logo

Contents

HSBC Digital Audit

Audit Phase: V-DIG (Digital Forensics / Technology Supply Chain)
Date: 2026-05-01
Scope: Technology stack, vendor relationships, cloud infrastructure, defence/intelligence sector exposure, AI/algorithmic systems, R&D footprint, and civil society scrutiny


Enterprise Technology Stack & Vendor Relationships

Israeli-Origin Software & Services

NICE Actimize (NICE Ltd.)

NICE Ltd. was established in Raanana, Israel in 1986 and its NICE Actimize division constitutes the market-leading platform for financial crime compliance, anti-money-laundering (AML), and trade surveillance at global Tier-1 banks 67. NICE Actimize is documented in Celent and IBS Intelligence analyst coverage as deployed at the majority of Tier-1 banking institutions globally 1516. HSBC is repeatedly cited in trade press and NICE Actimize marketing collateral as a customer for NICE Actimize’s AML, Suspicious Activity Monitoring (SAM), and Markets Surveillance product lines 615.

The nature of this relationship is enterprise-critical. AML and trade surveillance are regulatory-mandatory functions under the UK Proceeds of Crime Act, EU Anti-Money Laundering Directive (AMLD) frameworks, and the US Bank Secrecy Act. HSBC’s NICE Actimize deployment therefore constitutes a confirmed, ongoing, legally indispensable dependency on Israeli-origin technology embedded at the core of its global compliance infrastructure 61516. NICE Ltd.’s 2024–2025 investor materials and product blog continue to reference the X-Sight platform as deployed at “top-10 global banks,” with HSBC referenced in the analyst community as a continuing customer 45. Relationship status: confirmed ongoing (2019–present); assessed continuing post-July 2024 with no public evidence of discontinuation 45.

CyberArk (Privileged Access Management)

CyberArk was founded in Israel in 1999 and maintains its primary R&D centre in Be’er Sheva, Israel 9. The company is dual-listed on NASDAQ. CyberArk’s privileged access management (PAM) platform — which governs administrator-level access to production banking systems — is referenced in banking technology analyst coverage (IBS Intelligence, The Banker) and CyberArk’s own case study library in the context of HSBC as a customer 816. PAM represents a core identity-security dependency: compromise or discontinuation of this platform would directly expose production infrastructure. CyberArk’s 2024 Form 20-F filed with the SEC confirms continued strong EMEA financial services revenue, with UK and EMEA described as a significant revenue region and financial services as the leading vertical 30.

Relationship status: reported ongoing (2020–present); not confirmed via an HSBC-authored primary disclosure; not evidenced as discontinued post-July 2024 8930.

Palo Alto Networks

Palo Alto Networks is incorporated in Delaware, USA (2005), but was co-founded by Nir Zuk, an Israeli national and former Check Point engineer, and maintains significant R&D operations in Tel Aviv 17. A named Palo Alto Networks case study referencing HSBC as a network security customer appeared in Palo Alto’s public case study library during the 2019–2022 period, describing deployment of next-generation firewall and network security platform capabilities — core enterprise perimeter infrastructure 517. The case study was subsequently removed from Palo Alto’s public index; ongoing contract status post-2022 is unknown, and no new evidence of reinstatement or confirmed termination has been identified 5.

Check Point Software

Check Point Software Technologies is Israeli-founded (Gil Shwed, Tel Aviv, 1993) and headquartered in Tel Aviv. It is one of the dominant enterprise firewall and network security vendors in the global financial services sector 22. A review of Check Point’s customer references and partner ecosystem documentation (2022–2024) does not name HSBC in any published case study or customer list 47. Given Check Point’s documented prevalence in UK financial services infrastructure — as noted in FCA operational resilience policy contexts — it may form part of HSBC’s vendor estate via sub-contractors or managed security service providers; however, no direct procurement evidence is confirmed 2247. Status: no public evidence of a direct HSBC–Check Point relationship identified.

Wiz (Cloud-Native Security)

Wiz is Israeli-founded (2020, founded by veterans of the Israeli military intelligence Unit 8200) and now US-domiciled. Wiz has become a major cloud-native security posture management (CSPM) platform in the financial services sector. A review of Wiz’s published customer references (2023–2025) identifies named financial services clients including Citigroup and JPMorgan in trade press, but HSBC has not appeared in Wiz’s published customer references 36. No public evidence of an HSBC–Wiz contract or integration has been identified 36.

SentinelOne

SentinelOne is Israeli co-founded (Tomer Weingarten, 2013), US-domiciled. A review of SentinelOne’s financial services customer references (2024) identifies no HSBC-specific reference 49. No public evidence of an HSBC–SentinelOne contract has been identified.

Verint Systems

Verint is Israeli-founded (spun out of Comverse Technology, Israel, 2002) and is a leading provider of workforce engagement, contact centre analytics, and communications intelligence platforms for financial services 20. While Verint is widely deployed in UK financial services contact centres, no named HSBC–Verint contract has been identified in public sources. Status: no confirmed direct relationship 20.

Claroty

Claroty is an Israeli-founded industrial OT/IoT cybersecurity firm (2015). No public evidence of an HSBC–Claroty relationship has been identified.

Imperva (Web Application Security)

Imperva is Israeli-founded (2002, Rehovot, Israel), now US-domiciled following acquisition by Thales in 2023. Imperva’s web application firewall (WAF) and DDoS protection platforms are widely deployed in financial services generally and UK banking specifically. No confirmed HSBC–Imperva direct contract has been identified in public sources, though Imperva’s prevalence in UK banking infrastructure makes its presence within HSBC’s vendor estate — including through managed service providers — a non-trivial possibility that cannot be excluded without access to procurement records.

Amdocs

Amdocs is a technology services company incorporated in Guernsey with principal operations and R&D in Israel (Ra’anana). Amdocs serves primarily telecommunications companies and has a limited financial services sector presence. No HSBC–Amdocs relationship identified.

Cellebrite, NSO Group, Carbyne

Cellebrite is an Israeli digital forensics firm whose products are deployed by law enforcement, not commercial banks 48. NSO Group produces Pegasus spyware for state customers; no commercial bank is a known customer or technology partner 48. Carbyne is Israeli-founded and serves emergency services and public safety agencies. No HSBC relationship with any of these vendors is identified or plausible 48.

Scale of Dependency Assessment

The NICE Actimize relationship represents a critical-infrastructure dependency: as a legally mandated compliance platform, HSBC cannot substitute or discontinue this system without prior regulatory approval and a substantial transition programme. Its Israeli-origin provenance therefore represents a structural, not incidental, feature of HSBC’s technology estate 615. The CyberArk PAM relationship, if confirmed at the scope described in analyst coverage, similarly represents a core identity-security dependency governing access to production systems 89. Both relationships are assessed as continuing into 2025 with no public evidence of modification or discontinuation 4530.

Global Cloud & Major Technology Partnerships

HSBC has publicly confirmed the following strategic technology partnerships, none of which are Israeli-origin:

  • Google Cloud — multi-year agreement announced October 2021; expanded to AI and data analytics workloads 2023–2024, including deployment of Google Cloud’s Vertex AI platform for data analytics and risk modelling 427
  • Amazon Web Services — deepened partnership from 2022; expanded to AI workloads and generative AI experimentation 2023–2024 41
  • Microsoft Azure — cloud migration and services 2022–2023; continued through 2024, with Azure OpenAI Service exploration referenced for internal productivity tools 42
  • IBM — longstanding enterprise IT services relationship (pre-2010 to present) 21
  • Quantexa — UK-domiciled network analytics and financial crime platform; HSBC strategic partnership confirmed 1112
  • Accenture, Wipro, Infosys — application management and digital transformation outsourcing, referenced in IBS Intelligence survey coverage 16

No public evidence has been identified that these integrators specifically mandated or deployed Israeli-origin technology as a named component of their HSBC engagements. All three major hyperscaler cloud partners (Google Cloud, AWS, Azure) operate infrastructure regions within Israel; however, no public evidence has been identified that HSBC’s specific cloud tenancy or data flows route through Israeli cloud regions under any of these agreements 44344. This constitutes a documented unresolved gap addressed further under the Cloud Infrastructure section below.

HSBC’s approach to third-party technology and outsourcing risk is disclosed at a high level in the Operational Risk section of its Annual Reports in accordance with FCA and PRA operational resilience requirements 22; however, the Annual Report does not enumerate individual cybersecurity software vendors by name 122526.

Controlling Principals — Board and Executive Review (as of 2024–2025)

Mark Tucker (Group Chairman, appointed 2017): Prior career in insurance (AIA Group, Prudential plc). HSBC proxy statements (AGM 2023, AGM 2024) disclose external directorships and material interests; no Israeli technology sector directorship, investment, or advisory role has been disclosed 28.

Georges Elhedery (Group CEO, appointed September 2024, formerly Group CFO): Career entirely within HSBC Global Banking and Markets; educational background French and international (École Polytechnique and INSEAD); no disclosed Israeli technology sector investments 2528.

Noel Quinn (Group CEO through mid-2024, retired): Career within HSBC commercial banking; no disclosed Israeli technology sector investments identified in proxy statements through departure 28.

No director or named executive officer of HSBC Holdings plc has been identified in public proxy disclosures, director conflict-of-interest registers, or trade press as holding a directorship, material personal investment, advisory role, or equity stake in Israeli surveillance, cybersecurity, AI, or SIGINT firms including (but not limited to): NSO Group, Cellebrite, Carbyne, AnyVision/Oosto, Wiz, Palantir, Check Point, SentinelOne, Verint, or NICE 28.

Shareholder Analysis:

No controlling shareholder (≥10% equity stake) exists in HSBC Holdings plc as of 2024. The largest disclosed institutional holder is BlackRock at approximately 7%, followed by Vanguard at approximately 5–6%; both are US-domiciled passive index investors 25. Ping An Insurance Group, formerly HSBC’s largest single shareholder at approximately 9% (2022–2023), reduced its stake to approximately 5% during 2023; Ping An is a Chinese financial conglomerate with no identified Israeli technology sector investments relevant to this audit 29. The ≥10% threshold for controlling principal analysis is not met by any identified shareholder as of 2024 25.

This conclusion is qualified by the evidence gap that personal family-office vehicles below disclosure thresholds are not searchable in public records 28.

Group Structure & Attribution

HSBC Holdings plc is the ultimate parent company of the HSBC Group. Key operating subsidiaries relevant to technology analysis include HSBC Bank plc (UK principal banking subsidiary), HSBC UK Bank plc (ring-fenced UK retail bank), Hongkong and Shanghai Banking Corporation Limited (principal Asian operating entity), HSBC North America Holdings Inc., and HSBC Bank Middle East Limited (MENA operations, incorporated Bahrain). No subsidiary entity has been identified as operating an Israeli-origin technology relationship not reflected in the group-level findings above. The NICE Actimize and CyberArk relationships are understood to be group-wide platform deployments consistent with HSBC’s documented centralised technology governance approach 26.

HSBC Bank Middle East Limited operates across Gulf Cooperation Council markets; no public evidence of Israeli-origin technology procurement by HSBC MENA has been identified, and HSBC MENA is not known to have business operations within Israel or the occupied Palestinian territories 35.


Surveillance, Biometrics & Retail Technology

Voice & Behavioural Biometrics

HSBC operates a Voice ID biometric authentication system for telephone banking customers, launched in the UK in 2016. The underlying vendor for HSBC’s Voice ID has been reported in banking technology trade press as Nuance Communications (US-domiciled, acquired by Microsoft in 2022) 16 — not an Israeli-origin vendor.

HSBC has deployed behavioural biometrics (keystroke dynamics, device interaction patterns) for digital fraud prevention. The specific vendor for this capability has not been publicly named in available sources 16. BioCatch (founded Israel, 2011, by Avi Turgeman and Uri Rivner; headquartered Tel Aviv with US and UK commercial offices) is the dominant vendor for behavioural biometrics fraud prevention in UK retail and commercial banking; its documented named customers include Lloyds Banking Group, NatWest Group, and Barclays, among others 2324. HSBC’s use of behavioural biometrics for digital fraud prevention is documented in trade press without vendor identification 16. Given BioCatch’s market position — where it has named the majority of major UK high-street banks as customers — and HSBC’s confirmed deployment of behavioural biometrics, no direct confirmation of an HSBC–BioCatch contract has been identified in BioCatch’s published customer references, HSBC’s public disclosures, or trade press named sources 23. This gap cannot be resolved without procurement records and remains an open evidence question of material relevance given BioCatch’s Israeli-origin provenance.

Facial Recognition & Visual Biometrics

No public evidence has been identified of HSBC deploying facial recognition, gait analysis, or visual biometric technology from Israeli-origin vendors including AnyVision/Oosto, BriefCam, or Trigo. HSBC does not operate a physical retail store estate that would constitute the typical deployment context for loss-prevention or customer identification biometrics.

Compliance & Communications Surveillance

HSBC’s trade surveillance and market conduct monitoring — required under MiFID II — is implemented through platforms consistent with NICE Actimize Markets Surveillance 615. This represents verified, ongoing workforce and communications monitoring technology of Israeli origin deployed in a regulated context. The scope extends to electronic communications capture, surveillance, and flagging across HSBC’s global markets and trading operations.

No public evidence has been identified of HSBC deploying Israeli-origin social media monitoring, predictive policing tools, or general workforce surveillance technology beyond the compliance-mandated communications surveillance described above.

Third-Party Bundled Deployments

HSBC’s managed security service providers and cloud platform vendors may bundle Israeli-origin security tooling (e.g., Check Point or CyberArk components within managed service stacks) without HSBC constituting a direct named customer. No specific third-party bundled Israeli-origin technology deployment has been confirmed in public sources 22.


Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

HSBC does not appear in any public data centre registry, colocation operator disclosure, or real estate filing as operating, leasing, or co-locating data centre infrastructure within Israel. HSBC’s publicly stated data centre strategy involves consolidation around its own UK data centres and migration to its three hyperscaler cloud partners 425. HSBC maintains a commercial/representative office in Tel Aviv serving institutional and corporate banking clients 35; this is a client-facing commercial office, not a data centre or infrastructure facility. No announcement of closure of this office has been identified post-July 2024 35. No public evidence identified of HSBC data centre operations within Israel.

Project Nimbus and Israeli Government Cloud Contracts

Project Nimbus is the Israeli government’s national cloud infrastructure contract, awarded in 2021 jointly to Google Cloud and Amazon Web Services — not to any banking institution 18. HSBC is a banking and financial services group, not a cloud service provider, and is not a party to Project Nimbus 18. This finding is confirmed by Israeli government procurement announcements and Calcalist Tech reporting 18. No public evidence has been identified of HSBC participating in any Israeli government cloud initiative in any capacity.

Israeli Cloud Regions — Hyperscaler Tenancy Gap

Google Cloud opened a dedicated Israel cloud region (me-west1, Tel Aviv) in June 2023 43. AWS opened an Israel (Tel Aviv) region (il-central-1) in August 2023 44. Microsoft Azure does not yet have a dedicated Israel region as of 2024 43. HSBC is a confirmed customer of all three hyperscalers 44142.

HSBC has not publicly disclosed which cloud regions within Google Cloud, AWS, or Azure its data and workloads are routed to; regional tenancy configuration is commercially confidential 2741. Whether HSBC’s cloud tenancy configurations include or exclude the Google Cloud me-west1 (Israel) or AWS il-central-1 (Israel) regions cannot be confirmed or excluded from public sources. This constitutes a new unresolved data-exposure gap identified in the expansion run: if HSBC workloads traverse Israeli hyperscaler regions, those workloads would be subject to Israeli legal jurisdiction and potentially Israeli state access requests 4344.

Data Sovereignty & Residency

HSBC’s published privacy disclosures do not list Israel as a data processing jurisdiction for customer personal data 46. This is consistent with HSBC’s stated data processing framework but does not cover sub-processor relationships — such as NICE Actimize or CyberArk cloud-hosted components — which are governed by non-public third-party data processing agreements. NICE Ltd. operates R&D and data processing infrastructure in Israel; to the extent that NICE Actimize’s SaaS/cloud components involve data processing in Israeli-domiciled infrastructure, HSBC customer compliance data (transaction patterns, flagged suspicious activity, communications records) may be technically accessible under Israeli legal process 645. This represents a documented data-exposure pathway the precise scope of which cannot be confirmed from public sources.

Similarly, CyberArk’s PAM platform, if deployed at HSBC via CyberArk Privilege Cloud (the cloud-hosted deployment model), would involve HSBC infrastructure-access credentials and logs being processed in CyberArk’s cloud environment. CyberArk’s primary R&D is in Be’er Sheva, Israel 9; whether its cloud infrastructure is domiciled in Israeli data centres is not publicly disclosed. An unconfirmed data-exposure pathway exists contingent on confirmation of the relationship and the deployment architecture.

HSBC does not market or provide cloud infrastructure, data residency, or infrastructure resilience services to third-party state institutions in any jurisdiction. No public evidence has been identified of HSBC providing data sovereignty or infrastructure resilience services to Israeli state institutions, military bodies, or affiliated entities.


Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

HSBC is a commercial banking group. Its publicly disclosed business lines are retail banking, commercial banking, global banking and markets, and wealth management 1325. It is not a defence contractor or technology services provider to military or intelligence agencies in any jurisdiction.

No public evidence has been identified of any HSBC contract, partnership, or service agreement with the Israeli Ministry of Defence, the Israel Defence Forces (IDF), Israeli intelligence agencies (Mossad, Shin Bet, Unit 8200 affiliated entities), or comparable security bodies.

Israeli Defence Sector Technology Vendors — Screening

Elbit Systems is an Israeli defence electronics company; no commercial banking technology relationship with HSBC is identified or plausible 50. Rafael Advanced Defense Systems and Israel Aerospace Industries similarly present no identified or plausible commercial banking technology relationship with HSBC. Palantir Technologies has a publicly documented relationship with Israeli defence and intelligence bodies, as referenced in UN Special Rapporteur reporting (A/HRC/59/23) 32, and has named financial services sector clients including Deutsche Bank and (historically) Credit Suisse; no confirmed HSBC–Palantir relationship has been identified in public sources and Palantir is not referenced in HSBC’s technology strategy disclosures 50.

Dual-Use Technology Provision

No public evidence has been identified of HSBC’s commercially available technology — including its banking platforms, compliance systems, or customer-facing digital infrastructure — being knowingly deployed for military, intelligence, or law enforcement surveillance applications within Israel or the occupied Palestinian territories.

Offensive Cyber & Weapons Technology

No public evidence identified. HSBC does not develop, sell, license, or maintain offensive cyber capabilities, zero-day exploit tooling, or digital weapons systems of any kind. This section presents no findings.


AI, Algorithmic & Autonomous Systems

Internal AI/ML Applications

HSBC’s documented AI strategy is internally focused. Confirmed applications include:

  • Credit risk scoring — algorithmic underwriting support 1016
  • AML transaction monitoring — implemented substantially via NICE Actimize AI/ML modules (Israeli-origin) 615
  • Fraud detection — machine learning-based anomaly detection, including behavioural biometrics as noted above 16
  • Customer service automation — chatbot and virtual assistant deployment 10
  • Network analytics and financial crime detection — via Quantexa (UK-domiciled) partnership 1112
  • Data analytics and risk modelling — using Google Cloud’s Vertex AI platform, as described in Google Cloud Next 2024 presentations and HSBC technology briefings 27
  • Generative AI / internal productivity — HSBC referenced as exploring AWS generative AI infrastructure for internal workloads (2023–2024) and Azure OpenAI Service for internal productivity tools (2024) 4142

The Quantexa relationship is confirmed via a named public partnership announcement 11. Quantexa is UK-domiciled and registered in England; it is not Israeli-origin 12.

AI Provision to Israeli State Bodies

No public evidence has been identified of HSBC providing AI, machine learning, computer vision, or autonomous decision-support systems to Israeli state bodies, military institutions, or security services. HSBC’s AI capabilities are deployed solely within its own commercial banking operations and for its own regulatory compliance 125.

Training Data & Model Development

No public evidence has been identified of HSBC’s AI or machine learning models being trained on, or provided with access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the occupied Palestinian territories.

Autonomous & Lethal Systems

No public evidence identified. HSBC does not develop autonomous targeting, fire-control, weaponised drone management, or kill-chain automation systems. This section presents no findings.


Technology Ecosystem & R&D Footprint

Israeli R&D Centres & Engineering Offices

A systematic review of HSBC’s publicly disclosed office and legal entity locations does not list an R&D centre, engineering office, innovation lab, or technology accelerator within Israel 1325. HSBC operates technology and innovation hubs in London, Canary Wharf, Hong Kong, New York, Pune, Hyderabad, and Kraków, among other locations 1013. The Tel Aviv presence is explicitly a commercial/representative banking office 35. No public evidence identified of an HSBC R&D or technology development facility in Israel.

Acquisitions & Venture Investments

HSBC Ventures — the bank’s venture and growth capital arm — invests in fintech and technology companies. Its publicly disclosed portfolio as of 2023–2024 remains concentrated in the UK, US, and Southeast Asia; no Israeli-origin technology company has been identified as a named portfolio company in HSBC Ventures’ public disclosures 1951. HSBC has been reported in fintech trade press as engaging with the broader Israeli fintech ecosystem through events and early-stage engagements (2021–2023) 19; no specific named Israeli fintech investee company has been confirmed in HSBC Ventures’ public portfolio disclosures for this period.

A documented evidence gap applies: the full HSBC Ventures portfolio is not comprehensively public, and it is possible that Israeli-origin fintech or cybersecurity companies have received investment not disclosed in publicly available materials 51.

Separately, HSBC Asset Management — operating as a passive index investor — holds potential equity stakes in Israeli-listed or Israeli-origin technology companies through index-tracking vehicles as a function of standard asset management operations. This represents passive financial market activity and does not constitute a strategic technology relationship. No Israeli tech acquisitions by HSBC have been identified 31.

Patent & Intellectual Property

A review of HSBC’s patent filings across USPTO, EPO, and WIPO databases does not surface any identified co-development arrangement or joint patent filing with Israeli-domiciled research institutions such as the Technion–Israel Institute of Technology, Hebrew University, or the Weizmann Institute. No public evidence identified of significant patent portfolios, licensing agreements, or co-development arrangements between HSBC and Israeli-domiciled entities or research institutions.


Civil Society Scrutiny & Regulatory History

UN and Authoritative International Bodies

UN OHCHR Business Enterprise Database (HRC Res. 31/36 / 53/25): HSBC is not named in the OHCHR database of business enterprises involved in settlement activity 31. The database focuses on companies with direct operational activities in settlements across construction, infrastructure, real estate, finance, and telecommunications sectors. HSBC’s absence does not exclude findings under other analytical rubrics.

UN A/HRC/59/23 — “From economy of occupation to economy of genocide” (Albanese report, advance unedited version, 2 July 2025 context): HSBC is not named in this report 32. The report’s technology-sector findings (§§36–43) focus on cloud infrastructure providers (Google, Amazon), AI platforms (Palantir, Microsoft), and surveillance/biometrics firms with direct Israeli state and military contracts. The report does reference financial institutions as capital providers enabling the occupation’s technology infrastructure, but does so in the context of bond underwriting and equity provision to named defence and technology companies — a financial rather than technology-supply-chain domain issue. HSBC’s technology vendor relationships are not addressed in the report 32.

ICJ Advisory Opinion (19 July 2024): The ICJ Advisory Opinion establishes obligations for third states and international organisations to not render aid or assistance to the continuation of Israel’s unlawful presence in the occupied Palestinian territory 33. It does not itself impose direct legal obligations on private corporations, though it is relevant to constructive notice frameworks applied in civil society and investor due diligence contexts. No public statement from HSBC documenting any review or modification of technology vendor relationships in response to this opinion has been identified.

ICC Arrest Warrants (21 November 2024): Arrest warrants issued against Benjamin Netanyahu and Yoav Gallant by the ICC Pre-Trial Chamber on 21 November 2024 34. No HSBC public statement, regulatory disclosure, or press report has been identified documenting any review, modification, or termination of any technology vendor relationship or Israeli commercial office operations in response to these warrants.

NGO & Academic Reports

Who Profits Research Center publishes banking-sector reports focusing primarily on construction and real estate finance in Israeli settlements and on financial institutions providing banking services to Israeli defence contractors 1439. As of 2024–2025, HSBC does not appear as a named primary subject in Who Profits’ published technology-sector reports; the technology supply-chain dimension of HSBC’s vendor relationships has not been subject to a dedicated Who Profits investigation 39. HSBC does appear in investor-focused ESG screening frameworks (MSCI ESG, Sustainalytics) that flag its broad financing relationships, but these assessments are financial in nature rather than technology-supply-chain specific 3.

AFSC Investigate: HSBC is listed in the AFSC database in the context of financial relationships (bonds, loans, equity underwriting to screened companies) 37. No V-DIG technology supply-chain findings are associated with HSBC’s AFSC entry 37.

Don’t Buy Into Occupation (DBIO) 2024 and 2025 editions: HSBC is not named as a technology provider in DBIO’s published lists 38. The DBIO framework focuses on companies supplying goods and services that directly enable settlement construction and operation; HSBC’s technology procurement relationships do not fall within DBIO’s primary documented scope 38.

No academic study or UN report specifically addressing HSBC’s technology relationships with the Israeli state has been identified in the reviewed literature.

Boycott, Divestment & Shareholder Campaigns

HSBC has been the subject of Palestine-solidarity boycott and divestment campaign activity in the UK, reported in The Guardian and Palestine Solidarity Campaign materials across the 2010s through 2023–2024 3. These campaigns target HSBC’s financing relationships — specifically its underwriting and lending to companies operating in or providing services to Israeli settlements — not its technology procurement or supply-chain relationships 340. ShareAction and aligned shareholder campaign groups have filed engagement and shareholder resolution activity targeting HSBC’s investment relationships in this context 40. HSBC’s documented public response has been to reference its human rights policy framework and ESG commitments without specific acknowledgement of the cited concerns 3.

No BDS or civil society campaign specifically targeting HSBC’s technology vendor relationships with Israeli-origin firms has been identified in public sources.

HSBC’s regulatory history includes significant enforcement actions — including the 2012 US Department of Justice deferred prosecution agreement for AML failures, settlements related to LIBOR manipulation, and FX rate-rigging penalties — but none of these actions relate to technology sales or services to Israeli state entities 12. The NICE Actimize AML dependency is notable in this context: HSBC’s documented AML compliance failures predate the documented NICE Actimize deployment, and the platform was adopted in part as a remediation measure 615.

No regulatory inquiries, legal challenges, export control actions, or sanctions-related investigations involving HSBC’s technology sales or services to Israeli state entities have been identified.

Evidence Gaps Summary

The following documented gaps constrain the completeness of this audit:

  • HSBC’s full third-party vendor register is non-public; Israeli-origin vendors below the FCA/PRA materiality threshold for operational resilience disclosure cannot be confirmed or excluded 2226
  • The CyberArk and Palo Alto Networks findings rest on trade-press and vendor case-study references, not HSBC-authored primary disclosures 895
  • The precise contractual scope of the NICE Actimize relationship (global vs. regional; modules licensed; current contract duration; data processing jurisdiction) is not publicly documented 645
  • The HSBC Ventures full portfolio is not comprehensively disclosed 51
  • Managed security service provider sub-stacks — which could include Israeli-origin tooling — are not publicly disclosed
  • The behavioural biometrics fraud-detection vendor is unconfirmed; BioCatch (Israeli-founded, dominant in UK banking) is the leading candidate but no direct confirmation has been found 23
  • The IT infrastructure serving HSBC’s Tel Aviv representative office is undisclosed 35
  • [New — expansion run] Cloud regional tenancy configuration for Google Cloud (me-west1, Israel) and AWS (il-central-1, Israel) is commercially confidential; whether HSBC workloads traverse Israeli hyperscaler regions cannot be confirmed or excluded 4344
  • [New — expansion run] Whether NICE Actimize’s SaaS/cloud components process HSBC compliance data within Israeli-domiciled infrastructure is undisclosed, representing an unquantified data-exposure pathway 4546
  • [New — expansion run] Whether CyberArk Privilege Cloud components process HSBC infrastructure-access data in Israeli-hosted environments is undisclosed 930
  • [New — expansion run] Imperva (Israeli-founded WAF/DDoS vendor, now Thales-owned) is prevalent in UK banking infrastructure; no HSBC confirmation but no dedicated investigation found in public sources
  • Sub-10% shareholder personal investments in family-office vehicles below disclosure thresholds cannot be confirmed or excluded 28

End Notes


  1. https://www.hsbc.com/investor-relations/results-and-announcements/annual-results/2024 

  2. https://www.hsbc.com/investor-relations/results-and-announcements/annual-results/2023 

  3. https://www.hsbc.com/who-we-are/esg-and-responsible-business/esg-data 

  4. https://cloud.google.com/blog/topics/financial-services/hsbc-and-google-cloud-announce-multi-year-partnership 

  5. https://www.paloaltonetworks.com/customers/hsbc 

  6. https://www.niceactimize.com/financial-crime/customers 

  7. https://www.nice.com/about/company-overview 

  8. https://www.cyberark.com/customers/ 

  9. https://www.cyberark.com/company/ 

  10. https://www.hsbc.com/investor-relations/results-and-announcements/investor-update 

  11. https://www.quantexa.com/news/hsbc-partnership/ 

  12. https://www.quantexa.com/about/ 

  13. https://www.hsbc.com/who-we-are/our-global-businesses 

  14. https://whoprofits.org/ 

  15. https://www.niceactimize.com/resources/white-papers 

  16. https://ibsintelligence.com/ibsi-news/ 

  17. https://www.paloaltonetworks.com/company/our-story 

  18. https://www.calcalistech.com/ctech/articles/0,7340,L-3908951,00.html 

  19. https://www.hsbc.com/who-we-are/businesses-and-customers/hsbc-ventures 

  20. https://www.verint.com/industries/financial-services/ 

  21. https://www.ibm.com/industries/banking-financial-markets 

  22. https://www.fca.org.uk/publications/policy-statements/ps21-3-operational-resilience 

  23. https://www.biocatch.com/customers 

  24. https://www.biocatch.com/news/biocatch-raises-145-million 

  25. https://www.hsbc.com/investor-relations/results-and-announcements/annual-results/2025 

  26. https://www.hsbc.com/investor-relations/regulatory-and-prudential-disclosures/pillar-3 

  27. https://cloud.google.com/blog/topics/financial-services 

  28. https://www.hsbc.com/investor-relations/results-and-announcements/agm 

  29. https://www.pingan.com/en_web/investor/ 

  30. https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=CYBR 

  31. https://www.ohchr.org/en/hr-bodies/hrc/regular-sessions/session31/res-31-36 

  32. https://www.ohchr.org/en/documents/thematic-reports/ahrc5923-report-special-rapporteur-situation-human-rights-palestinian 

  33. https://www.icj-cij.org/case/186 

  34. https://www.icc-cpi.int/news/statement-icc-prosecutor-karim-aa-khan-kc-applications-arrest-warrants-situation-state-palestine 

  35. https://www.boi.org.il/en/banking-in-israel/banks-and-their-branches/ 

  36. https://www.wiz.io/customers 

  37. https://investigate.afsc.org/company/hsbc 

  38. https://dontbuyintooccupation.org/ 

  39. https://whoprofits.org/industries/banks-and-finance/ 

  40. https://shareaction.org/ 

  41. https://aws.amazon.com/financial-services/ 

  42. https://azure.microsoft.com/en-us/industries/financial/ 

  43. https://cloud.google.com/about/locations/ 

  44. https://aws.amazon.com/about-aws/global-infrastructure/ 

  45. https://www.niceactimize.com/blog 

  46. https://www.hsbc.com/privacy-and-legal/privacy 

  47. https://www.checkpoint.com/customers/ 

  48. https://cellebrite.com/en/home/ 

  49. https://sentinelone.com/customers/ 

  50. https://www.palantir.com/industries/financial-services/ 

  51. https://www.hsbc.com/who-we-are/businesses-and-customers/hsbc-ventures 

Related News & Articles