, the United States Attorney’s Office for the Eastern District of New York, and the United States Attorney’s Office for the Northern District of West Virginia (collectively, the “Department”), enter into this deferred prosecution agreement (the “Agreement”). The terms and conditions of this Agreement are as follows:

1

Criminal Information and Acceptance of Responsibility

1.      The HSBC Parties acknowledge and agree that the Department will file the attached four-count criminal Information in the United States District Court for the Eastern District of New York (“the Court”) charging the HSBC Parties with (a) wilfully failing to maintain an effective anti-money laundering program, in violation of Title 31, United States Code, Section 5318(h) and regulations issued thereunder; (b) wilfully failing to conduct and maintain due diligence on correspondent bank accounts held on behalf of foreign persons, in violation of Title 31, United States Code, Section 5318(i) and regulations issued thereunder; (c) wilfully violating and attempting to violate the Trading with the Enemy Act, Title 50 United States Code Appendix Sections 3, 5, 16, and regulations issued thereunder; and (d) wilfully violating and attempting to violate the International Emergency Economic Powers Act, Title 50 United States Code Sections 1702 and 1705, and regulations issued thereunder. In so doing, the HSBC Parties: (a) knowingly waive their right to indictment on this charge, as well as all rights to a speedy trial pursuant to the Sixth Amendment to the United States Constitution, Title 18, United States Code, Section 3161, and Federal Rule of Criminal Procedure 48(b); and (b) knowingly waive for purposes of this Agreement any objection

2

with respect to venue and consent to the filing of the Information, as provided under the terms of this Agreement.

2.      The HSBC Parties admit, accept and acknowledge that they are responsible for the acts of their officers, directors, employees, and agents as charged in the Information, and as set forth in the Statement of Facts attached hereto as Attachment A and incorporated by reference into this Agreement, and that the allegations described in the Information and the facts described in Attachment A are true and accurate. Should the Department pursue the prosecution that is deferred by this Agreement, the HSBC Parties agree that they will neither contest the admissibility of nor contradict the Statement of Facts in any such proceeding, including any guilty plea or sentencing proceeding. Neither this Agreement nor the criminal Information is a final adjudication of the matters addressed in such documents.

Term of the Agreement

3.      This Agreement is effective for a period beginning on the date on which the Information is filed and ending five (5) years from that date (the “Term”). However, the HSBC Parties agree that, in the event the Department determines, in its sole discretion, that the HSBC Parties have knowingly violated any provision of this Agreement, an extension or extensions of the Term of the Agreement may be imposed by the Department, in its sole discretion, for up

3

to a total additional period of one year, without prejudice to the Department’s right to proceed as provided in Paragraphs 16 through 19 below. Any extension of the Agreement extends all terms of this Agreement for an equivalent period. Conversely, in the event the Department finds, in its sole discretion, that the provisions of this Agreement have been satisfied, the Term of the Agreement may be terminated early.

Relevant Considerations

4.      The Department enters into this Agreement based on the individual facts and circumstances presented by this case. Among the facts considered were the following: (a) the HSBC Parties’ willingness to acknowledge and accept responsibility for the actions of their officers, directors, employees, and agents as charged in the Information and as set forth in the Statement of Facts; (b) the HSBC Parties’ extensive remedial actions taken to date, which are described in the Statement of Facts and Paragraph 5 below; (c) the HSBC Parties’ agreement to continue to enhance their anti-money laundering programs; (d) the HSBC Parties’ agreement to continue to cooperate with the Department in any ongoing investigation of the conduct of the HSBC Parties and their current or former officers, directors, employees, agents and consultants, as provided in Paragraph 6 below; (e) the HSBC Parties’ willingness to settle any and all civil and criminal

4

claims currently held by the Department for any act within the scope of the Statement of Facts; and (f) the HSBC Parties’ cooperation with the Department, including conducting multiple extensive internal investigations, voluntarily making U.S. and foreign employees available for interviews, and collecting, analyzing, and organizing voluminous evidence and information for the Department.

5.      The HSBC Parties have taken, will take, and/or shall continue to adhere to, the following remedial measures:

5

6

7

8

Upon the application of the HSBC Parties, the Corporate Compliance Monitor (discussed infra at paragraphs 9-13) may modify, adjust, or discontinue any remedial or compliance measure listed in this Agreement if the Monitor finds that continuation of the measure is impractical, inconsistent with any recommendation of the Monitor, or inadvisable for any other reason, subject to Department approval.

Cooperation

6.      The HSBC Parties shall continue to cooperate fully with the Department in any and all investigations, subject to applicable laws and regulations and the attorney-client and attorney work product privileges. At the request of the Department, the HSBC Parties shall also cooperate fully with other domestic or foreign law enforcement authorities and agencies in any investigation of the HSBC Parties or any of their present and former officers, directors, employees, agents and consultants, or any other party. The HSBC Parties also agree that they shall:

9

10

11

Forfeiture Amount

7.      As a result of the HSBC Parties’ conduct, including the conduct set forth in the Statement of Facts, the parties agree the Department could institute a civil and/or criminal forfeiture action against certain funds held by the HSBC Parties and that such funds would be forfeitable pursuant to Title 18, United States Code, Sections 981 and 982. The HSBC Parties hereby acknowledge that at least $881,000,000 was involved in transactions, in violation of Title 18, United States Code,

12

Sections 1956 and 1957; and that at least $375,000,000 was involved in transactions in violation of Title 50, United States Code, Appendix, Sections 3, 5 and 16 and the regulations issued thereunder, or Title 50, United States Code, Section 1705 and the regulations issued thereunder. In lieu of a criminal prosecution and related forfeiture, the HSBC Parties hereby agree to pay to the United States the sum of $1,256,000,000 (the “Forfeiture Amount”). The HSBC Parties hereby agree the Forfeiture Amount shall be considered substitute res for the purpose of forfeiture to the United States pursuant to Title 18, United States Code, Sections 981 and 982, and the HSBC Parties release any and all claims they may have to such funds. The HSBC Parties shall pay the Forfeiture Amount plus any associated transfer fees within five (5) business days of the date on which this Agreement is signed, pursuant to payment instructions as directed by the Department in its sole discretion.

Conditional Release from Liability

8.      In return for the full and truthful cooperation of the HSBC Parties, and their compliance with the other terms and conditions of this Agreement, the Department agrees, subject to Paragraphs 16 through 19 below, not to use any information related to the conduct described in the attached Statement of Facts against the HSBC Parties or any of their corporate parents, subsidiaries,

13

affiliates, predecessors, successors or assigns, in any criminal or civil case, except: (a) in a prosecution for perjury or obstruction of justice; or (b) in a prosecution for making a false statement. In addition, the Department agrees, except as provided herein, that it will not bring any criminal case against the HSBC Parties or any of their corporate parents, subsidiaries, affiliates, predecessors, successors or assigns, related to the conduct described in the attached Statement of Facts and the Information.

14

Corporate Compliance Monitor

9.      Within sixty (60) calendar days of the filing of the Agreement and the accompanying Information, or promptly after the Department’s selection pursuant to Paragraph 10 below, HSBC Holdings agrees to retain an independent compliance monitor (the “Monitor”). In particular, within thirty (30) calendar days after the execution of this Agreement, and after consultation with the Department, HSBC Holdings will propose to the Department a pool of three qualified candidates to serve as the Monitor. If the Department, in its sole discretion, is not satisfied with the candidates proposed, the Department reserves the right to seek additional nominations from HSBC Holdings. The Monitor candidates shall have, at a minimum, the following qualifications:

15

10.      The Department retains the right, in its sole discretion, to accept or reject any Monitor candidate proposed by HSBC Holdings, though HSBC Holdings may express their preference(s) among the candidates. In the event the Department rejects all proposed Monitors, HSBC Holdings shall propose another candidate within ten (10) calendar days after receiving notice of the rejection. This process shall continue until a Monitor acceptable to both parties is chosen. The Department may also propose the names of qualified Monitor candidates for consideration. The term of the monitorship, as set forth in Attachment B, shall commence upon the Department’s acceptance of a Monitor candidate proposed by HSBC Holdings. If the Monitor resigns or is otherwise unable to fulfill his or her obligations as set out herein and Attachment B, HSBC Holdings shall

16

within sixty (60) calendar days recommend a pool of three qualified Monitor candidates from which the Department will choose a replacement.

11.      The Monitor will be retained by HSBC Holdings for a period of not less than sixty (60) months from the date the Monitor is selected. The term of the monitorship, including the circumstances that may support an extension of the term, as well as the Monitor’s powers, duties, and responsibilities, will be as set forth in Attachment B.

12.      HSBC Holdings agrees that it will not employ or be affiliated with the Monitor for a period of not less than one year from the date on which the Monitor’s term expires.

13.      The Monitor’s term shall be five (5) years from the date on which the Monitor is retained by HSBC Holdings, subject to extension or early termination as described in Paragraph 3.

Deferred Prosecution

14.      In consideration of: (a) the past and future cooperation of the HSBC Parties described in Paragraph 6 above; (b) the HSBC Parties’ forfeiture, totaling $1,256,000,000; and (c) the HSBC Parties’ implementation and maintenance of remedial measures described in the Statement of Facts and Paragraph 5 above, the Department agrees that any prosecution of the HSBC Parties for conduct set forth in the Information or the attached Statement of

17

Facts, and for the conduct that the HSBC Parties disclosed to the Department prior to the signing of this Agreement, be and hereby is deferred for the Term of this Agreement.

15.      The Department further agrees that if the HSBC Parties fully comply with all of their obligations under this Agreement, the Department will not continue the criminal prosecution against the HSBC Parties described in Paragraph 1 and, at the conclusion of the Term, this Agreement shall expire. Within thirty (30) days of the Agreement’s expiration, the Department shall seek dismissal with prejudice of the criminal Information filed against the HSBC Parties described in Paragraph 1.

Breach of the Agreement

16.      If, during the Term of this Agreement, the Department determines, in its sole discretion, that the HSBC Parties have (a) committed any crime under U.S. federal law subsequent to the signing of this Agreement, (b) at any time provided in connection with this Agreement deliberately false, incomplete, or misleading information, or (c) otherwise breached the Agreement, the HSBC Parties shall thereafter be subject to prosecution for any federal criminal violation of which the Department has knowledge, including the charges in the Information described in Paragraph 1, which may be pursued by the Department in the United States District Court for the Eastern District of New York or any other appropriate venue.

18

Any such prosecution may be premised on information provided by the HSBC Parties. Any such prosecution that is not time-barred by the applicable statute of limitations on the date of the signing of this Agreement may be commenced against the HSBC Parties notwithstanding the expiration of the statute of limitations between the signing of this Agreement and the expiration of the Term plus one year. Thus, by signing this Agreement, the HSBC Parties agree the statute of limitations with respect to any such prosecution that is not time-barred on the date of the signing of this Agreement shall be tolled for the Term plus one year.

17.      In the event the Department determines the HSBC Parties have breached this Agreement, the Department agrees to provide the HSBC Parties with written notice of such breach prior to instituting any prosecution resulting from such breach. The HSBC Parties shall, within thirty (30) days of receipt of such notice, have the opportunity to respond to the Department in writing to explain the nature and circumstances of such breach, as well as the actions the HSBC Parties have taken to address and remediate the situation, which explanation the Department shall consider in determining whether to institute a prosecution.

18.      In the event the Department determines the HSBC Parties have breached this Agreement: (a) all statements made by or on behalf of the HSBC Parties to the Department or to the Court,

19

including the attached Statement of Facts, and any testimony given by the HSBC Parties before a grand jury, a court, or any tribunal, whether prior or subsequent to this Agreement, and any leads derived from such statements or testimony, shall be admissible in evidence in any and all criminal proceedings brought by the Department against the HSBC Parties; and (b) the HSBC Parties shall not assert any claim under the United States Constitution, Rule 11(f) of the Federal Rules of Criminal Procedure, Rule 410 of the Federal Rules of Evidence, or any other federal rule that statements made by or on behalf of the HSBC Parties prior or subsequent to this Agreement, or any leads derived therefrom, should be suppressed. The decision whether conduct or statements of any current director or employee, or any person acting on behalf of, or at the direction of, the HSBC Parties will be imputed to the HSBC Parties for the purpose of determining whether the HSBC Parties have violated any provision of this Agreement shall be in the sole discretion of the Department.

19.      The HSBC Parties acknowledge the Department has made no representations, assurances, or promises concerning what sentence may be imposed by the Court if the HSBC Parties breach this Agreement and this matter proceeds to judgment. The HSBC Parties further acknowledge that any such sentence is solely within the

20

discretion of the Court and that nothing in this Agreement binds or restricts the Court in the exercise of such discretion.

Sale or Merger of HSBC Parties

20.      The HSBC Parties agree that in the event they sell, merge, or transfer all or substantially all of their business operations as they exist as of the date of this Agreement, whether such sale is structured as a sale, asset sale, merger, or transfer, it shall include in any contract for sale, merger, or transfer a provision binding the purchaser, or any successor in interest thereto, to the obligations described in this Agreement.

Public Statements by HSBC Parties

21.      The HSBC Parties expressly agree that they shall not, through present or future attorneys, officers, directors, employees, agents or any other person authorized to speak for the HSBC Parties make any public statement, in litigation or otherwise, contradicting the acceptance of responsibility by the HSBC Parties set forth above or the facts described in the attached Statement of Facts. Any such contradictory statement shall, subject to cure rights of the HSBC Parties described below, constitute a breach of this Agreement, and the HSBC Parties thereafter shall be subject to prosecution as set forth in Paragraphs 16-19 of this Agreement. The decision whether any public statement by any such person contradicting a fact contained in the Statement of Facts will be

21

imputed to the HSBC Parties for the purpose of determining whether they have breached this Agreement shall be at the sole discretion of the Department. If the Department determines that a public statement by any such person contradicts in whole or in part a statement contained in the Statement of Facts, the Department shall so notify the HSBC Parties, and the HSBC Parties may avoid a breach of this Agreement by publicly repudiating such statement(s) within five (5) business days after notification. The HSBC Parties shall be permitted to raise defenses and to assert affirmative claims in other proceedings relating to the matters set forth in the Statement of Facts provided that such defenses and claims do not contradict, in whole or in part, a statement contained in the Statement of Facts. This Paragraph does not apply to any statement made by any present or former officer, director, employee, or agent of the HSBC Parties in the course of any criminal, regulatory, or civil case initiated against such individual, unless such individual is speaking on behalf of the HSBC Parties. Subject to this paragraph, the HSBC Parties retain the ability to provide information or take legal positions in litigation or other regulatory proceedings in which the Department or the New York County District Attorney’s Office is not a party.

22.      The HSBC Parties agree that if it or any of its direct or indirect subsidiaries or affiliates issues a press release or

22

holds any press conference in connection with this Agreement, the HSBC Parties shall first consult the Department to determine (a) whether the text of the release or proposed statements at the press conference are true and accurate with respect to matters between the Department and the HSBC Parties; and (b) whether the Department has no objection to the release.

23.      The Department agrees, if requested to do so, to bring to the attention of governmental and other debarment authorities the facts and circumstances relating to the nature of the conduct underlying this Agreement, and the nature and quality of the HSBC Parties’ cooperation and remediation. By agreeing to provide this information to debarment authorities, the Department is not agreeing to advocate on behalf of the HSBC Parties, but rather is agreeing to provide facts to be evaluated independently by the debarment authorities.

Limitations on Binding Effect of Agreement

24.      This Agreement is binding on the HSBC Parties and the Department, but specifically does not bind any other federal agencies, or any state, local or foreign law enforcement or regulatory agencies, or any other authorities, although the Department will bring the cooperation of the HSBC Parties and their compliance with their other obligations under this Agreement to the attention of such agencies and authorities if requested to do so

23

by the HSBC Parties. Specifically, this Agreement does not bind the Tax Division or the Fraud Section of the Criminal Division of the United States Department of Justice. This Agreement does not bind any affiliates or subsidiaries of HSBC Holdings plc, other than those that are parties to this Agreement, but is binding on HSBC Holdings plc itself. To the extent HSBC Holdings plc’s compliance with this Agreement requires it, HSBC Holdings plc agrees to ensure that its wholly-owned subsidiaries, and any successors and assigns, comply with the requirements and obligations set forth in this Agreement, to the full extent permissible under locally applicable laws and regulations, and the instructions of local regulatory agencies.

Complete Agreement

25.      This Agreement sets forth all the terms of the agreement between the HSBC Parties and the Department. No amendments, modifications or additions to this Agreement shall be valid unless they are in writing and signed by the Department, the attorneys for the HSBC Parties and a duly authorized representative of the HSBC Parties.

24

FOR HSBC Bank USA, N.A. and HSBC Holdings plc:

25

FOR THE DEPARTMENT OF JUSTICE:

26

BANK OFFICER’S CERTIFICATE

I have read this Agreement and carefully reviewed every part of it with outside counsel for HSBC Bank USA, N.A. (the “Bank”). I understand the terms of this Agreement and voluntarily agree, on behalf of the Bank, to each of its terms. Before signing this Agreement, I consulted outside counsel for the Bank. Counsel fully advised me of the rights of the Bank, of possible defenses, and of the consequences of entering into this Agreement.

I have carefully reviewed the terms of this Agreement with the Board of Directors of the Bank. I have advised and caused outside counsel for the Bank to advise the Board of Directors fully of the rights of the Bank, of possible defenses, and of the consequences of entering into the Agreement.

No promises or inducements have been made other than those contained in this Agreement. Furthermore, no one has threatened or forced me, or to my knowledge any person authorizing this Agreement on behalf of the Bank, in any way to enter into this Agreement.

I am also satisfied with outside counsel’s representation in this matter. I certify that I am the Senior Executive Vice President and General Counsel for the Bank and that I have been duly authorized by the Bank to execute this Agreement on behalf of the Bank.

27

Nothing in this Certificate is intended nor shall it be deemed as a waiver by the Bank of the attorney-client privilege or work product protection.

Date: December 10, 2012

28

COMPANY OFFICER’S CERTIFICATE

I have read this Agreement and carefully reviewed every part of it with outside counsel for HSBC Holdings plc (the “Company”). I understand the terms of this Agreement and voluntarily agree, on behalf of the Company, to each of its terms. Before signing this Agreement, I consulted outside counsel for the Company. Counsel fully advised me of the rights of the Company, of possible defenses, and of the consequences of entering into this Agreement.

I have carefully reviewed the terms of this Agreement with the Board of Directors of the Company. Internal and External counsel have advised the Board of Directors fully of the rights of the Company, of possible defenses, and of the consequences of entering into the Agreement.

No promises or inducements have been made other than those contained in this Agreement. Furthermore, no one has threatened or forced me, or to my knowledge any person authorizing this Agreement on behalf of the Company, in any way to enter into this Agreement.

I am also satisfied with outside counsel’s representation in this matter. I certify that I am the Group Chief Risk Officer for the Company and that I have been duly authorized by the Company to execute this Agreement on behalf of the Company.

29

Nothing in this Certificate is intended nor shall it be deemed as a waiver by the Company of the attorney-client privilege or work product protection.

Date: December 10, 2012

30

CERTIFICATE OF COUNSEL

I am counsel for HSBC Bank USA, N.A. and HSBC Holdings plc (collectively, the “Bank”) in the matter covered by this Agreement. In connection with such representation, I have examined relevant Bank documents and have discussed the terms of this Agreement with the Bank’s Boards of Directors. Based on our review of the foregoing materials and discussions, I am of the opinion that the representatives of the Bank have been duly authorized to enter into this Agreement on behalf of the Bank and that this Agreement has been duly and validly authorized, executed, and delivered on behalf of the Bank and is a valid and binding obligation of the Bank. Further, I have carefully reviewed the terms of this Agreement with the Boards of Directors of the Bank and the Senior Executive Vice President and General Counsel for HSBC Bank USA, N.A., and the Group Chief Risk Officer for HSBC Holdings plc. I have fully advised them of the rights of the Bank, of possible defenses, and of the consequences of entering into this Agreement. To my knowledge, the decision of the Bank to enter into this Agreement, based on the authorization of the Boards of Directors, is an informed and voluntary one.

Nothing in this Certificate is intended nor shall it be deemed as a waiver by the Bank of the attorney-client privilege or work product protection.

31

Date: December 10, 2012

32

CONSENT TO THE ASSESSMENT OF CIVIL MONEY PENALTY

I. INTRODUCTION

Under the authority of the Bank Secrecy Act and regulations issued pursuant to that Act, ¹ the Financial Crimes Enforcement Network has determined that grounds exist to assess a civil money penalty against HSBC Bank USA N.A. (“HBUS” or the “Bank”). HBUS consents to the assessment of a civil money penalty and enters this CONSENT TO THE ASSESSMENT OF CIVIL MONEY PENALTY (“CONSENT”) with the Financial Crimes Enforcement Network.

Pursuant to an investigation conducted by the Department of Justice (“DOJ”) concerning the transmission of funds to and from the United States through HBUS, HBUS has agreed to enter into a Deferred Prosecution Agreement (DPA) as a settlement agreement with the DOJ wherein HBUS admits that it violated 31 U.S.C. § 5318(h) and 31 C.F.R. § 1020.210, which makes it a crime to willfully fail to establish and maintain an effective anti-money laundering program, and 31 U.S.C. § 5318(i) and 31 C.F.R. § 1010.610, which makes it a crime to willfully

1

fail to establish due diligence policies, procedures, and controls for foreign correspondent accounts. As a consequence of these violations, HBUS also violated 31 U.S.C. § 5318(g) and 31 C.F.R. § 1020.320, which requires a financial institution to report any suspicious transaction relevant to a possible violation of law or regulation.

II. JURISDICTION

HBUS’s main office is located in McLean, Virginia, and the Bank is the principal U.S. banking subsidiary of HSBC USA Inc. (“HSBC USA”). HSBC USA is an indirect, wholly-owned subsidiary of HSBC North America Holdings Inc. (“HNAH”), one of the largest bank holding companies in the United States, with assets totaling approximately $317 billion. HNAH is an indirect, wholly-owned subsidiary of HSBC Holdings plc (together with its affiliates, the “HSBC Group”). HSBC Group is one of the world’s largest banking and financial services organizations, with assets of approximately $2.7 trillion, 60 million customers worldwide, and affiliates located in Europe, North America, Latin America, Africa, the Asia-Pacific region, and the Middle East.

HBUS has approximately $194 billion in assets and 300 branches. HBUS provides a full range of consumer and commercial bank services to customers in the United States and abroad, including clients of HSBC Group affiliates outside the United States.

The Financial Crimes Enforcement Network has authority to investigate banks for compliance with and violation of the Bank Secrecy Act pursuant to 31 C.F.R. § 1010.810, which grants the Financial Crimes Enforcement Network “overall authority for enforcement and compliance, including coordination and direction of procedures and activities of all other agencies exercising delegated authority under this chapter.” At all relevant times, the Bank was

2

a “financial institution” and a “bank” within the meaning of the Bank Secrecy Act and its implementing regulations. ²

III. DETERMINATIONS

The Financial Crimes Enforcement Network has determined that HBUS willfully violated the Bank Secrecy Act since at least mid-2006 by: (1) lacking an effective anti-money laundering program reasonably designed to manage risks of money laundering and other illicit activity, in violation of Title 31, United States Code, Section 5318(h) and 31 C.F.R. § 1020.210; (2) failing to conduct due diligence on certain foreign correspondent accounts, in violation of Title 31, United States Code, Section 5318(i) and 31 C.F.R. § 1010.610; and (3) failing to detect and adequately report evidence of money laundering and other illicit activity, in violation of Title 31, United States Code, Section 5318(g) and 31 C.F.R. § 1020.320.

Since April 24, 2002, the Bank Secrecy Act and its implementing regulations have required banks to establish and implement anti-money laundering programs. ³ A bank regulated by a Federal functional regulator is deemed to have satisfied Bank Secrecy Act anti-money laundering program requirements if it implements and maintains an anti-money laundering program that complies with the regulations of its Federal functional regulator. ⁴ The Office of the Comptroller of the Currency (“OCC”) is the Bank’s Federal functional regulator and examines HBUS for compliance with the Bank Secrecy Act and its implementing regulations and similar

3

rules under Title 12 of the United States Code. The OCC requires each bank under its supervision to establish and maintain an anti-money laundering program that, at a minimum, (a) provides for a system of internal controls to ensure ongoing compliance; (b) provides for independent testing for compliance conducted by bank personnel or by an outside party; (c) designates an individual or individuals responsible for coordinating and monitoring day-to-day compliance; and (d) provides training for appropriate personnel. ⁵

As discussed in detail below, HBUS violated the Bank Secrecy Act’s anti-money laundering program requirements by (i) conducting business without adequate internal controls, (ii) failing to conduct adequate independent testing for compliance, and (iii) failing to staff its Bank Secrecy Act compliance program with a reasonably sufficient number of qualified personnel.

HBUS provided a full range of consumer and commercial products and services to individuals, corporations, financial institutions, non-profit organizations, and governments in the United States and abroad, including in jurisdictions with weak anti-money laundering and counter-terrorist financing (“AML/CFT”) controls. HBUS did not effectively conduct enterprise-wide, risk-based assessments of potential money laundering risks, given its products, clients, and geographic reach, and HBUS failed to adequately identify potential money laundering vulnerabilities. The Bank’s failure to adequately assess risk negatively impacted the

4

effectiveness of its transaction monitoring, which already suffered from additional systemic weaknesses.

Product Risk. Some of the Bank’s products and services involved significant anti-money laundering risks, including but not limited to: correspondent accounts, embassy banking, wire transfers, automated clearinghouse (“ACH”) transfers, banknotes, lockboxes, clearing of bulk traveler’s checks, bearer share accounts, pre-paid cards, foreign exchange, cash letters, international pouch activity, and remote deposit capture. HBUS failed to take appropriate steps to adequately assess the AML/CFT risks posed with respect to many of its products and services.

For instance, the Bank failed to manage money laundering risks associated with its pouch services and did not provide for appropriate controls and monitoring to address the underlying risks posed by this transaction activity. In one example, until November 2008, the Bank cleared traveler’s checks received from a foreign respondent bank without monitoring systems in place that were reasonably designed to detect, investigate, and report evidence of money laundering. Several individuals purchased sequentially numbered traveler’s checks at a Russian bank in transactions totaling more than $290 million over several years. These traveler’s checks were signed in a uniform illegible scrawl and made payable to approximately 30 different customers of a Japanese bank. The Japanese bank was a HBUS correspondent customer and for several years regularly delivered multi-hundred-thousand-dollar batches of these sequentially numbered traveler’s checks to HBUS via pouch. During the relevant period of time, HBUS knew or should have known that uniformly signed, sequentially numbered traveler’s checks in such high volume are a money laundering “red flag.”

Customer Risk. The Bank’s written policies, procedures, and controls did not effectively risk rate customers. The Bank’s risk rating methodologies were not designed to

5

evaluate customers based on specific customer information and balanced consideration of all relevant factors, including country/jurisdictional risk, products and services provided, expected transaction volume, and nature of customer profiles. Failure to consistently gather reasonably accurate and complete customer documentation undermined the Bank’s ability to conduct customer risk assessments. These deficiencies prevented the Bank from performing adequate analysis of the risks associated with particular customers and from determining whether transactions lacked an apparent business or lawful purpose or fell within the particular customer’s normal and expected range of conduct.

For example, Group affiliate HSBC Mexico S.A. Banco (“HBMX”) was an HBUS respondent bank. The account that HBMX maintained with HBUS accepted bulk deposits of U.S. currency and processed wire transfers. HBMX operated in Mexico, a country that was the subject of publicly available cautionary information about drug trafficking and money laundering vulnerabilities. ⁶ HBMX’s branch in the Cayman Islands operated under a Cayman Islands Monetary Authority license limiting authority to do business to non-residents of the Cayman Islands. Potentially high-risk Mexican casas de cambio and other money transmitter and dollar-exchange businesses were HBMX customers. Despite these risks, until 2009, HBUS treated HBMX as a “standard” money laundering risk and did not effectively detect and report suspicious activity.

Country Risk. The Bank lacked adequate country risk rating processes reasonably designed to capture readily available information about countries’ AML/CFT risks and failed to ensure uniform compliance with risk rating standards through complete internal reviews. The

6

Bank lacked a precise structure to ensure systematic country risk assessments, including updates, as prudent and necessary, which resulted in HBUS making inappropriate country risk assessments in some instances. The Bank used four labels (“standard,” “medium,” “cautionary,” or “high” risk) to identify a country’s anti-money laundering risk. From 2002 until 2009, HBUS rated Mexico as having “standard” anti-money laundering risk, the lowest of the Bank’s four possible country risk ratings, despite publicly-available information to the contrary. In 2006, the Financial Crimes Enforcement Network issued an advisory, FIN-2006-A003, notifying financial institutions of the potential threat of narcotics-based money laundering between Mexico and the United States. In addition, the United States Department of State International Narcotics Control Strategy Reports dating back to 2002 have consistently rated Mexico as a country of primary concern for money laundering and financial crimes. The inappropriate country risk rating, together with other AML/CFT deficiencies, including the monitoring failures described below, resulted in HBUS failing to identify and thereby facilitating the flow of illicit proceeds between Mexico and the United States.

Transaction Monitoring. HBUS failed to implement and maintain an adequate transaction monitoring regime reasonably designed to detect and report money laundering and other illicit activity. The transaction monitoring procedures failed in a number of ways, including but not limited to:

7

8

The Bank’s independent audit program repeatedly failed to effectively evaluate money laundering vulnerabilities and to detect Bank Secrecy Act compliance failures in a timely fashion. In particular, the scope of its independent audits was not sufficient to effectively assess the Bank’s exposure to risk of money laundering activities and its ability to comply with anti-money laundering program and suspicious activity reporting obligations. The ineffectiveness of independent testing at HBUS to identify and notify management of AML/CFT deficiencies contributed to the continuation of failures at the Bank, during the relevant period.

HBUS failed to ensure adequate staffing for the proper monitoring of day-to-day compliance with the Bank Secrecy Act. The compliance operation lacked continuity and sufficient standing or authority within the Bank to effectively execute Bank Secrecy Act responsibilities, in light of the Bank’s AML/CFT risk profile. For a number of years, HBUS’s Bank Secrecy Act compliance function suffered from an insufficient number of appropriately

9

trained professionals responsible for coordinating and monitoring day-to-day compliance. HBUS did not have sufficient staff to review suspicious activity alerts resulting from the Bank’s monitoring processes. The Bank’s compliance staff was frequently unable to initiate and complete investigations and file complete and timely suspicious activity reports. In light of the global risk profile of HBUS, Bank management failed to establish and maintain adequate staffing and continuity in the anti-money laundering compliance operation. Moreover, a corporate culture persisted at the Bank in the past that effectively denied compliance officials with the requisite authority over the business and account relationship business lines to manage the Bank’s risk profile.

In sum, HBUS failed to dedicate sufficient human and technological resources to meet its AML/CFT obligations. Such failures were repeatedly evidenced by the Bank’s deficient responses to adverse supervisory findings and mandates requiring it to implement effective measures to ensure the filing of accurate, timely, and complete suspicious activity reports and compliance with other Bank Secrecy Act requirements.

Foreign correspondent accounts are gateways to the U.S. financial system. As part of their anti-money laundering obligations, U.S. banks maintaining correspondent accounts in the United States for foreign financial institutions must subject the accounts and respondents to certain due diligence measures. ⁷ Banks must implement and maintain risk-based policies, procedures, and controls reasonably designed to gather all relevant due diligence information concerning such foreign correspondent accounts, employ this due diligence information to

10

determine whether an account is subject to enhanced due diligence, conduct assessments of money laundering risks for each account, and comply with suspicious activity reporting requirements. ⁸ HBUS violated the Bank Secrecy Act customer due diligence requirements by failing to collect or maintain required due diligence information regarding accounts held by HSBC Group affiliates that were foreign financial institutions.

HBUS maintained correspondent accounts for HSBC Group affiliates around the world. HBUS formerly did not collect or maintain customer due diligence information regarding any HSBC Group affiliates with correspondent account relationships at the Bank. HBUS’s prior policy of exempting HSBC Group affiliates from customer due diligence processes inhibited the Bank’s ability to recognize potential money laundering vulnerabilities of correspondent banking throughout the HSBC Group affiliates network. HBUS did not incorporate information about affiliates’ business purposes, anticipated activity, anti-money laundering supervision, host country anti-money laundering vulnerabilities, and history of anti-money laundering compliance into the Bank’s monitoring of affiliate transactions. As a result, transactions flowed to and from the United States without appropriate monitoring and alerts to identify movements of funds. A significant number of non-U.S. financial institutions and other customers of HSBC Group affiliates effectively gained indirect access to the U.S. financial system without appropriate safeguards, including financial institution customers involved in the movement of illicit drug proceeds.

The Bank Secrecy Act and its implementing regulations impose an obligation on banks to report transactions that involve or aggregate to at least $5,000, are conducted by, at, or through

11

the bank, and that the bank “knows, suspects, or has reason to suspect” are suspicious. ⁹ A transaction is “suspicious” if the transaction: (1) involves funds derived from illegal activities, or is conducted to disguise funds derived from illegal activities; (2) is designed to evade the reporting or recordkeeping requirements of the Bank Secrecy Act or regulations under the Bank Secrecy Act; or (3) has no business or apparent lawful purpose or is not the sort in which the customer would normally be expected to engage, and the bank knows of no reasonable explanation for the transaction after examining the available facts, including background and possible purpose of the transaction. ¹⁰ HBUS violated Bank Secrecy Act suspicious activity reporting requirements by failing to detect and report suspicious activity and by filing both untimely and incomplete suspicious activity reports.

HBUS showed a prior longstanding pattern of late suspicious activity reports. In many cases, the reports were significantly late. Indeed, several thousand suspicious activity reports prepared by HBUS suffered from lengthy delays. In some instances, more than a year elapsed between the time of the underlying activity and the time when the Bank submitted the suspicious activity report. In addition to late filings, the Bank in the past filed incomplete suspicious activity reports that violated the instructions for suspicious activity reports. Reporting delays and incomplete information impaired the usefulness of the suspicious activity reports to law enforcement and regulators.

For instance, HBUS engaged extensively in the business of buying and selling large volumes of physical banknotes (cash) from and to financial institutions around the world, including HSBC Group affiliates. This banknotes line of business required the Bank to arrange

12

for the regular delivery of large quantities of cash from financial institutions outside the United States to the Bank and ultimately to the Federal Reserve Bank. During 2006, the Financial Crimes Enforcement Network warned all U.S. financial institutions about money laundering risks associated with United States/Mexico cross-border cash. ¹¹ In addition, law enforcement authorities in the United States and Mexico determined that billions of U.S. dollars derived from illegal drug trafficking flowed annually from criminals through Mexican financial institutions to U.S. financial institutions. For example, drug traffickers in the United States were smuggling cash into Mexico and placing it into Mexican financial institutions. The Mexican financial institutions would then ship bulk cash to banks in the United States. Thus, HSBC Group affiliate HBMX shipped billions of dollars in bulk cash to HBUS’s banknotes business unit against a backdrop of readily available information that large volumes of cash emanating from deposits into Mexican banks were fueled by customers depositing cash from illegal drug trafficking. Despite this information, HBUS did not collect the necessary due diligence information about HBMX and, with occasional exceptions, excluded HBMX banknote transactions from anti-money laundering monitoring processes, from mid-2006 to mid-2009. As a result, the Bank failed to file timely suspicious activity reports related to these transactions.

HBUS suffered similar failures in its wire transfer business. The Bank processed an average of approximately 25 million wire transfers annually, from 2005 to 2009, with total dollar volume amounting to an average of approximately $75 trillion. A substantial portion of the Bank’s funds transfer business was on behalf of foreign correspondent financial institutions and

13

their clients. Yet, as described above, the Bank did not perform due diligence on foreign affiliates and improperly risk rated customers and countries, which resulted in ineffective monitoring, and, thus, a failure to file timely suspicious activity reports.

During 2010 and 2011, HBUS performed a historical review of transactions, known as a “lookback,” in connection with the 2010 Consent Cease and Desist Order by the OCC. As part of this lookback, HBUS sampled accounts, banknotes activity, wire transaction data, remote deposit capture, and pouch activity for suspicious activity. The Bank also re-reviewed thousands of transaction monitoring system alerts that were previously on backlog or which had previously been closed based on ineffective reviews. As a result, HBUS filed hundreds of delinquent suspicious activity reports on transactions totaling several billion dollars.

IV. CIVIL MONEY PENALTY

The Financial Crimes Enforcement Network has determined that a civil money penalty in the amount of $500 million is warranted for HBUS’s violations of the Bank Secrecy Act and its implementing regulations, as described in this CONSENT. ¹²

A penalty in the amount (not to exceed $100,000) involved in the transaction (if any) or $25,000 may be imposed on a financial institution for each violation of the anti-money laundering program or suspicious transaction reporting requirements. ¹³ A separate violation of the anti-money laundering program requirements occurs for each day the violation continues. A penalty equal to not less than two times the amount of the transaction, but not more than $1,000,000, may be imposed for violation of the requirement to establish due diligence policies,

14

procedures, and controls that are reasonably designed to detect and report instances of money laundering through a correspondent bank account for a non-U.S. person. ¹⁴

V. CONSENT TO ASSESSMENT

To resolve this matter, and only for that purpose, HBUS consents to the assessment of a civil money penalty in the sum of $500 million. The CONSENT shall be concurrent with the assessment of a civil money penalty, in the amount of $500 million, by the OCC, and shall be satisfied by one payment of $500 million to the Department of the Treasury.

HBUS agrees that it is entering into this CONSENT freely and voluntarily and that no offers, promises, or inducements of any nature whatsoever have been made by the Financial Crimes Enforcement Network or any employee, agent, or representative of the Financial Crimes Enforcement Network to induce HBUS to enter into this CONSENT, except those specified in this CONSENT.

HBUS agrees that this CONSENT embodies the entire agreement between HBUS and the Financial Crimes Enforcement Network relating to this enforcement matter only, as described in Section III above. HBUS further agrees that there are no express or implied promises, representations, or agreements between HBUS and the Financial Crimes Enforcement Network other than those expressly set forth in this document and that nothing in this document or in the ASSESSMENT OF CIVIL MONEY PENALTY (“ASSESSMENT”) is binding on any other agency of government, whether federal, state, or local.

VI. RELEASE

HBUS understands that execution of this CONSENT, and compliance with the terms of the ASSESSMENT and this CONSENT, constitute a complete settlement and release of civil

15

liability for the violations of the Bank Secrecy Act and regulations issued pursuant to that Act as described in this CONSENT against the Bank.

VII. WAIVERS

Nothing in this CONSENT or the ASSESSMENT shall preclude any proceedings brought by the Financial Crimes Enforcement Network to enforce the terms of this CONSENT or the ASSESSMENT or constitute a waiver of any right, power, or authority of any other representatives of the United States or agencies thereof, including but not limited to the Department of Justice, to bring other actions deemed appropriate.

In executing this CONSENT, HBUS waives:

//

//

//

//

//

//

//

16

17

Exhibit 99.3

Undertaking from HSBC Holdings plc to the Financial Services Authority

HSBC Holdings plc (“Holdings”) undertakes to the Financial Services Authority (“FSA”) to:

1

2

3

Holdings further agrees:

Holdings understands and accepts that failure to comply with these undertakings is relevant to:

4

5

Exhibit 99.4

DEFERRED PROSECUTION AGREEMENT

HSBC Holdings plc (“HSBC Holdings”) is a financial institution holding company registered and organized under the laws of England and Wales. HSBC Holdings, by and through its undersigned representatives pursuant to authority granted by HSBC Holdings’ Board of Directors, and the District Attorney of the County of New York (“DANY”), enter into this Deferred Prosecution Agreement (the “Agreement”). HSBC Holdings agrees to enter into a separate Deferred Prosecution Agreement with the United States Department of Justice (the “Department”).

1. HSBC Holdings agrees that it shall in all respects comply with its obligations under this Agreement.

2. HSBC Holdings accepts and acknowledges responsibility for the conduct of its officers, directors, employees, and agents as set forth in the Factual Statement attached hereto as Exhibit A and incorporated herein by reference (the “Factual Statement”). If DANY initiates a prosecution that is deferred by this Agreement against HSBC Holdings, HSBC Holdings agrees that it will neither contest the admissibility of the Factual Statement or any other documents provided by HSBC Holdings to DANY, nor contradict in any such proceedings the facts contained in the Factual Statement.

3. As a result of the conduct set forth in the Factual Statement, DANY has determined that it could institute a criminal prosecution against HSBC Holdings pursuant to New York State Penal Law Section 175.10, and a forfeiture action against certain funds currently held by HSBC Holdings, and that such funds could be forfeitable under New York State law. Therefore, HSBC Holdings hereby expressly agrees to settle, and does settle, any and all criminal and forfeiture claims DANY has determined it could institute against those funds for the sum of $375,000,000 (the “Settlement Amount”). The parties to this Agreement agree that the

Settlement Amount will fully satisfy all claims currently held by DANY based upon the conduct set forth in the Statement of Facts. ¹

4. In consideration of HSBC Holdings’ voluntary cooperation with this investigation, its remedial actions to date, and its willingness to: (i) acknowledge and accept responsibility for the actions of its officers, directors, employees, and agents as set forth in the Factual Statement; (ii) voluntarily terminate the conduct set forth in the Factual Statement prior to the commencement of DANY’s investigation; (iii) continue to provide to DANY substantial cooperation in any ongoing investigation of the conduct of HSBC Holdings’ current or former officers, directors, employees, agents, and consultants; (iv) engage in remediation and training as outlined in Paragraph 13; and (v) settle any criminal claims currently held by DANY for any act within the scope of the Factual Statement; DANY agrees as follows:

(a) that it shall defer prosecution of HSBC Holdings for a period of twenty-four (24) months from the date of this Agreement, or less at the sole discretion of DANY. DANY shall not prosecute HSBC Holdings for any conduct detailed in the Factual Statement if HSBC Holdings complies with all its obligations pursuant to this Agreement; and

(b) that if HSBC Holdings is in compliance with all its obligations under this Agreement for the time period set forth above in Paragraph 4(a), this Agreement shall expire and be of no further force or effect.

5. HSBC Holdings expressly agrees that within six (6) months of determination by DANY that a material and willful breach by HSBC Holdings of this Agreement has occurred,

2

any violations of New York State law that were not time-barred by the applicable statute of limitations as of the date of this Agreement, and which relate to the facts set forth in the Factual Statement may, in the sole discretion of DANY, be charged against HSBC Holdings, notwithstanding the provisions or expiration of any applicable statute of limitations. HSBC Holdings expressly waives any challenges to the venue and jurisdiction of the Supreme Court of the State of New York for the County of New York.

6. HSBC Holdings expressly agrees that it shall not, through its attorneys, board of directors, agents, officers, or employees, make any public statement contradicting the acceptance of responsibility by HSBC Holdings set forth above or any statement of fact contained in the Factual Statement. Any such public statements by HSBC Holdings, its attorneys, board of directors, agents, officers, or employees, shall constitute a material breach of this Agreement, and HSBC Holdings would thereafter be subject to prosecution pursuant to the terms of this Agreement. The decision about whether any public statement by any such person contradicting the acceptance of responsibility by HSBC Holdings set forth above or any fact contained in the Factual Statement will be imputed to HSBC Holdings, for the purpose of determining whether HSBC Holdings has breached this Agreement, shall be in the sole and reasonable discretion of DANY. Upon DANY’s notification to HSBC Holdings of a public statement by any such person that in whole or in part contradicts the acceptance of responsibility by HSBC Holdings set forth above or any statement of fact contained in the Factual Statement, HSBC Holdings may avoid breach of this Agreement by publicly repudiating such statement within seventy-two (72) hours of notification by DANY. This paragraph is not intended to apply to any statement made by any individual in the course of any criminal, regulatory, or civil case initiated by a governmental or private party against such individual regarding that individual’s personal conduct, nor does this

3

paragraph affect HSBC Holdings’ right to take legal or factual positions in litigation or other legal proceedings in which the United States or DANY is not a party.

7. Should DANY determine, during the term of this Agreement, that HSBC Holdings has committed any New York State crime after the date of the signing of this Agreement, HSBC Holdings shall, in the sole discretion of DANY, thereafter be subject to prosecution for any such crimes, including but not limited to the conduct described in the Factual Statement. The discovery by DANY of any purely historical criminal conduct that did not take place during the term of the Agreement will not constitute a breach of the Agreement.

8. Should DANY determine that HSBC Holdings has committed a willful and material breach of any provision of this Agreement, DANY shall provide written notice to HSBC Holdings of the alleged breach and allow HSBC Holdings a thirty (30) day period from the date of receipt of said notice, or longer, at the discretion of DANY, to cure the breach by making a presentation to DANY that demonstrates that no breach has occurred, or, to the extent applicable, that the breach is not willful or material, or has been cured. The parties hereto expressly understand and agree that, should HSBC Holdings fail to make the above-noted presentation within such time period, it shall be presumed that HSBC Holdings is in material breach of this Agreement. The parties further understand and agree that the exercise of discretion by DANY under this paragraph is not subject to review in any court or tribunal. In the event of a breach of this Agreement that results in a prosecution, such prosecution may be premised upon any information provided by or on behalf of HSBC Holdings to DANY or the United States at any time, unless otherwise agreed when the information was provided.

9. DANY agrees that it shall not seek to prosecute HSBC Holdings or any of its corporate parents, subsidiaries, affiliates, successors, predecessors, and assigns for any act within

4

the scope of or related to the Factual Statement, that violated New York State law during the period set forth in the Factual Statement. This Paragraph does not provide protection against prosecution of HSBC Holdings, or any of its affiliates, successors, related companies, employees, officers, or directors, acting within the scope of their employment and for the benefit of HSBC Holdings, who knowingly and willfully transmitted or approved the transmission of United States Dollar (“USD”) denominated funds through the United States, or involving a U.S. person, in violation of New York State law, that went to, came from, or involved persons or entities designated at the time of the transaction by the Office of Foreign Assets Control (“OFAC”) as a Specially Designated Terrorist, a Specially Designated Global Terrorist, a Foreign Terrorist Organization, or a proliferator of Weapons of Mass Destruction (a “Special SDN Transaction”), except insofar as such transactions occurred during the period set forth in the Factual Statement and were disclosed to DANY during the course of this investigation and prior to the execution of this Agreement. Any prosecution related to a Special SDN Transaction may be premised upon any information provided by or on behalf of HSBC Holdings to DANY or any investigative agency, whether prior to or subsequent to this Agreement, or any leads derived from such information, including information contained in the Statement of Facts. HSBC Holdings agrees that it shall waive the provisions of Article 30 of the Criminal Procedure Law of New York State with respect to such conduct for a period of eighteen (18) months from the date of this Agreement.

10. HSBC Holdings agrees that, if it sells, merges, or transfers all or substantially all of its business operations or assets as they exist as of the date of this Agreement to a single purchaser or group of affiliated purchasers during the term of this Agreement, it shall include in any contract for sale, merger, or transfer a provision binding the purchaser/successor/transferee

5

to the obligations described in this Agreement. Any such provision in a contract of sale, merger, or transfer shall not expand or impose additional obligations on HSBC Holdings or the purchaser/successor/transferee beyond those contained in the Agreement, including but not limited to HSBC Holdings’ obligations as described in Paragraphs 13 and 14.

11. It is understood that nothing in this Agreement shall require HSBC Holdings to extend the obligations in this Agreement to any company or entity that it acquires after the date of this Agreement, and this Agreement shall not extend any protections to any such company or entity.

12. HSBC Holdings agrees that for the term of this Agreement, in accordance with applicable laws, it shall, upon request of DANY, supply any relevant documents, electronic data, or other objects in HSBC Holdings’ possession, custody, or control, as of the date of this Agreement relating to any transaction within the scope of or relating to the Factual Statement and known to HSBC Holdings at the time of the signing of this Agreement. If such data is in electronic format, HSBC Holdings shall provide access to such data and assistance in operating any computer and other equipment that is necessary to retrieve the data. This obligation shall not include production of materials covered by the attorney-client privilege, the work product doctrine, or other applicable confidentiality, criminal, or data protection laws except as provided herein. To the extent that HSBC Holdings believes in good faith that such materials are covered by any confidentiality, criminal, or data protection laws, HSBC Holdings shall use its best efforts to produce such materials, including supporting an application made by DANY to the appropriate governmental agency or court, for authority to provide DANY with the requested materials, provided that HSBC Holdings shall not be required to produce any materials where such production would be in breach of applicable local law. At the request of DANY, HSBC

6

Holdings shall provide a written memorandum explaining the operation and application of any local law where HSBC Holdings concludes that it would be unlawful to directly or indirectly produce the materials to DANY.

13. HSBC Holdings further agrees that it shall:

(a) continue to cooperate fully with DANY in any and all investigations of HSBC Holdings or any of its present and former officers, directors, employees, agents, and consultants, or any other party, started prior to the signing of this Agreement;

(b) use its good faith efforts to make available, at HSBC Holdings’ cost, current and former HSBC Holdings directors, officers, employees, consultants, representatives, and agents when requested by DANY to provide additional information and materials concerning any and all investigations started prior to the signing of this Agreement; to give sworn testimony, including before any grand jury or in any judicial proceeding; and to be interviewed by law enforcement authorities. Cooperation under this Paragraph shall include identification of witnesses who, to the knowledge of HSBC Holdings, may have material information regarding these matters;

(c) provide any information, materials, documents, databases, or transaction data in HSBC Holdings’ possession, custody, or control requested by DANY in connection with the investigation or prosecution of any current or former officers, directors, employees, agents, and consultants, started prior to the signing of this Agreement;

(d) continue to apply the OFAC sanctions list to the same extent as any United Nations (“U.N.”) or European Union (“E.U.”) sanctions or freeze lists to USD transactions, the acceptance of customers, and all USD cross-border Society for Worldwide Interbank Financial

7

Telecommunications (“SWIFT”) incoming and outgoing messages involving payment instructions or electronic transfer of funds;

(e) implement compliance procedures and training designed to ensure that the HSBC Holdings compliance officer in charge of sanctions is made aware in a timely manner of any known requests or attempts by any entity (including, but not limited to, HSBC Holdings’ customers, financial institutions, companies, organizations, groups, or persons) to withhold or alter its name or other identifying information where the request or attempt appears to be related to circumventing or evading U.S. sanctions laws. HSBC Holdings’ Head of Compliance, or his or her designee, shall report to DANY the name and contact information, if available to HSBC Holdings, of any entity that makes such a request;

(f) maintain the electronic database of SWIFT Message Transfer (“MT”) payment messages and all documents and materials produced by HSBC Holdings to DANY as part of this investigation relating to USD payments processed during the period from 2001 through 2007 in electronic format for a period of two years from the date of this Agreement;

(g) notify DANY of any criminal, civil, administrative, or regulatory investigation or action involving HSBC Holdings, its current directors, officers, employees, consultants, representatives, and agents, and related to U.S. sanctions;

(h) provide information, materials, and testimony as necessary or requested to identify or to establish the original location, authenticity, or other basis for admission into evidence of documents or physical evidence in any criminal or judicial proceeding;

(i) by September 30, 2013, certify that HSBC Holdings has rolled out and completed Financial Economic Crime sanctions training, to include training that covers U.S., U.N., and E.U. sanctions and trade control laws, for all employees, including officers, (1) involved in the

8

processing or investigation of USD payments; (2) involved in the execution of USD denominated securities trading orders; and (3) involved in transactions or business activities involving any nation or entity subject to U.S., E.U. or U.N. sanctions, including the execution of cross-border payments;

(j) by June 30, 2013, certify that HSBC Holdings has implemented a written policy to require the use of the SWIFT MT 202COV bank-to-bank payment message where appropriate under SWIFT guidelines; and

(k) abide by any and all requirements of the settlement agreements, dated December 10, 2012 by and between OFAC and HSBC Holdings, and the Office of the Comptroller of the Currency and HSBC Bank USA, N.A., regarding remedial measures or other required actions related to this matter.

14. It is understood that this Agreement is binding on HSBC Holdings and DANY only, and specifically does not bind any federal agency or any state or local authorities. DANY will bring the cooperation of HSBC Holdings and its compliance with its other obligations under this Agreement to the attention of any federal, state, or local prosecuting office or regulatory agency, if requested by HSBC Holdings or its attorneys.

15. It is further understood that this Agreement does not relate to or cover any conduct by HSBC Holdings other than that disclosed during the course of the investigation related to the Factual Statement and this Agreement, and it does not relate to or cover any conduct by HSBC Holdings involving Special SDN Transactions, except insofar as such transactions occurred during the period set forth in the Factual Statement and were disclosed to DANY during the course of this investigation and prior to the execution of this Agreement.

9

16. Nothing in this Agreement shall prohibit any federal agency or department, or any state or local government from pursuing any criminal, civil, administrative, or regulatory action against any current or former directors, officers, employees, or agents of HSBC Holdings or against any other entities or individuals. The parties to this Agreement intend that the Agreement does not confer or provide any benefits, privileges, immunities, or rights to any other individual or entity other than the parties hereto.

17. HSBC Holdings and DANY agree that this Agreement and the Factual Statement shall be disclosed to the public.

18. This Agreement sets forth all the terms of the Deferred Prosecution Agreement between HSBC Holdings and DANY. There are no promises, agreements, or conditions that have been entered into other than those expressly set forth in this Agreement, and none shall be entered into and/or bind HSBC Holdings or DANY unless expressly set forth in writing, signed by DANY, HSBC Holdings’ attorneys, and a duly authorized representative of HSBC Holdings. This Agreement supersedes any prior promises, agreements, or conditions between HSBC Holdings and DANY. HSBC Holdings agrees that it has the full legal right, power, and authority to enter into and perform all of its obligations under this Agreement, and it agrees to abide by all the terms and obligations of the Agreement as described herein.

10

Acknowledgment

I, Marc Moses, the duly authorized representative of HSBC Holdings plc, hereby expressly acknowledge the following: (1) that I have read this entire Agreement, as well as the other documents filed herewith, including the Factual Statement; (2) that I have had an opportunity to discuss this Agreement fully and freely with HSBC Holdings plc’s attorneys; (3) that HSBC Holdings plc fully and completely understands each and every one of its terms; (4) that HSBC Holdings plc is fully satisfied with the advice and representation provided to it by its counsel, Cahill Gordon & Reindel LLP and Sullivan & Cromwell LLP; (5) that I am authorized on behalf of HSBC Holdings plc to enter into this Agreement; and (6) that HSBC Holdings plc has signed this Agreement voluntarily.

11

Counsel for HSBC Holdings plc.

We, David N. Kelley and Samuel W. Seymour, the attorneys for HSBC Holdings plc, hereby expressly acknowledge the following: (1) that we have discussed this Agreement with our client; (2) that we have fully explained each one of its terms to our client; (3) that we have fully answered each and every question put to us by our client regarding the Agreement; and (4) we believe our client completely understands all of the Agreement’s terms.

12

New York County District Attorney’s Office

13

WHEREAS, HSBC Holdings plc, London, United Kingdom (“Holdings”), a registered bank holding company, is a large complex financial organization that has a number of separate business lines and legal entities in many countries around the world;

WHEREAS, Holdings conducts its operations in the United States through its indirectly wholly owned U.S. subsidiary, HSBC North America Holdings Inc., New York, New York (“HNAH”), a registered bank holding company;

WHEREAS, HNAH indirectly owns and controls HSBC Bank USA, National Association, McLean, Virginia (“HBUS”) and various other bank and nonbank subsidiaries;

WHEREAS, Holdings has a consolidated global compliance program that oversees compliance by its affiliates with applicable laws, rules, and regulations, including the affiliates’ policies, procedures, and practices relating to compliance with anti-money laundering and sanction laws and regulations;

WHEREAS, HNAH has adopted a firm-wide compliance risk management program designed to identify and manage compliance risks across the consolidated U.S. organization, including HNAH and its subsidiaries, related to compliance with all applicable laws, rules, and

regulations, including the Bank Secrecy Act (the “BSA”) (31 U.S.C. § 5311 et seq .); the rules and regulations issued thereunder by the United States Department of Treasury (31 C.F.R. Chapter X); and the regulations issued by the appropriate federal supervisors of HNAH and its subsidiaries (the “BSA/AML Requirements”);

WHEREAS, on October 4, 2010, HNAH consented to the issuance of a Cease and Desist Order by the Board of Governors of the Federal Reserve System (the “Board of Governors”) designed to correct deficiencies with its firm-wide compliance risk-management program and to address compliance with applicable United States federal and state laws, rules, and regulations, including the BSA/AML Requirements;

WHEREAS, on October 6, 2010, HBUS consented to the issuance of a Cease and Desist Order by the Office of the Comptroller of the Currency designed to remedy deficiencies in HBUS’s BSA/AML compliance program;

WHEREAS, the United States Department of Justice (the “DOJ”) has been conducting an investigation into the practices of Holdings concerning the transmission of funds through HBUS, including by and through entities and individuals subject to sanctions regimes imposed under the International Emergency Economic Powers Act (“IEEPA”), 50 U.S.C. §§ 1701-06, and the Trading with the Enemy Act (“TWEA”), 50 U.S.C. §§ 5, 16, both of which are administered by the Office of Foreign Assets Control of the United States Department of the Treasury (“OFAC”). In order to resolve the investigation, Holdings and HBUS have agreed to enter into a Deferred Prosecution Agreement (“DPA”) with the DOJ, wherein:

A. HBUS admits that it violated the BSA by willfully failing to establish and maintain an effective AML program and willfully failing to establish due diligence for foreign correspondent accounts; and

2

B. Holdings admits that it violated TWEA by willfully violating or attempting to violate any regulation issued under TWEA, including regulations restricting transactions with Cuba. Holdings further admits that it violated IEEPA by willfully violating or attempting to violate any regulation issued under IEEPA, including regulations restricting transaction with Iran, Libya, Sudan, and Burma.

WHEREAS, after entry of the 2010 Cease and Desist Orders, the Board of Governors obtained information supporting allegations that:

A. Holdings lacked adequate risk management and legal review policies and procedures to ensure compliance with applicable United States law. As a result:

1. Between 2006 and 2009, Holdings’s banking subsidiary in Mexico, HSBC Mexico (“HBMX”), was able to engage in a substantial number of high-risk transactions with HBUS while maintaining an inadequate system of internal controls to manage the risk of money laundering. Holdings officials failed to communicate certain negative findings in internal audits of HBMX and concerns raised by foreign governing bodies regarding the AML practices of HBMX to HNAH and HBUS appropriate legal and compliance staff in the United States, while simultaneously maintaining firm-wide standards and policies that discouraged HBUS from conducting appropriate levels of due diligence and monitoring of the bank’s foreign correspondent accounts; and

2. From at least 2001 to 2007, Holdings’s banking subsidiaries in Europe, HSBC Bank plc (“HBEU”), and the Middle East, HSBC Bank Middle East (“HBME”), moved, or permitted to be moved, illegally several hundred million dollars through the U.S. financial system on behalf of banks located in Cuba, Iran, Libya, Sudan, and Burma, and persons listed as parties or jurisdictions sanctioned by OFAC in violation of U.S. economic sanctions in a manner

3

that circumvented the system established by HBUS for ensuring compliance with the laws of the United States, including the regulations issued by OFAC (31 C.F.R. Chapter V) (the “OFAC Regulations”). Holdings failed to adequately review the procedures used by HBEU and HBME to determine whether these transactions were carried out in a manner consistent with U.S. law.

B. Between 2006 and 2010, HBUS failed to maintain internal controls, staffing and resources sufficient to adequately identify and mitigate the risks associated with high risk transactions conducted through the bank’s foreign correspondent accounts, especially those relating to the bank’s Mexican affiliate. In this regard, HNAH failed to ensure that HBUS had an adequate process to identify high risk customers and countries that may be potentially associated with money-laundering or terrorist financing.

WHEREAS, to address the deficiencies described above, Holdings must implement improvements in its oversight and compliance program with respect to the BSA/AML Requirements and OFAC Regulations for activities involving HNAH and its subsidiaries, including transactions with non-U.S. affiliates of HNAH that impact HNAH’s ability to comply with applicable BSA/AML Requirements and OFAC Regulations;

WHEREAS, the Board of Governors and Holdings have the common goal to ensure that Holdings and HNAH comply with United States laws, rules, and regulations that apply to the activities of the HNAH organization and that Holdings fosters a strong commitment towards compliance;

WHEREAS, the Board of Governors is issuing this consent Order to Cease and Desist against Holdings (the “Order”);

4

WHEREAS, the United Kingdom’s Financial Services Authority (“FSA”) has agreed to assist the Board of Governors as set out in paragraphs 2(b), 2(c), 3 and 5(a) of this Order as permitted by the FSA’s functions under the Financial Services and Markets Act 2000; and

WHEREAS, on December 10, 2012, the Board of Directors of Holdings adopted a resolution authorizing and directing Marc M. Moses, Group Chief Risk Officer of Holdings to enter into this Order on behalf of Holdings, consenting to compliance by Holdings and its institution-affiliated parties, as defined in sections 3(u) and 8(b)(4) of the Federal Deposit Insurance Act, as amended (12 U.S.C. §§ 1813(u) and 1818(b)(4)), with each and every provision of this Order, and waiving any and all rights that Holdings may have pursuant to 12 U.S.C. § 1818, 12 C.F.R. Part 263, or otherwise to: (i) the issuance of a Notice of Charges and of Hearing on any matter set forth in this Order; (ii) a hearing for the purpose of taking evidence of any matters set forth in this Order; (iii) judicial review of this Order, and (iv) to challenge or contest, in any manner, the basis, issuance, validity, terms, effectiveness or enforceability of this Order or any provision hereof.

NOW, THEREFORE, before the filing of any notices, or taking of any testimony or adjudication of or finding on any issues of fact or law herein, and without this Order constituting an admission or denial by Holdings of any allegation made or implied by the Board of Governors in connection with this matter, and solely for the purpose of settling this matter without a formal proceeding being filed and without the necessity for protracted or extended hearings or testimony, it is hereby ordered, pursuant to sections 8(b)(1) and (4) of the FDI Act (12 U.S.C. §§1818(b)(1) and 1818(b)(4)), that:

5

U.S. Law Compliance Program

1. Within 120 days of this Order, Holdings shall submit to the Federal Reserve Bank of Chicago (the “Reserve Bank”) an acceptable compliance program, including a timetable for implementation (the “ U.S. Law Compliance Program”), that shall, at a minimum, provide for:

BSA/AML compliance elements

(a) Measures to ensure that Holdings and its global subsidiaries appropriately identify and communicate activities or deficiencies within its operations that may impact the ability of U.S. subsidiaries to comply with BSA/AML Requirements;

(b) policies and procedures that require the escalation of significant issues related to BSA/AML Requirements to appropriate senior officers for resolution;

OFAC compliance elements

(c) during the term of this Order, an annual assessment of OFAC compliance risks arising from the global business activities and customer base of Holdings subsidiaries, including risks arising from transaction processing and trade finance activities conducted by or through Holdings’s global operations;

(d) policies and procedures to ensure compliance with OFAC Regulations by Holdings’s global business lines, including screening with respect to transaction processing and trade financing activities for the direct and indirect customers of Holdings subsidiaries;

(e) the establishment of an OFAC compliance reporting system that is widely publicized within the global organization and integrated into Holdings’s other reporting systems in which employees report known or suspected violations of OFAC Regulations, and that includes a process designed to ensure that known or suspected OFAC violations are promptly escalated to appropriate compliance personnel for appropriate resolution and reporting;

6

(f) procedures to ensure that the OFAC compliance elements of the U.S. Law Compliance Program are adequately staffed and funded;

(g) training for Holdings employees in OFAC-related issues appropriate to the employee’s job responsibilities that is provided on an ongoing, periodic basis; and

(h) an audit program designed to test for compliance with OFAC.

2. (a) During the term of this Order, to ensure that the OFAC compliance elements of the U.S. Law Compliance Program are functioning effectively to detect, correct, and report OFAC sanction transactions when they occur, Holdings shall conduct on an annual basis: (i) a review of OFAC compliance policies and procedures and their implementation, and (ii) an appropriate risk-focused sampling of U.S. dollar payments (the “OFAC Compliance Review”).

(b) The OFAC Compliance Review, the first of which shall commence one year after the date of this Order, shall be conducted by an independent consultant acceptable to the Reserve Bank and the FSA. No later than 30 days before the scheduled commencement of the OFAC Compliance Review, Holdings shall submit an engagement letter acceptable to the Reserve Bank and the FSA that details the independent consultant’s scope of work.

(c) Each OFAC Compliance Review shall be conducted in accordance with generally accepted auditing standards and the results of each review shall be submitted to the Reserve Bank and the FSA within 90 days of the anniversary date of this Order.

3. Within 60 days of the Reserve Bank’s approval of the U.S. Law Compliance Program required by paragraph 1, Holdings shall complete a global OFAC risk assessment with particular attention to transactions involving group affiliates. A copy of the risk assessment shall be submitted to the Reserve Bank and the FSA upon its completion.

7

Compliance with the Order

4. Within 30 days after the end of each calendar quarter following the date of this Order, Holdings shall submit to the Reserve Bank written progress reports detailing the form and manner of all actions taken to secure compliance with this Order and the results thereof.

Approval and Implementation of Program

5. (a) Holdings shall submit the written enhanced U.S. Law Compliance Program that is acceptable to the Reserve Bank within the time period set forth in paragraph 1 of this Order. An independent consultant acceptable to the Reserve Bank and the FSA shall be retained within the time period set forth in paragraph 2(b) of this Order. An engagement letter acceptable to the Reserve Bank and the FSA shall be submitted within the time period set forth in paragraph 2(b) of this Order.

(b) Within 10 days of approval by the Reserve Bank, Holdings shall adopt the approved U.S. Law Compliance Program. Upon adoption, Holdings shall promptly implement the approved program, and thereafter fully comply with it.

(c) During the term of this Order, the approved program and engagement letter shall not be amended or rescinded without the prior written approval of the Reserve Bank.

Communications

6. All communications regarding this Order shall be addressed to:

Assistant Vice President

Federal Reserve Bank of Chicago

230 South LaSalle Street

Chicago, Illinois 60604-1413

Global General Counsel – Litigation and Regulatory Affairs

HSBC Holdings plc

8 Canada Square

41st Floor

London, United Kingdom E145HQ

8

Miscellaneous

7. Notwithstanding any provision of this Order to the contrary, the Reserve Bank may, in its sole discretion, grant written extensions of time to Holdings to comply with this Order.

8. The provisions of this Order shall be binding upon Holdings and its institution-affiliated parties, in their capacities as such, and their successors and assigns.

9. Each provision of this Order shall remain effective and enforceable until stayed, modified, terminated, or suspended in writing by the Reserve Bank.

10. The provisions of this Order shall not bar, estop, or otherwise prevent the Board of Governors, the Reserve Bank, or any other federal or state agency from taking any other action affecting Holdings, HNAH, any subsidiary thereof, or any of their current or former institution-affiliated parties and their successors and assigns.

By order of the Board of Governors of the Federal Reserve System, effective this 11 ^th day of December, 2012.

9

WHEREAS, HSBC Holdings plc, London, United Kingdom (“Holdings”), a registered bank holding company, is a large complex financial organization that has a number of separate business lines and legal entities in many countries around the world;

WHEREAS, Holdings conducts its operations in the United States through its indirectly wholly owned U.S. subsidiary, HSBC North America Holdings Inc., New York, New York (“HNAH”), a registered bank holding company;

WHEREAS, HNAH indirectly owns and controls HSBC Bank USA, National Association, McLean, Virginia (“HBUS”) and various other bank and nonbank subsidiaries;

WHEREAS, Holdings has a consolidated global compliance program that oversees compliance by its affiliates with applicable laws, rules, and regulations, including the affiliates’ policies, procedures, and practices relating to compliance with anti-money laundering and sanction laws and regulations;

WHEREAS, HNAH has adopted a firm-wide compliance risk management program designed to identify and manage compliance risks across the consolidated U.S. organization,

including HNAH and its subsidiaries, related to compliance with all applicable laws, rules, and regulations, including the Bank Secrecy Act (the “BSA”) (31 U.S.C. § 5311 et seq.); the rules and regulations issued thereunder by the United States Department of Treasury (31 C.F.R. Chapter X); and the regulations issued by the appropriate federal supervisors of HNAH and its subsidiaries (the “BSA/AML Requirements”);

WHEREAS, on October 4, 2010, HNAH consented to the issuance of a Cease and Desist Order by the Board of Governors of the Federal Reserve System (the “Board of Governors”) designed to correct deficiencies with its firm-wide compliance risk-management program and to address compliance with applicable United States federal and state laws, rules, and regulations, including the BSA/AML Requirements;

WHEREAS, at the time of issuing its Cease and Desist Order with HNAH, the Board of Governors deffered a decision with regard to the assessment of a civil money penalty against HNAH based on the deficiencies addressed in the Cease and Desist Order, pending additional investigation;

WHEREAS, the United States Department of Justice (the “DOJ”) has been conducting an investigation into the practices of Holdings concerning the transmission of funds through HBUS, including by and through entities and individuals subject to sanctions regimes imposed under the International Emergency Economic Powers Act (“IEEPA”), 50 U.S.C. §§ 1701-06, and the Trading with the Enemy Act, 50 U.S.C. §§ 5, 16, both of which are administered by the Office of Foreign Asset Control of the United States Department of the Treasury (“OFAC”). In order to resolve the investigation, Holdings has agreed to enter a Deferred Prosecution Agreement (“DPA”) with the DOJ, and agreed to forfeitures, wherein:

2

A. HBUS admits that it violated the BSA by willfully failing to establish and maintain an effective AML program and willfully failing to establish due diligence for foreign correspondent accounts; and

B. Holdings admits that it violated TWEA by willfully violating or attempting to violate any regulation issued under TWEA, including regulations restricting transactions with Cuba. Holdings further admits that it violated IEEPA willfully violating or attempting to violate any regulation issued under IEEPA, including regulations restricting transaction with Iran, Libya, Sudan and Burma.

WHEREAS, after entry of the 2010 Cease and Desist Order, the Board of Governors obtained information supporting allegations that:

A. Holdings lacked adequate risk management and legal review policies and procedures to ensure compliance with applicable United States law. As a result:

1. Between 2006 and 2009, Holdings’s banking subsidiary in Mexico, HSBC Mexico (“HBMX”), was able to engage in a substantial number of high-risk transactions with HBUS while maintaining an inadequate system of internal controls to manage the risk of money laundering. Holdings officials failed to communicate certain negative findings in internal audits of HBMX and concerns raised by foreign governing bodies regarding the AML practices of HBMX to HNAH and HBUS appropriate legal and compliance staff in the United States, while simultaneously maintaining firm-wide standards and policies that discouraged HBUS from conducting appropriate levels of due diligence and monitoring of the bank’s foreign correspondent accounts; and

2. From at least 2001 to 2007, Holdings’s banking subsidiaries in Europe, HSBC Bank plc (“HBEU”), and the Middle East, HSBC Bank Middle East (“HBME”), moved,

3

or permitted to be moved, illegally several hundred million dollars through the U.S. financial system on behalf of banks located in Cuba, Iran, Libya, Sudan, and Burma, and persons listed as parties or jurisdictions sanctioned by OFAC in violation of U.S. economic sanctions in a manner that circumvented the system established by HBUS for ensuring compliance with the laws of the United States, including the regulations issued by OFAC (31 C.F.R. Chapter V) (the “OFAC Regulations”). Holdings failed to adequately review the procedures used by HBEU and HBME to determine whether these transactions were carried out in a manner consistent with U.S. law.

B. Between 2006 and 2010, HBUS failed to maintain internal controls, staffing and resources sufficient to adequately identify and mitigate the risks associated with high risk transactions conducted through the bank’s foreign correspondent accounts, especially those relating to the bank’s Mexican affiliate. In this regard, HNAH failed to ensure that HBUS had an adequate process to identify high risk customers and countries that may be potentially associated with money-laundering or terrorist financing.

WHEREAS, the unsafe or unsound practices described above warrant the assessment of a civil money penalty by the Board of Governors against Holdings and HNAH under section 8(i)(2)(B) of the Federal Deposit Insurance Act, as amended (12 U.S.C. § 1818(i)(2)(B)) (the “FDI Act”);

WHEREAS, the Board of Governors is issuing this Order of Assessment of a Civil Money Penalty Upon Consent against Holdings and HNAH (the “Consent Order of Assessment”);

WHEREAS, Holdings and HBUS have consented to the assessment of a civil money penalty by OFAC for violations of OFAC Regulations concurrent with the fine assessed by the DOJ;

4

WHEREAS, HBUS has consented to the assessment of a civil money penalty by the Office of the Comptroller of the Currency (the “OCC”) for violations of the BSA/AML Requirements;

WHEREAS, HBUS has consented to the assessment of a civil money penalty by the Financial Crimes Network of the United States Department of the Treasury (“FinCEN”) for violations of the BSA/AML Requirements concurrent with the civil money penalty assessed by the OCC; and

WHEREAS, on December 10, 2012, the Board of Directors of Holdings adopted a resolution authorizing and directing Marc M. Moses, Group Chief Risk Officer of Holdings, and on December 9, 2012, the Board of Directors of HNAH adopted a resolution authorizing Stuart A. Alderoty, General Counsel of HNAH, to enter into this Consent Order of Assessment on behalf of Holdings and HNAH, consenting to compliance by Holdings, HNAH, and their institution-affiliated parties, as defined in sections 3(u) and 8(b)(3) and (4) of the FDI Act (12 U.S.C. §§ 1813(u) and 1818(b)(3) and (4)), with each and every applicable provision of this Consent Order of Assessment, and waiving any and all rights that Holdings and HNAH may have pursuant to 12 U.S.C. §1818, 12 C.F.R. Part 263, or otherwise to: (i) the issuance of a Notice of Assessment of a Civil Money Penalty; (ii) a hearing for the purpose of taking evidence of any matters set forth in this Consent Order of Assessment; (iii) judicial review of this Consent Order of Assessment, and (iv) to challenge or contest, in any manner, the basis, issuance, validity, terms, effectiveness or enforceability of this Consent Order of Assessment or any provision hereof.

5

NOW, THEREFORE, before the filing of any notices, or taking of any testimony or adjudication of or finding on any issues of fact or law herein, and without this Consent Order of Assessment constituting an admission or denial by Holdings or HNAH of any allegation made or implied by the Board of Governors in connection with this matter, and solely for the purpose of settling this matter without a formal proceeding being filed and without the necessity for protracted or extended hearings or testimony, it is hereby ordered, pursuant to sections 8(b)(3) and (4) and 8(i)(2)(B), that:

1. The Board of Governors hereby assesses Holdings and HNAH a joint civil money penalty in the amount of $165,000,000 to be paid to the Board of Governors at the time of the execution of this Order by Fedwire transfer of immediately available funds to the Federal Reserve Bank of Richmond, ABA No. 05 1000033, beneficiary, Board of Governors of the Federal Reserve System. The Board of Governors or the Federal Reserve Bank of Richmond on its behalf shall remit to the United States Treasury, pursuant to section 8(i) of the FDI Act, 12 U.S.C. § 1818(i).

Communications

2. All communications regarding this Consent Order of Assessment shall be addressed to:

Deputy General Counsel

Board of Governors of the Federal Reserve System

Washington, D.C. 20551

Global General Counsel – Litigation and Regulatory Affairs

HSBC Holdings plc

8 Canada Square

41st Floor

London, United Kingdom E145HQ

General Counsel

HSBC North America Holdings, Inc.

452 Fifth Avenue

New York, New York 10018

6

Miscellaneous

3. The provisions of this Consent Order of Assessment shall be binding upon Holdings, HNAH, and their successors and assigns.

4. Each provision of this Consent Order of Assessment shall remain effective and enforceable until stayed, modified, terminated, or suspended in writing by the Board of Governors.

5. Except as provided for in this Consent Order of Assessment, the Board of Governors hereby releases and discharges Holdings, HNAH, and their affiliates, successors, and assigns from all potential liability that has been or might have been asserted by the Board of Governors based on the conduct that is the subject of this Consent Order of Assessment to the extent known to the Board of Governors as of the effective date of the Consent Order of Assessment. The foregoing release and discharge shall not preclude or affect any right of the Board of Governors to determine and ensure compliance with the terms and provisions of this Consent Order of Assessment, the Consent Cease and Desist Order issued by the Board of Governors against Holdings in 2012, or the Consent Cease and Desist Order issued by the Board of Governors against HNAH in 2010, or any proceedings brought by the Board of Governors to enforce the terms and provisions of this Consent Order of Assessment or such Consent Cease and Desist Orders.

7

By order of the Board of Governors of the Federal Reserve System, effective this 11 ^th day of December, 2012.

8

By order of the Board of Governors of the Federal Reserve System, effective this      day of             , 2012.

8

Exhibit 99.7

MUL-615225

SETTLEMENT AGREEMENT

This Settlement Agreement (the “Agreement”) is made by and between the U.S. Department of the Treasury’s Office of Foreign Assets Control and HSBC Holdings plc (“HSBC Holdings”).

1. The Office of Foreign Assets Control (“OFAC”) of the U.S. Department of the Treasury administers and enforces economic sanctions against targeted foreign countries, regimes, terrorists, international narcotics traffickers, and persons engaged in activities related to the proliferation of weapons of mass destruction, among others. OFAC acts under Presidential national emergency authorities, as well as authority granted by specific legislation, to impose controls on transactions and freeze assets under U.S. jurisdiction.

2. HSBC Holdings is a public limited company organized under the laws of the United Kingdom and directly or indirectly owns, inter alia, HSBC Bank plc (“HBEU”), a financial institution registered under the laws of England and Wales; HSBC Bank Middle East Limited (“HBME”), a financial institution registered under the laws of the Jersey Channel Islands; The Hongkong and Shanghai Banking Corporation Ltd (“HBAP”), a financial institution organized under the laws of Hong Kong; and HSBC Bank USA, N.A. (“HBUS”), a national bank chartered under the laws of the United States (collectively, HSBC Holdings and its subsidiaries, including HBEU, HBME, HBAP, and HBUS, are referred to herein as “HSBC Group”).

3. In January 2001, HBEU approached HBUS with a proposal to clear U.S. dollar transactions for Bank Melli London (“Bank Melli”) through HBEU’s correspondent account with HBUS by utilizing Society for Worldwide Interbank Financial Telecommunication (“SWIFT”) MT 202 cover payments that would not reference Bank Melli. In February 2001, HBUS concluded that the proposed transactions appeared to comply with OFAC regulations that authorized U.S. depository institutions to process certain transactions for the direct or indirect benefit of persons in Iran or the Government of Iran where the transactions involved transfers from one third country’s account at a domestic bank to another third country’s account at a domestic bank (“U-turn” transactions). A June 2001 email from an HBEU relationship manager to members of HBUS Compliance stated:

Once the proposition goes live we have instructed Bank Melli to alter the format of [its] payments to achieve straight through [processing]… we have further asked them to only put ‘One of our clients’ in field 52, thus removing the chance of them inputting an ‘Iranian referenced’ customer name, that causes fall out of the cover payment sent to HBUS and a breach of OFAC regulations.

4. In a letter drafted in April 2001, an HBEU Business Development Manager explained to Bank Melli how to send payments to HBEU in a manner that would allow HBEU to process its payments successfully through HBUS.

The key is to always populate field 52… this means that the outgoing payment instruction from HSBC will not quote “Bank Melli” as sender – just HSBC London and whatever is in field 52. This then negates the need to quote “DO NOT MENTION OUR NAME IN NEW YORK” in field 72 (emphasis in original).

5. By July 2001, several HBUS compliance, payments, and business managers, as well as HSBC Group’s Compliance head, ¹ were aware that HBEU was discussing with Bank Melli how to structure Iranian-related payments to be processed through HBUS. Although HBUS’ head of Compliance warned HSBC Group’s head of Compliance that OFAC might view HBEU’s formatting instructions to Bank Melli as a willful disregard or evasion of U.S. sanctions, and that the non-transparent nature of the payment messages could make it impossible for either HBEU or HBUS to confirm that any payment would be permissible, neither HSBC Group nor HBEU implemented processes to ensure the Bank Melli payments processed to or through HBUS were authorized or exempt pursuant to U.S. sanctions regulations. HBUS proposed that HBEU address these compliance concerns by only processing Bank Melli payments as serial MT 103 messages.

6. In August 2003, the head of HSBC Group Audit sent an email informing the head of HSBC Group Compliance about HBEU’s processing of Iranian transactions to HBUS with ‘selves’ noted as the ordering party so the payments would not be stopped for review. The head of HSBC Group Compliance ordered an investigation into the practice and, in October 2003, a senior Group Compliance official found that HBEU was offering U.S. dollar clearing services to six Iranian banks, and that it had “been manually intervening in the processing of Iranian bank payment instructions … to prevent … the subsequent declaration to OFAC (and possible freezing) of the funds.” In an email sent the next day, a senior payments official objected to the notion that HBEU’s non-transparent practices were not known within HBEU, writing: “I have been alarmed by recent inferences that Payment Services have been amending the Iranian banks’ payments without the knowledge or consent of [HBEU] Compliance.” He further stated that, although HBEU Risk Management Services would be controlling HBEU’s then-new interdiction software, the Payments Department had “been requested to find ways to circumnavigate our own and other institutions’ compliance filters.”

7. By September 2004, the HBEU Chief Executive Officer and HSBC Group Compliance management had approved a proposal to send all Iranian payments as serial payments – as HBUS had previously proposed in 2001 with respect to Bank Melli – allowing for due diligence to be conducted by HBUS to prevent violations of U.S. sanctions regulations. In December 2004, HBUS agreed to the proposal provided, inter alia, that all transactions would be fully transparent serial payments, and HBEU would agree not to alter any payment instructions. Despite agreement to this proposal by HSBC Group Compliance, HBEU, and HBUS, this directive was not carried out.

8. In July 2005, HSBC Group Compliance issued a group-wide policy for the first time prohibiting all HSBC Group affiliates from processing U.S. dollar payments that would be prohibited by OFAC regulations. However, the policy allowed the continued use of cover payments, including for Iranian U-turn transactions which were to be processed by a specialized compliance review team that checked payments for compliance with U.S. sanctions. The policy failed to stop all occurrences of OFAC violations. In August 2006 the head of Group Compliance noted, “I have to say that a number of potential payments resulting from trade transactions from other Group offices that [HSBC Group senior compliance official] and I have looked at since the issuance of the GCL [Group Compliance Letter] are not in our view U-turn compliant.”

9. In April 2006, HSBC Group Compliance issued a GCL prohibiting the use of cover payments to process OFAC-sensitive payments through the United States, and requiring all commercial U.S. dollar transactions sent through HBUS to be executed as fully transparent serial payment messages, with full disclosure of all originators and beneficiaries. The GCL made an exception to this policy, however, which allowed the use of cover payments for Iranian transactions, provided such payments complied with the U-turn authorization and were processed by the specialized compliance review team. Several HSBC Group affiliates requested and received dispensation from the April 2006 effective date, with the understanding that any Iran-related payments would be sent to the specialized review team to check for U-turn compliance consistent with the GCL. HSBC Group Compliance first provided dispensation to HBEU until October 31, 2006; the dispensation was ultimately extended until November 2007.

10. On October 25, 2006, HSBC Group issued a GCL directing all HSBC Group affiliates to immediately stop processing Iranian U.S. dollar payments, with an exception for permissible U-turn payments made in connection with any existing legally binding contractual obligations. This GCL provided that, outside of the exception for those obligations, HSBC Group affiliates could no longer use the U-turn exception for Iranian payments, two years before OFAC’s elimination of the U-turn exception. HSBC Group affiliates, however, continued to maintain several existing Iranian relationships despite the implementation of the GCL. In June 2007, as a result of a meeting between a senior U.S. Department of the Treasury official and the HSBC Group Compliance head, the HBME Deputy Chairman and HSBC head of Group Compliance agreed that HSBC Group should immediately end its Iranian relationships. On September 24, 2007, HSBC Group Compliance issued another GCL announcing that the bank would exit all Iranian business, and directed all account relationships for Iranian banks to be closed as soon as possible, with a hard deadline of November 30, 2007.

11. HSBC Group affiliates also processed transactions involving Burma, Cuba, Libya, and Sudan through the United States during the review period. Information provided to OFAC indicates that HSBC Group affiliates sent Sudanese payments through the United States without disclosing the sanctioned person or location in payment messages in a similar manner to the Iranian payments described above. In addition, although multiple HSBC Group affiliate locations utilized cover payments as the default method of payment processing during this time period, several managers appear to have been aware that the use of these message types would result in the omission of references to U.S.-sanctioned persons or locations that would otherwise cause payments to be stopped by financial institutions in the United States.

12. While the July 2005 GCL appears to have been effective at slowing the number of transactions processed to or through the United States in apparent violation of the Burmese, Cuban, and Sudanese sanctions programs, HSBC Group affiliates continued to use non-transparent cover payments on a periodic basis. In September 2005, an HBEU senior payments official completed an analysis of transactions involving Burma, Cuba, or Sudan over a 10-day period that stopped in HBEU’s OFAC interdiction software and were subsequently processed through the United States as bank-to-bank transfers in support of underlying MT-103s. In a September 23, 2005, email to an HSBC Group Money Laundering Control Officer and HSBC Group senior compliance official, the HBEU senior compliance official stated:

The issues surrounding Iran have overshadowed other OFAC payments recently, however, I can advise that we have not so far physically returned any USD payments involving Sudan, Cuba or Burma [since the issuance of the GCL].

13. The HBEU senior payments official went on to seek guidance on two alternative responses to transactions stopped by HBEU’s interdiction software. The first alternative was to continue processing the transactions by routing the payments in a manner “that they are not frozen in the U.S.” The senior payments official stated:

This will involve intelligent usage of the routing system but may perpetuate similar scenarios to those encountered with Iran (customer instructions saying Do no mention [sic] Sudan or routing which does not make it apparent that these are Sudanese payments).

The second alternative was to strictly apply the GCL and “return the payments unprocessed.” The HBEU senior payments official indicated his instinct was to use the second alternative and sought confirmation from HSBC Group Compliance before taking action. HSBC, however, did not provide OFAC with any documentation indicating that the senior payments official received a response from HSBC Group Compliance. By October 2005, HSBC Group affiliates appear to have informed the Sudanese, Cuban and Burmese banks that held correspondent accounts with HSBC Group affiliates of the new policy set forth in the July 2005 GCL.

14. As recently as August 2007, payment processing audit trails indicate that HSBC Group employees may have facilitated, or were at least aware of, the re-submission of cancelled payments in U.S. dollars which initially contained references implicating U.S. sanctions. For example, after a 2007 payment was cancelled because it contained a reference to Burma in the beneficiary field of the payment instructions, the remitter informed HBAP that it intended to make separate payment arrangements. The payment was resubmitted and successfully processed 10 days later without the Burmese reference. In another instance, also in 2007, an HBAP employee asked another employee to advise a client to cancel a payment that referenced “Myanmar” and remit the payment in another currency. This payment was also subsequently resubmitted in U.S. dollars without the reference to “Myanmar.” In both instances HBAP managers were copied on the emails between the HBAP business and operations employees referencing the communication with customers.

15. In November 2008, the head of HBUS Compliance completed an analysis of transactions from 2003 to 2008 that included, inter alia, payments HBUS processed due to the omission or obfuscation of U.S.-sanctions targets in Cuba and Sudan that should have been blocked pursuant to OFAC regulations. The analysis revealed payments processed subsequent to, and in contradiction of, the July 2005 GCL. In a November 6, 2008, email to the head of HSBC Group Compliance, the head of HBUS Compliance stated: “we have nonetheless received a fairly notable number of payments that suggest HSBC banks have not been consistently applying the [July 2005] GCL.”

16. OFAC has reason to believe that HSBC Group affiliates processed transactions in violation of Executive Orders and/or regulations promulgated pursuant to, inter alia, the International Emergency Economic Powers Act (“IEEPA”), 50 U.S.C. §§ 1701-06, and the Trading With the Enemy Act (“TWEA”), 50 U.S.C. App. §§ 1-44.

17. From on or about March 18, 2004, to on or about December 7, 2007, HSBC Group affiliates processed 40 electronic funds transfers and trade finance transactions in which Cuba or a Cuban national had an interest, in the aggregate amount of $18,817,452, through financial institutions located in the United States in apparent violation of the prohibition against “[a] transfers of credit and all payments between, by, through, or to any banking institution or banking institutions wheresoever located, with respect to any property subject to the jurisdiction of the United States,” 31 C.F.R. § 515.201.

18. From on or about March 15, 2004, to on or about May 31, 2006, HSBC Group affiliates processed a combined 1,031 electronic funds transfers and trade finance transactions, in the aggregate amount of $136,736,510, through financial institutions located in the United States, in apparent violation of the prohibitions against (i) “the exportation or re-exportation of financial services to Burma, directly or indirectly, from the United States…,” 31 C.F.R. § 537.202, and/or (ii) dealing in property and interests in property that “come within the United States” of persons listed in the Annex to Executive Order 13310, 31 C.F.R. § 537.201.

19. From on or about March 15, 2004, to on or about August 21, 2007, HSBC Group affiliates processed a combined 1,036 electronic funds transfers and trade finance transactions, in the aggregate amount of $109,042,996, to the benefit of the Government of Sudan and/or persons in Sudan, through financial institutions located in the United States in apparent violation of the prohibitions against (i) the “exportation or re-exportation, directly or indirectly, to Sudan of…services from the United States,” 31 C.F.R. § 538.205, and/or (ii) dealing in property and interests in property of the Government of Sudan that “come within the United States,” 31 C.F.R. § 538.201.

20. From on or about March 15, 2004, to on or about April 27, 2004, HSBC Group affiliates processed a combined 25 electronic funds transfers in the aggregate amount of $1,172,363, to the benefit of the Government of Libya and/or persons in Libya, through financial institutions located in the United States in apparent violation of the now-repealed prohibition against the exportation of “…goods, technology … or services … to Libya from the United States…,” 31 C.F.R. § 550.202.

21. From on or about March 19, 2004, to on or about June 15, 2010, HSBC Group affiliates processed a combined 203 electronic funds transfers and trade finance transactions in the aggregate amount of $164,308,904, for the benefit of the Government of Iran and/or persons in Iran, through a financial institution located in the United States in apparent violation of the prohibition against the “exportation …, directly or indirectly, from the United States … of any … services to Iran or the Government of Iran,” 31 C.F.R. § 560.204. This does not include the transactions covered by authorizations and exemptions (including the u-turn exemption) under 31 CFR Part 560.

22. Separately and unrelated to the above matters, on May 24, 2006, the London branch of HBUS acted as a clearing bank in a book entry transfer of 32,000 ounces of gold bullion, valued at $20,560,000, for the ultimate benefit of Bank Markazi, Iran, in apparent violation of the prohibition against the “exportation …, directly or indirectly, from the United States, … of any … services to Iran or the Government of Iran,” 31 C.F.R. § 560.204.

23. Separately and unrelated to the above matters, between July 30, 2008, and October 10, 2008, HBUS processed six electronic funds transfers in the aggregate amount of $35,418, in apparent violation of the prohibition against dealing in property and interests in property that “come within the United States” of any person designated pursuant to the Zimbabwe Sanctions Regulations, 31 C.F.R. § 542.201, and Executive Order 13469 of July 25, 2008.

24. Separately and unrelated to the above matters, between August 3, 2007, and April 3, 2008, HBUS processed two electronic funds transfers in the aggregate amount of $15,610, in apparent violation of the prohibitions against (i) “the exportation or re-exportation of financial services to Burma, directly or indirectly, from the United States…,” 31 C.F.R. § 537.202, and/or (ii) dealing in property and interests in property that “come within the United States” of persons listed in the Annex to Executive Order 13310, 31 C.F.R. § 537.201.

25. Separately and unrelated to the above matters, on September 1, 2006, HBUS processed a $1,175,000 electronic funds transfer in apparent violation of the prohibitions against the “exportation or re-exportation, directly or indirectly, to Sudan of…services from the United States,” 31 C.F.R. § 538.205.

26. None of the alleged violations described above were voluntarily self-disclosed to OFAC within the meaning of OFAC’s Economic Sanctions Enforcement Guidelines (the “Guidelines”), except for the May 24, 2006, alleged violation of the Iranian Transaction Regulations involving the transfer of 32,000 ounces of gold bullion described in paragraph 22, which was voluntarily self-disclosed to OFAC within the meaning of the Guidelines. See 31 C.F.R. part 501, App A.

27. The apparent violations by HSBC Group affiliates described above undermined U.S. national security, foreign policy, and other objectives of U.S. sanctions programs.

28. HSBC Group has taken remedial action including closing U.S. dollar accounts held by HSBC Group affiliates for Burmese, Cuban, and Sudanese banks; terminating all business and prohibiting new business with Iranian customers; closing its representative office in

Tehran; implementing new training programs; hiring a number of new compliance personnel; and enhancing filtering technology.

29. HSBC Group provided substantial cooperation to OFAC by conducting an historic transaction review and providing a written admission that relevant transactions identified as a result appear to constitute violations; providing substantial, well organized information for OFAC’s assessment; signing a tolling agreement with OFAC and subsequently agreeing to extend the agreement on multiple occasions; and, responding to multiple inquiries and requests for information.

30. OFAC had not issued a penalty notice or Finding of Violation against HSBC Group in the five years preceding the alleged violations.

IT IS HEREBY AGREED by OFAC and HSBC Holdings that:

31. HSBC Group has terminated the conduct described in paragraphs 3 through 15 above and HSBC Group has put in place, and agreed to maintain, policies and procedures that prohibit, and are designed to minimize the risk of the recurrence of, similar conduct in the future.

32. HSBC Group has also addressed the conduct described in paragraphs 22 through 25 above.

33. HSBC Holdings agrees to provide OFAC with copies of all submissions to the Federal Reserve Bank of Chicago (“Reserve Bank”), in the same form provided to the Reserve Bank, pursuant to the Order to Cease and Desist Issued Upon Consent to HSBC Holdings on December 11, 2012, by the Board of Governors of the Federal Reserve System (Docket No. 12-062-B-FB) relating to the OFAC compliance review related thereto. It is understood that the United Kingdom’s Financial Services Authority (“FSA”), as the home country supervisor of HSBC Holdings, is assisting the Board of Governors in the supervision of its Order as permitted by the FSA’s functions under the Financial Services and Markets Act 2000.

34. Without this Agreement constituting an admission or denial by HSBC Group of any allegation made or implied by OFAC in connection with this matter, and solely for the purpose of settling this matter without a final agency finding that a violation has occurred, HSBC Holdings agrees to a settlement in the amount of $375,000,000 arising out of the alleged violations by HSBC Group of IEEPA, TWEA, the Executive Orders, and the Regulations referenced in this Agreement. HSBC Holdings’ obligation to pay such settlement amount to OFAC shall be satisfied by its payment of an equal amount in satisfaction of penalties assessed by U.S. federal or county agencies or regulators arising out of the same pattern of conduct.

35. Should OFAC determine, in the reasonable exercise of its discretion, that HSBC Holdings has willfully and materially breached its obligations under paragraphs 33 or 34 of this Agreement, OFAC shall provide written notice to HSBC Holdings of the alleged breach and provide HSBC Holdings with 30 days from the date of HSBC Holdings’ receipt of such notice,

or longer as determined by OFAC, to demonstrate that no willful and material breach has occurred or that any breach has been cured. In the event that OFAC determines that a willful and material breach of this Agreement has occurred, OFAC will provide notice to HSBC Holdings of its determination, and this Agreement shall be null and void, and the statute of limitations applying to activity occurring on or after October 19, 2002, shall be deemed tolled until a date 180 days following HSBC Holdings’ receipt of notice of OFAC’s determination that a breach of the Agreement has occurred.

36. OFAC agrees that, as of the date that HSBC Holdings satisfies the obligations set forth in paragraphs 33 through 34 above, OFAC will release and forever discharge HSBC Group from any and all civil liability under the legal authorities that OFAC administers, in connection with any and all violations arising from or related to the conduct disclosed during the course of the investigation, including that described in paragraphs 3 through 15 above and the alleged violations described in paragraphs 17 through 25 above.

37. HSBC Holdings waives any claim by or on behalf of HSBC Holdings or HSBC Group, whether asserted or unasserted, against OFAC, the U.S. Department of the Treasury, and/or its officials and employees arising out of the facts giving rise to this Agreement, including but not limited to OFAC’s investigation of the alleged violations and any possible legal objection to this Agreement at any future date.

38. The provisions of this Agreement shall not bar, estop, or otherwise prevent OFAC from taking any other action affecting HSBC Group with respect to any and all violations not arising from or related to the conduct described in paragraphs 3 through 15 above or violations occurring after the dates of that conduct. The provisions of this Agreement shall not bar, estop, or otherwise prevent other U.S. federal, state, or county officials from taking any other action affecting HSBC Group.

39. Each provision of this Agreement shall remain effective and enforceable according to the laws of the United States of America until stayed, modified, terminated, or suspended by OFAC.

40. No amendment to the provisions of this Agreement shall be effective unless executed in writing by OFAC and by HSBC Holdings.

41. The provisions of this Agreement shall be binding on HSBC Holdings and its successors and assigns. To the extent HSBC Holdings’ compliance with this Agreement requires it, HSBC Holdings agrees to use best efforts to ensure that all entities within HSBC Group comply with the requirements and obligations set forth in this Agreement, to the full extent permissible under locally applicable laws and regulations, and the instructions of local regulatory agencies.

42. No representations, either oral or written, except those provisions as set forth herein, were made to induce any of the parties to agree to the provisions as set forth herein.

43. This Agreement consists of 9 pages and expresses the complete understanding of OFAC and HSBC Holdings regarding resolution of the alleged violations arising from or related to the conduct described in paragraphs 3 through 15 above. No other agreements, oral or written, exist between OFAC and HSBC Holdings regarding resolution of this matter.

44. OFAC, in its sole discretion, may post on OFAC’s website this entire Agreement or the facts set forth in paragraphs 3 through 30 of this Agreement, including the identity of any entity involved, the satisfied settlement amount, and a brief description of the alleged violations. OFAC also may issue a press release including this information, and any other information it deems appropriate in its sole discretion.

45. Use of facsimile signatures shall not delay the approval and implementation of the terms of this Agreement. In the event any party to this Agreement provides a facsimile signature, the party shall substitute the facsimile with an original signature. The Agreement may be signed in multiple counterparts, which together shall constitute the Agreement. The effective date of the Agreement shall be the latest date of execution.

All communications regarding this Agreement shall be addressed to:

CONSENT ORDER

The Comptroller of the Currency of the United States of America (“Comptroller”), through his national bank examiners has conducted an examination of HSBC Bank USA, N.A., McLean, Virginia (“Bank”). The Comptroller has identified certain unsafe or unsound practices related to enterprise-wide compliance. The Comptroller has informed the Bank of the findings resulting from the examination.

The Bank, by and through its duly elected and acting Board of Directors (“Board”), has executed a “Stipulation and Consent to the Issuance of a Consent Order,” dated December 11, 2012 (“Stipulation and Consent”), that is accepted by the Comptroller through his duly authorized representative. By this Stipulation and Consent, which is incorporated by reference, the Bank has consented to the issuance of this Consent Order (“Order”) by the Comptroller.

ARTICLE I

COMPTROLLER’S FINDINGS

The Comptroller finds, and the Bank neither admits nor denies, the following:

1

(1) The Bank has a supervisory history of non-compliance with banking laws and regulations, as well as non-conformance with policies, procedures, and prescribed practices in the compliance area that have occurred over a multi-year period. During the past year, additional deficiencies have surfaced from internal and external reviews that evidence broad and serious weaknesses in the Bank’s compliance program. The robustness of the compliance program has not kept pace with the bank’s size, complexity, and risk profile.

(2) The Comptroller’s examination findings establish that the Bank has engaged in unsafe or unsound practices with respect to enterprise-wide compliance. Specifically, the Bank’s compliance program has historically shown deficiencies in adequate, proactive leadership, risk reporting, and policies and procedures.

Pursuant to the authority invested in him by the Federal Deposit Insurance Act, as amended, 12 U.S.C. § 1818(b), the Comptroller hereby ORDERS that:

ARTICLE II

COMPLIANCE COMMITTEE

(1) The Board shall maintain a Compliance Committee of at least three (3) directors, of which at least two (2) may not be employees or officers of the Bank or any of its subsidiaries or affiliates. In the event of a change of the membership, the name of any new member shall be submitted in writing to the Deputy Comptroller for Large Bank Supervision (“Deputy Comptroller”) and Examiner-in-Charge of Large Bank Supervision at the Bank (“Examiner-in-Charge”). The Compliance Committee shall be responsible for monitoring and coordinating the Bank’s adherence to the provisions of this Order.

(2) The Compliance Committee shall meet at least monthly.

2

(3) Within ninety (90) days of this Order and quarterly thereafter, the Compliance Committee shall submit a written progress report to the Board setting forth in detail:

(4) The Board shall forward a copy of the Compliance Committee’s report, with any additional comments by the Board, to the Deputy Comptroller and Examiner-in-Charge within ten (10) days of receiving such report.

ARTICLE III

ENTERPRISE-WIDE COMPLIANCE PROGRAM

(1) Within ninety (90) days of the date of this Order, the Board, or a designated committee of the Board, shall adopt, implement, and thereafter ensure adherence to a written enterprise-wide compliance program designed to ensure that the Bank is operating in compliance with applicable laws, rules, regulations, regulatory guidance, and supervisory findings. This program shall include, but not be limited to:

3

personnel, and requirements that these positions be staffed with qualified personnel;

4

(2) Upon completion of the program, the Board shall submit the program to the Deputy Comptroller and the Examiner-in-Charge for prior written determination of no supervisory objection. In the event the Deputy Comptroller recommends changes to the program, the Board shall incorporate those changes into the program. Upon receiving a written determination of no supervisory objection from the Deputy Comptroller, the Bank shall immediately implement and adhere to the program.

5

ARTICLE IV

ENTERPRISE-WIDE COMPLIANCE PROGRAM ACTION PLAN

(1) The Board shall direct management to undertake and complete all steps necessary to correct the circumstances and conditions, as noted in the Bank’s most recent Report of Examination, which prompted the need for the enterprise-wide compliance program required by this Order.

(2) Within ninety (90) days of this Order, the Board shall develop and adopt a written plan that:

(3) Upon completion of the plan, the Board shall submit the plan to the Deputy Comptroller and Examiner-in-Charge for a prior written determination of no supervisory objection. Upon receiving a written determination of no supervisory objection from the Deputy Comptroller, the Bank shall immediately implement and adhere to the plan.

(4) The plan shall be implemented pursuant to the time frames set forth within the plan unless events dictate modifications to the plan. Where the Board considers

6

modifications appropriate, those modifications shall be submitted to the Deputy Comptroller and Examiner-in-Charge for prior written determination of no supervisory objection. Upon receiving a written determination of no supervisory objection from the Deputy Comptroller, the Bank shall implement and adhere to the revised plan.

ARTICLE V

OTHER PROVISIONS

(1) Although this Order requires the Bank to submit certain actions, plans, programs, policies, and procedures for the review or prior written determination of no supervisory objection by the Deputy Comptroller or the Examiner-in-Charge, the Board has the ultimate responsibility for proper and sound management of the Bank.

(2) In each instance in this Order in which the Board is required to ensure adherence to, and undertake to perform certain obligations of the Bank, it is intended to mean that the Board shall:

7

(3) If, at any time, the Comptroller deems it appropriate in fulfilling the responsibilities placed upon him by the several laws of the United States to undertake any action affecting the Bank, nothing in this Order shall in any way inhibit, estop, bar, or otherwise prevent the Comptroller from so doing.

(4) This Order constitutes a settlement of the cease and desist proceeding against the Bank contemplated by the Comptroller, based on the unsafe or unsound practices described in the Comptroller’s Findings set forth in Article I of this Order. Provided, however, that nothing in this Order shall prevent the Comptroller from instituting other enforcement actions against the Bank or any of its institution-affiliated parties, including, without limitation, assessment of civil money penalties, based on the findings set forth in this Order, or any other findings. Nothing herein shall limit or modify the releases provided by the Stipulation and Consent to the Issuance of a Consent Order for the Assessment of a Civil Money Penalty executed simultaneously with this Order.

(5) This Order is and shall become effective upon its execution by the Comptroller, through his authorized representative whose hand appears below. The Order shall remain effective and enforceable, except to the extent that, and until such time as, any provision of this Order shall be amended, suspended, waived, or terminated in writing by the Comptroller.

(6) Any time limitations imposed by this Order shall begin to run from the effective date of this Order, as shown below, unless the Order specifies otherwise.

(7) The terms and provisions of this Order apply to the Bank and its subsidiaries, even though those subsidiaries are not named as parties to this Order.

8

(8) This Order is intended to be, and shall be construed to be, a final order issued pursuant to 12 U.S.C. § 1818(b), and expressly does not form, and may not be construed to form, a contract binding the Comptroller or the United States. Nothing in this Order shall affect any action against the Bank or its institution-affiliated parties by a bank regulatory agency, the United States Department of Justice, or any other law enforcement agency, to the extent permitted under applicable law.

(9) The terms of this Order, including this paragraph, are not subject to amendment or modification by any extraneous expression, prior agreements, or prior arrangements between the parties, whether oral or written.

(10) Nothing in the Stipulation and Consent or this Order, express or implied, shall give to any person or entity, other than the parties hereto, and their successors hereunder, any benefit or any legal or equitable right, remedy or claim under the Stipulation and Consent or this Order.

(11) The Bank consents to the issuance of this Order before the filing of any notices, or taking of any testimony or adjudication, and solely for the purpose of settling this matter without a formal proceeding being filed.

IT IS SO ORDERED, this 11 ^th day of December, 2012.

9

CONSENT ORDER FOR THE

ASSESSMENT OF A CIVIL MONEY PENALTY

The Comptroller of the Currency of the United States of America (“Comptroller”), through his national bank examiners and other staff of the Office of the Comptroller of the Currency (“OCC”), has conducted an examination and investigation of the Payments and Cash Management (“PCM”), Global Banknotes, and foreign correspondent operations of HSBC Bank USA, N.A., McLean, Virginia (“Bank”). The OCC has identified deficiencies in the Bank’s internal controls for these areas as well as in its overall program for Bank Secrecy Act/anti-money laundering (“BSA/AML”) compliance. These findings were the subject of a Consent Cease and Desist Order issued on October 6, 2010 (“Consent Order”). Upon issuance of the Consent Order, the OCC deferred a decision with regard to the assessment of a civil money penalty (“CMP”) against the Bank based on deficiencies addressed in the Consent Order, pending additional investigation.

The Bank, by and through its duly elected and acting Board of Directors (“Board”), has executed a “Stipulation and Consent to the Issuance of a Consent Order for the Assessment of a Civil Money Penalty,” dated December 11, 2012 (“Stipulation”), that is accepted by the Comptroller. By this Stipulation, which is incorporated by reference, the Bank has consented to

the issuance of this Consent Order for the Assessment of a Civil Money Penalty (“CMP Order”) by the Comptroller.

On December 11, 2012, the Bank entered into a Deferred Prosecution Agreement (“DPA”) with the United States Department of Justice (“DOJ”). In the DPA, the Bank admitted it had violated 31 U.S.C. § 5318(h)(1), which makes it a crime to willfully fail to establish and maintain an effective AML program, and 31 U.S.C. § 5318(i)(1), which makes it a crime to willfully fail to establish due diligence for foreign correspondent accounts. The Bank further consented to DOJ’s findings in connection with these violations.

ARTICLE I

COMPTROLLER’S FINDINGS

The Comptroller finds the following:

The Comptroller incorporates the following findings in Article I of the Consent Order:

(1) The OCC’s examination findings identified deficiencies in the Bank’s BSA/AML compliance program. These deficiencies resulted in a BSA/AML compliance program violation under 12 U.S.C. § 1818(s) and its implementing regulation, 12 C.F.R. § 21.21 (BSA Compliance Program). In addition, the Bank violated 12 C.F.R. § 21.11 (Suspicious Activity Report Filings); and 31 U.S.C. § 5318(i) and its implementing regulation, 31 C.F.R. § 1010.610 (Correspondent Banking) (formerly 31 C.F.R. § 103.176).

The Bank failed to adopt and implement a compliance program that adequately covers the required BSA/AML program elements, including, in particular, internal controls for customer due diligence, procedures for monitoring suspicious activity, and independent testing. The Bank's compliance program and its implementation were ineffective, and accompanied by

-2-

aggravating factors, such as highly suspicious activity creating a significant potential for unreported money laundering or terrorist financing.

Some of the critical deficiencies in the elements of the Bank’s BSA/AML compliance program included the following:

(A) The Bank excluded from automated BSA/AML monitoring wire transfers initiated by customers domiciled in countries risk rated as “standard” or “medium,” representing two-thirds of total dollar volume for PCM. While the Bank employed other methods for monitoring wire transactions for customers located in countries risk rated standard or medium, these alternatives provided limited coverage, were not effective, and did not mitigate the BSA/AML risks posed;

(B) During mid-2006 through mid-2009, the Bank did not perform BSA/AML monitoring for banknote (or “bulk cash”) transactions with Group Entities (defined as the Bank’s foreign affiliates in which the Bank’s parent, HSBC Holdings plc, London, England (“HSBC Group”), holds a majority interest);

(C) The Bank did not collect or maintain customer due diligence (“CDD”) or enhanced due diligence (“EDD”) information for Group Entities. The Bank transacted extensive wire transfers and purchases of United States bulk cash with Group Entities. The lack of due diligence information inhibited the Bank's assessment of customer risk and the identification of suspicious activity in Group Entity accounts;

(D) The Bank failed to disposition its alerts appropriately or to comply fully with its obligation to report suspicious activity on time. As part of the 2009-10 examination, the OCC cited the Bank for its backlog of unprocessed alerts. The

-3-

Bank’s subsequent review of the backlogged alerts led it to file a substantial number of late Suspicious Activity Reports (“SARs”) with law enforcement authorities; and

(E) The Bank did not appropriately designate customers as “high-risk” for purposes of BSA/AML monitoring, even where a customer’s association with politically-exposed persons (“PEPs”) could have harmed the Bank’s reputation.

(2) The above violations and failures were the result of a number of factors, including, among others, (i) inadequate staffing and procedures in the alert investigations unit that resulted in a significant backlog of alerts; (ii) the closure of alerts based on ineffective review; (iii) inadequate monitoring of Group Entities’ correspondent accounts for purpose and anticipated activity, anti-money laundering record, or consistency between actual and anticipated account activity; (iv) unwarranted reliance on Group Entities’ following HSBC Group BSA/AML policies; (v) inadequate monitoring of funds transfers; (vi) inadequate procedures to ensure the timely reporting of suspicious activity; (vii) failure to adequately monitor Group Entities’ banknote activity, (viii) inadequate monitoring of correspondent funds transfer activity; and (ix) inadequate collection and analysis of CDD information, including inadequate monitoring of PEPs.

The Comptroller further finds, for purposes of this CMP Order:

(3) The Bank has not fully complied with Article IX (Wire Monitoring) of the Consent Order. In relevant part, the Consent Order required the Bank to fully install, test, and activate a new wire monitoring system within 180 days. The Bank installed and activated a new wire monitoring system for its PCM unit without adequately testing the system. The Consent Order further required the Bank to conduct validation (gap) testing of the new system after installation. The Bank did not complete this testing within a reasonable period after installing

-4-

the new system at its PCM unit. These instances of noncompliance exposed the Bank to a material risk of failing to report suspicious activity, including suspicious international wire transfers, to law enforcement.

(4) Pursuant to Article XI (Account/Transaction Activity Review (“Look-Back”)) of the Consent Order, the Bank retained a consultant to conduct a look-back to review certain account and transaction activity specified by the OCC. The look-back, and the prior review during 2010 of the Bank’s backlog of unprocessed alerts, together resulted in the Bank’s late-filing 890 SARs addressing suspicious activity in the amount of $6.34 billion.

(5) The foregoing violations of law and noncompliance with the Consent Order meet the requirements for a “Tier II” civil money penalty, pursuant to 12 U.S.C. § 1818(i)(2)(B). The violations of law formed a pattern of misconduct. The BSA/AML compliance program violation began by January 1, 2007, and continued through 2010. The remaining violations of law lasted for three years or longer.

(6) During 2007-10, the Bank benefited from the foregoing violations of law by conserving funds that it should have expended in order to maintain a robust BSA/AML compliance program, as required by law. In this case, it is necessary to assess a civil money penalty in excess of the benefit amount to promote compliance with statutory and regulatory requirements and deter future misconduct.

Pursuant to the authority vested in him by the Federal Deposit Insurance Act, as amended, 12 U.S.C. § 1818, the Comptroller hereby ORDERS that:

-5-

ARTICLE II

ORDER FOR A CIVIL MONEY PENALTY

(1) The Bank shall pay a civil money penalty of five hundred million dollars ($500,000,000.00) to the United States Treasury upon execution of this CMP Order.

(2) This CMP Order shall be enforceable to the same extent and in the same manner as an effective and outstanding order that has been issued and has become final pursuant to 12 U.S.C. § 1818(h), (i) (as amended).

ARTICLE III

CLOSING

(1) If, at any time, the Comptroller deems it appropriate in fulfilling the responsibilities placed upon him by the several laws of the United States to undertake any action affecting the Bank, nothing in this CMP Order shall in any way inhibit, estop, bar, or otherwise prevent the Comptroller from so doing.

(2) This CMP Order is and shall become effective upon its execution by the Comptroller, through his authorized representative whose hand appears below. The CMP Order shall remain effective and enforceable against the Bank and its successors in interest, except to

-6-

the extent that, and until such time as, any provisions of this CMP Order shall have been amended, suspended, waived, or terminated in writing by the Comptroller.

(3) This CMP Order is intended to be, and shall be construed to be, a final order issued pursuant to 12 U.S.C. § 1818(i)(2), and expressly does not form, and may not be construed to form, a contract binding the Comptroller or the United States.

(4) The terms of this CMP Order, including this paragraph, are not subject to amendment or modification by any extraneous expression, prior agreements, or prior arrangements between the parties, whether oral or written.

IT IS SO ORDERED, this 11 ^th day of December, 2012.

-7-

-8-

Exhibit 99.10

AGREEMENT BY AND BETWEEN

HSBC BANK USA, N.A.

McLEAN, VIRGINIA

AND

THE OFFICE OF THE COMPTROLLER OF THE CURRENCY

HSBC Bank USA, N.A., McLean, Virginia (“Bank”) is a national bank subject to the limitations on controlling or holding an interest in financial subsidiaries set forth in 12 U.S.C. § 24a and 12 C.F.R. § 5.39.

The Comptroller of the Currency of the United States (“Comptroller”), through his National Bank Examiners, has examined the Bank and determined that the Bank is not in compliance with the requirements set forth in 12 U.S.C. § 24a(a)(2)(C) and 12 C.F.R. § 5.39(g)(1). Accordingly, the Bank is required to execute an agreement with the Comptroller.

In consideration of the above, it is agreed, between the Bank, by and through its duly elected and acting Board of Directors (“Board”), and the Comptroller, through his authorized representative, that the Bank shall operate at all times in compliance with the articles of this Agreement.

ARTICLE I

JURISDICTION

(1) This Agreement is entered into pursuant to 12 U.S.C. § 24a(e)(2) and (3) and 12 C.F.R. §§ 5.39(j)(1)(ii) and (iii).

(2) This Agreement shall not be deemed to be a “formal written agreement” for the purposes of 12 C.F.R. Part 5 and Part 24.

1

ARTICLE II

ACTION PLAN

(1) The Board shall direct management to undertake and complete all steps necessary to correct the circumstances and conditions, as noted in the Bank’s most recent Report of Examination, resulting in the Bank’s noncompliance with the conditions and requirements set forth in 12 U.S.C. § 24a and 12 C.F.R. § 5.39 for a national bank that maintains a financial subsidiary.

(2) Within ninety (90) days of the effective date of this Agreement, the Board shall develop and adopt a written plan that:

(3) Upon adoption of the plan, the Board shall submit the plan to the Deputy Comptroller and Examiner-in-Charge for a prior written determination of no supervisory objection. Upon receiving a written determination of no supervisory objection from the Deputy Comptroller, the Bank shall immediately implement and adhere to the plan.

(4) The plan shall be implemented pursuant to the time frames set forth within the plan unless events dictate modifications to the plan. Where the Board considers modifications

2

appropriate, those modifications shall be submitted to the Deputy Comptroller and Examiner-in-Charge for prior written determination of no supervisory objection. Upon receiving a written determination of no supervisory objection from the Deputy Comptroller, the Bank shall implement and adhere to the revised plan.

ARTICLE III

LIMITATIONS ON ADDITIONAL ACTIVITIES

INVOLVING FINANCIAL SUBSIDIARIES

(1) The Board shall ensure that the Bank complies with all the requirements and safeguards set forth in 12 U.S.C. § 24a and 12 C.F.R. § 5.39 for a national bank that has established or maintains a financial subsidiary.

(2) The Bank shall not, directly or indirectly, acquire control of, nor hold an interest in, any new financial subsidiary, nor commence a new activity in its existing financial subsidiary, unless:

3

ARTICLE IV

REQUIRED DIVESTITURE OF FINANCIAL SUBSIDIARY

(1) If, after one hundred eighty (180) days following the Bank’s receipt of the Comptroller’s notice following the Bank’s most recent examination, the Comptroller determines, in his sole discretion, that the circumstances and conditions, as detailed in the Bank’s most recent Report of Examination, that led to the Bank’s noncompliance with the conditions and requirements for a national bank to control, or hold an interest in, a financial subsidiary have not been corrected, and the Bank has not made significant progress towards the correction of those circumstances and conditions, the Bank agrees, if it is directed to do so by the Comptroller, to:

ARTICLE V

CONCLUDING PROVISIONS

(1) It is expressly and clearly understood that if, at any time, the Comptroller deems it appropriate in fulfilling the responsibilities placed upon him by the several laws of the United States of America to undertake any action affecting the Bank, nothing in this Agreement shall in any way inhibit, estop, bar, or otherwise prevent the Comptroller from so doing.

4

(2) Any time limitations imposed by this Agreement shall begin to run from the effective date of this Agreement. Such time requirements may be extended in writing by the Comptroller or his duly authorized representative for good cause upon written application by the Board.

(3) The provisions of this Agreement shall continue in full force and effect unless or until such provisions are amended in writing by mutual consent of the parties to the Agreement or excepted, waived, or terminated in writing by the Comptroller.

(4) The phrase “effective date” shall mean the date that this Agreement is executed by the Comptroller or by his duly authorized representative.

(5) This Agreement does not form, and may not be construed to form, a contract binding on the Comptroller or the United States. Notwithstanding the absence of mutuality of obligation, or of consideration, or of a contract, the Comptroller may enforce any of the commitments or obligations herein undertaken by the Bank under its supervisory powers, including 12 U.S.C. § 1818(i), and not as a matter of contract law. The Bank expressly acknowledges that neither the Bank nor the Comptroller has any intention to enter into a contract. The Bank also expressly acknowledges that no officer or employee of the Office of the Comptroller of the Currency has the statutory or other authority to bind the United States, the U.S. Treasury Department, the Comptroller, or any other federal bank regulatory agency or entity, or any officer or employee of any of those entities to a contract affecting the Comptroller’s exercise of his supervisory responsibilities. The terms of this Agreement, including this paragraph, are not subject to amendment or modification by any extraneous expression, prior agreements or arrangements, or negotiations between the parties, whether oral or written.

5

IN TESTIMONY WHEREOF, the undersigned, authorized by the Comptroller, has hereunto set her hand on behalf of the Comptroller.

6

IN TESTIMONY WHEREOF, the undersigned, as the duly elected and acting Board of Directors of the bank, have hereunto set their hands on behalf of the Bank.