V-DIG Domain Audit — HSBC Holdings plc

Audit Date: [Compiled from research memo dated 2024-2026] Target Entity: HSBC Holdings plc Audit Phase: V-DIG (Verified Digital InfrastructureGhost) Audit Classification: Unclassified / For Research Purposes

Enterprise Technology Stack & Vendor Relationships

HSBC deploys a multi-layered enterprise technology stack incorporating several prominent vendors across its global banking infrastructure. The institution’s anti-money-laundering (AML) capabilities are substantially powered by Google Cloud’s artificial intelligence platform, which processes approximately 1.2 billion transactions monthly across the United Kingdom and Hong Kong ¹. This implementation represents a core compliance infrastructure dependency, functioning as the primary system for regulatory-mandated transaction monitoring within HSBC’s largest operating markets.

In the domain of privileged access management (PAM), HSBC maintains a confirmed relationship with CyberArk, as evidenced by internal job postings specifying CyberArk as a key product managed within HSBC infrastructure ². The PAM deployment governs access to production banking systems and represents a foundational identity-security dependency for the financial institution.

HSBC’s fraud prevention capabilities incorporate behavioral biometrics solutions from multiple vendors. The bank is confirmed as a customer of BioCatch, an Israeli-origin behavioral biometrics company, and participates as a member of the BioCatch Client Innovation Board alongside American Express, Barclays, Citi, and National Australia Bank ³⁴. This board membership indicates a deeper collaborative relationship extending beyond mere procurement. Separately, HSBC has deployed Featurespace’s ARIC platform for retail banking and insurance fraud prevention, representing a distinct vendor relationship with a United Kingdom-based provider ⁵.

The scale of HSBC’s technology dependency on these vendors is substantial. The Google Cloud AML AI deployment constitutes a mission-critical compliance system subject to regulatory oversight by multiple financial authorities. The CyberArk PAM implementation governs administrative access across production environments, representing a critical security control point.

No public evidence has been identified confirming whether HSBC’s third-party system integrators—including Accenture, Wipro, or Infosys—specifically mandate or deploy Israeli-origin technology within their HSBCcontracted engagements.

Surveillance, Biometrics & Retail Technology

HSBC’s deployment of surveillance and biometric technologies spans both behavioral biometrics and predictive analytics capabilities. The bank utilizes BioCatch’s behavioral biometrics platform for fraud detection across its United States, United Kingdom, and Asia-Pacific operating regions ³⁴. BioCatch’s technology analyzes user interaction patterns—including keystroke dynamics, mouse movements, and device handling—to identify fraudulent activity in real time, providing continuous authentication without requiring explicit user intervention.

Complementing the BioCatch deployment, HSBC employs Featurespace’s ARIC platform specifically for retail banking and insurance fraud prevention ⁵. This platform applies machine learning to detect anomalies in transaction patterns and customer behavior, representing a secondary layer of algorithmic surveillance within the retail banking operation.

For predictive analytics and transaction monitoring, HSBC leverages Google Cloud’s artificial intelligence and machine learning capabilities within its AML infrastructure ¹. This system processes the aforementioned 1.2 billion monthly transactions, applying algorithmic models to identify suspicious patterns indicative of money laundering, terrorist financing, or other financial crimes.

No public evidence has been identified of third-party deployments wherein bundled Israeli-origin technology is integrated into HSBC’s retail operations beyond the direct vendor relationships confirmed above.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

HSBC operates a multi-cloud strategy, maintaining relationships with both Google Cloud and Amazon Web Services. The migration to AWS was announced in 2023 as a multi-year deal, representing a significant infrastructure transition ⁶. The bank also maintains confirmed usage of Google Cloud for its AML processing capabilities ¹.

Regarding data centre operations within Israel, no public evidence has been identified confirming that HSBC operates, leases, or co-locates data centre infrastructure within Israeli territory. HSBC maintains a commercial and representative office in Tel Aviv (Ramat Gan) serving corporate banking clients, but this appears to be a conventional banking presence rather than infrastructure hosting ⁷⁸.

With respect to government cloud contracts, no public evidence has been identified confirming HSBC’s participation in Project Nimbus or any Israeli government cloud initiative. Project Nimbus represents a cloud services contract between Google, Amazon, and the Israeli government for government workloads ⁹. HSBC, as a commercial banking institution, is not a party to this governmental procurement.

In the realm of data sovereignty and resilience services, no public evidence has been identified confirming HSBC providing data sovereignty or infrastructure resilience services to Israeli state institutions. The bank’s cloud deployments serve its own operational requirements and those of its commercial customers.

Regarding Israeli cloud region tenancy: Google Cloud’s me-west1 region (located in Israel/Tel Aviv) launched in November 2022 and forms part of the infrastructure supporting Project Nimbus ¹⁰⁹. While HSBC uses Google Cloud globally ¹, no public evidence confirms whether HSBC workloads traverse the Israeli cloud regions (me-west1) or the analogous AWS il-central-1 region. This constitutes a gap requiring further verification through technical architecture review or vendor confirmation.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence has been identified of HSBC holding contracts, partnerships, or service agreements with the Israeli Ministry of Defence, the Israel Defense Forces (IDF), or any Israeli intelligence agencies.

No public evidence has been identified confirming that HSBC’s commercially available technology has been knowingly deployed for military, intelligence, or law enforcement applications in Israel or the occupied Palestinian territories.

No public evidence has been identified indicating that HSBC develops, sells, licenses, or provides offensive cyber capabilities or weapons technology.

AI, Algorithmic & Autonomous Systems

No public evidence has been identified of HSBC providing artificial intelligence, machine learning, or autonomous decision-support systems to Israeli state bodies, military institutions, or security services.

No public evidence has been identified confirming that HSBC artificial intelligence models are trained on data originating from Israel or the occupied Palestinian territories.

No public evidence has been identified indicating that HSBC develops autonomous targeting or weapons systems. The bank’s artificial intelligence applications remain confined to financial services, including fraud detection, anti-money-laundering, and customer service automation.

Technology Ecosystem & R&D Footprint

HSBC’s technology ecosystem presence in Israel is limited to a commercial banking operation rather than research and development activities. No public evidence has been identified confirming HSBC operating R&D facilities, engineering offices, or innovation laboratories within Israeli territory. The HSBC Israel operation functions as a corporate banking representative office ⁷⁸.

In the domain of acquisitions and investments, HSBC provided $550 million in financing to Core42 in 2026, a G42-backed artificial intelligence infrastructure company, to support expansion across the United States and Europe ¹¹. This relationship positions HSBC as a financier rather than a technology customer. Separately, HSBC participated as an investor in BioCatch’s $20 million Series C extension in 2020, investing alongside American Express Ventures, Barclays, Citi, and National Australia Bank ³. This represents a strategic investment in the behavioral biometrics vendor.

Historically, HSBC held 16,317 shares in Elbit Systems valued at approximately $8.3 million as of September 2025. Following a direct action campaign led by advocacy groups, HSBC achieved full divestment from Elbit Systems by May 2026 ¹². Elbit Systems is an Israeli defense manufacturer specializing in unmanned aerial systems, electronic warfare, and military communications.

No public evidence has been identified of patent portfolios, licensing agreements, or co-development arrangements between HSBC and Israeli-domiciled research institutions.

Civil Society Scrutiny & Regulatory History

The United Nations Human Rights Office updated its database of businesses involved in Israeli settlements in September 2025, expanding the list to 158 companies ¹³. No public evidence confirms whether HSBC is specifically named in this database.

The “Don’t Buy Into Occupation” (DBIO) 2024 report, published by the International Federation for Human Rights (FIDH), identifies HSBC among European financial institutions providing significant lending—totaling approximately $14.21 billion between 2020 and 2023—to companies linked to Israeli settlements in the occupied West Bank ¹⁴.

HSBC appears in BDS (Boycott, Divestment, Sanctions) campaign materials citing approximately €1 billion in financing for the Tel Aviv Light Rail (Purple Line), a transit project serving routes through areas adjacent to Israeli settlements ¹⁵.

HSBC has been the subject of divestment campaigns targeting financing relationships. Most notably, the “People Against Genocide” campaign targeted HSBC for its investment in Elbit Systems, resulting in full divestment by May 2026 ¹². However, no public evidence has been identified of BDS or civil society campaigns specifically targeting HSBC’s technology vendor relationships with Israeli-origin firms such as BioCatch.

No regulatory inquiries, legal challenges, export control actions, or sanctions investigations involving HSBC’s technology sales or services to Israeli state entities have been identified in publicly available sources.

End Notes